Bitcoin paypal phish from Microsoft Outlook Part 4





Haresasz Nxysarwsa has invited you to PayPal Payment Received – Bitcoin Order Processing

Title: PayPal Payment Received – Bitcoin Order Processing

When: July 8, 2026

Organizer:

Haresasz Nxysarwsa

Description: Dear Customer,



We are pleased to confirm that your PayPal payment has been received successfully. Your Bitcoin (BTC) purchase request is now being processed by our system.



Transaction Summary:

Order Type: Bitcoin (BTC)

Payment Method: PayPal

Amount Charged: $520.00

Status: Processing



Your order is currently undergoing verification and will be completed shortly.



If you did not authorize this transaction, please contact our support team immediately at +1 802 610 2070.



Thank you for choosing our service.



Sincerely,

Billing Department

Attendees:



cynthiaperez389903@groups.outlook.com





Dear Customer,



We are pleased to confirm that your PayPal payment has been received successfully. Your Bitcoin (BTC) purchase request is now being processed by our system.



Transaction Summary:

Order Type: Bitcoin (BTC)

Payment Method: PayPal

Amount Charged: $520.00

Status: Processing



Your order is currently undergoing verification and will be completed shortly.



If you did not authorize this transaction, please contact our support team immediately at +1 802 610 2070.



Thank you for choosing our service.



Sincerely,

Billing Department

Kedy

streda 8. júl 2026

Organizátor

Haresasz Nxysarwsa

haressaznzxrrsxaxz321@gmail.com

Hostia

(Zoznam hostí bol na žiadosť organizátora skrytý)

Odpoveď na cynthiaperez389903@groups.outlook.com

Áno



Nie



Možno

Ďalšie možnosti



Pozvánka z Kalendára Google



Túto správu ste dostali, pretože ste účastníkom danej udalosti.



Ak túto pozvánku prepošlete, ktorýkoľvek jej príjemca bude môcť odoslať odpoveď organizátorovi, byť pridaný do zoznamu hostí, pozývať iných bez ohľadu na ich vlastný stav pozvánky alebo meniť vaše potvrdenie účasti. Ďalšie informácie

Bitcoin paypal phish from Microsoft Outlook Part 2

X-Microsoft-Antispam-Message-Info:

=?utf-8?B?ODN4aVY5WlM4enpqR3dUbklEelhTZ2tZUlQyYjFlRXplM1h6Zk56ajNubmJD?=

=?utf-8?B?akI1YUEwSWN5V3RRYTZJRm1SZXlNNHBFbjUrNUxZUlR2NlpXakxURndFbG1r?=

=?utf-8?B?MVROVFFrNEpyNEo3SnN4cDd1aTBBSVFlYno5TjloclBCQUk3TVM0NzJRdkpY?=

=?utf-8?B?a1NteGZjTk1YMjJwUWNtWFVhTmFEWXNyMGlFK1lTSGtERllVNFJyMlhMMlBr?=

=?utf-8?B?QlE4UUxrK2pLWlJMUGVSTDYyc1Y1dEJyS3ZqQ3krSFI5cThhdVpBNThHVXgv?=

=?utf-8?B?UWRIdzBTZ25tS0lkb0E2UXN5ZjFELzlWL29oUGtoNEo4STk4RUxETE9Fa0dn?=

=?utf-8?B?Vk1WWDZZdEVRNTBTZ1IxQTdLeHNDUGlNVi9uTmVOOENhQ2F0Zm1CaFdmalAw?=

=?utf-8?B?MENNZVhZczBncmw5bE9IZUt5Ty9JbFBFeU54dnNrT3h0ejlScXJLU00xZDEv?=

=?utf-8?B?eGYyWjE4Tk80V0xEVzh5Z1EvTk1jT1lkNGJRaExobUFMUFdHS05LREVSK2Y0?=

=?utf-8?B?YkErQnhNNTFlSHU0TTZZbVNPVEpZZEx5QjZlUVdHL1VuZENseTQvUWhvV0hF?=

=?utf-8?B?aU1EL1NoczNwdHdnRElyWXlONnFIU1J3aHhadHhSc3ZUZ1VKQmJYQy9NN1Bo?=

=?utf-8?B?WUNtaHR4Zk9FeitEMCtPV2pBRlcwM0FuUnZES05mSi90R2p4NFFJNUtKV1Jq?=

=?utf-8?B?SGljVkw4RTNKUWYvVmFWVkJVT2NVMFBnL1JMQVhkeXF0dXZ3UEdaaVpoRUps?=

=?utf-8?B?aGpOVGNvYnFjcnJRSFZrNmdycnhpS21OV0pPcXBhQ2t2dGJPc1Z5eEd4cm56?=

=?utf-8?B?TFdGZ2dSQWZFaG5XakVBU3ZFSnYvNWFnZDlUNmhvOUFsTzJ1YUw5bU9Rb3dG?=

=?utf-8?B?N0tKdDVvNWlYWVN2aGRNSmNSSUhnUUxlYjR5TUJHc2R5YVlEcDRpS3RtNDRF?=

=?utf-8?B?QXUrVU02ZnNNSjM4R3F4b1pUOTJyMlQyRlNmSERrMG1qZ1hRaVJhMnpmY2dH?=

=?utf-8?B?anliR25obU0weS84YkpzWDhVQ2xoRVZOY21DQ1RhdThOaVR4dG5FY3R5SlZN?=

=?utf-8?B?b0VDY3RlOVNYQ3Q2ZHVhOElPa3lNUVRzS1dUVENLYU95STRwRnc5WGM5UEVI?=

=?utf-8?B?TnJnN1R2bWJaWlNxbmhNUGZsWWV4aDBHMXhkZW04dU5IL3ZuRnBtL1pJREtk?=

=?utf-8?B?aDg2RVQ5MWVXOVFrZ0NCVko1NE1ocHB2Rm90ZnlJcUMvZ2JKMy8zR0lyN2ds?=

=?utf-8?B?cWxqK1JZaEVLWDR6VGJRZTkyTkZsdHRJVnFRL0x6TFdVLzB6NHEzS2hGaDBt?=

=?utf-8?B?R2JqekRiQkRaZk1CalVOOFBhT3RHaXMyZFNLMThHUXYxRm1BZU5SSSsxVklD?=

=?utf-8?B?bzhPTmRBdHJaSkNmMUlWd1pncFpZQk5YOThScjFsQXpxT05pODVRTHU2Y0FG?=

=?utf-8?B?V3pFcGJoOXhKeHFlaGExWVI0a0xFWFJ1UjVyNnAwalFIVzFLcUJXWm56a1Nq?=

=?utf-8?B?SS9wQ05OK3Vzc0J6eHBGYkU5UTZlVFV1THlHRm5vcFZkd2ZDVjNRRG44blVQ?=

=?utf-8?B?THFUY2RjU05BNlgvNDJ6ZUxYdFpWNGtmck9kTGpEMXByMHYwTkFhWlJHclBY?=

=?utf-8?B?K2dwdG1lM0NqVzVVNkxwUy9ML0hjUEV0d240dVZ0TTQxVEYrc2tRMFNBWGpz?=

=?utf-8?B?R0wzdzlsdnJwYTJRMGRpTlRNejFSSWlQUVBzREZLL2ZpZFdJdGFwVVA5eVU0?=

=?utf-8?B?dVkxRk1KZEIxQlN0L2QwSm9PUm5KRU00aFlxbEFaR1JSamkzOEswR1dNNVVw?=

=?utf-8?B?QlJidFJRcVR0cTR2bVFiVi81elBOcFRLSTJEaUpyVTVTV0xrTVRYZ3dVc0I2?=

=?utf-8?B?QlVyWkN2bXFGcXgrM3RXVTNUcEs2ZjZXbmd0K0QwSFJPcFlFZXppdmFSa1pj?=

=?utf-8?B?QlN6bTQxOTl4N3BMZzRHUVhRMHNEY1NVWHh2QUhEcERrbUk3dHpoMWdITmdI?=

=?utf-8?B?dlRBNytLZC9ZZmlzaSt1SUhNTkxUbGF6dGJDbjl4R0tuZE5sM2lWazZaeUNT?=

=?utf-8?B?bkx2NDJlN0hORTg2UGZYRzRKR3RseW9CZGtVU1lnNU8xalA4NkpRWXRzWkFH?=

=?utf-8?B?UE9BV3c4N2libGxhT01PL0dtM2xpWVpPaVgza0VFKzc3QzdUYnV3VkZJa01B?=

=?utf-8?B?aUVBcXFZcDBZcWRCcGowUUtQSVMzS3BCYUkzUTllZGtkYVltdVZTSmtEY3Bj?=

=?utf-8?B?ZkdBWUF1MW82YXQ0anoyMzJpd2VEeEJlWDVjeHRFVGlKUy80cTVudnN4Q2N2?=

=?utf-8?B?VmF0Y3ZlUHNrblhSanVPZ0t3QjZtTlhESWt0MlR1WjUzUVhra3g4Y0NtS2RZ?=

=?utf-8?B?eElpVkVoQVJmZDkwMXljV2h4anpzaU9pYkNjVUt3UENDdm8rMCtDVjVzc29N?=

=?utf-8?B?R1JBd3Z3dlQyR3lQN1F2ZERqRkZHdGFuNk1NcTdWSHc4Mk1sWXhRS0dGcDJ3?=

=?utf-8?B?S1VWbzBxSDFSQWJHY0xoYjIvd0NobjlPR3ZpcG1xeitkSlBpVHFkTHZnS1pH?=

=?utf-8?B?aUx5RTJWSVBKbTJCcmJYYUVtQTl4bVRpcW5YYVpxQ3dkVWU0NDV2MEhObGtE?=

=?utf-8?B?MHFaVWZrMzFkUUg0VDRORG05ZXZrdTdveGszc0hoNnFOM3UydUdKNGZFWXhQ?=

=?utf-8?B?aWVzN09mYmdnbnpRMHQ1Tm5icTYzRGJ6amIreXdPa1F4K2hiemtoMTlocDVY?=

=?utf-8?B?cjJoN0F4SGkvTlJlbUZxdCtIN1pTVHJsV082Y0JUbSt3b1NlaDlXMWUyQ3RF?=

=?utf-8?B?bVpNMzZjNHNwVkwwR1hzY1JWbG0zVEFqRGQrVnhKeDBRTk9PU0JMTXlpS05E?=

=?utf-8?B?S0FyZit3ZngyNThERFVraXU2aExqNTZ3SzROOXhtOFEzWHJKamllZ2wxZk03?=

=?utf-8?B?L1Qxc3c4Q0luaHNreC9tdHhDdXhNVzRXZFVJVC82bkwxWE1MSTg1cU5qenl3?=

=?utf-8?B?d2Y0aXZDZ2M5YXFrOXZwdEJkRklmSWNBRUkzeGlhYm0zbVRWNS83bHd4dzFw?=

=?utf-8?B?VC8rWFViUWVrNDc4UXp3Tkp5d3hIbjFBeWJVSXljREVxUXFVcTFiMnA0T2o5?=

=?utf-8?B?TW9YT2Z4V25KQUd5UWFnQTlSMkNsaWxqUCthRWRncmo5NENZbENQSHlsOUtx?=

=?utf-8?B?Rmw2WFg4YzBCczlPRkRNQ05vTVBweWltampDTGNNYit3TDdydEtJUlllRUJw?=

=?utf-8?B?eUdOcW1GeW1ubk8wTWMxNnRlRTY3R3I0Vmh5VnRoNndLV3FsZ0pmdHNURFlC?=

=?utf-8?B?OU1XZmpOdjdSZ042U1hNRGZXSnFZR0ZZai9wMlZuNnNNMURGTWljdWdyZUVj?=

=?utf-8?B?U0NZY1YyaXgwdFdMUHpiV1pkdnJNVlJqN2l4L0l6bjJzeFYyL2dpNGs2bGQw?=

=?utf-8?Q?45yISvSLdjgXgZ38QV0=3D?=

X-Auto-Response-Suppress: DR, OOF, AutoReply

X-OriginatorOrg: sct-15-20-9412-4-msonline-outlook-090a5.templateTenant

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 08 Jul 2026 16:16:52.5695

(UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id: f7c0d972-a3cd-4503-0b98-08dedd0c5276

X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-AuthSource: CH2PEPF00000142.namprd02.prod.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: Internet

X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA3PR18MB5297

X-Spam_score: 13.7

X-Spam_score_int: 137

X-Spam_bar: +++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: PayPal Payment Received – Bitcoin Order Processing streda

8. júl 2026 Dear Customer, We are pleased to confirm that your PayPal payment

has been received successfully. Your Bitcoin (BTC) purchase request is now

being processed by our system.

Bitcoin paypal phish from Microsoft Outlook Part 3

Content analysis details: (13.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[40.93.20.59 listed in dnsbl.ahbl.org]

[40.93.20.59 listed in dnsbl.ahbl.org]

[40.93.20.59 listed in dnsbl.ahbl.org]

[40.93.20.59 listed in dnsbl.ahbl.org]

[209.85.208.71 listed in dnsbl.ahbl.org]

[209.85.208.71 listed in dnsbl.ahbl.org]

[209.85.208.71 listed in dnsbl.ahbl.org]

[209.85.208.71 listed in dnsbl.ahbl.org]

[2603:10b6:610:1f3:0:0:0:26 listed in]

[dnsbl.ahbl.org]

[2603:10b6:610:1f3:0:0:0:26 listed in]

[dnsbl.ahbl.org]

[2603:10b6:610:1f3:0:0:0:26 listed in]

[dnsbl.ahbl.org]

[2603:10b6:610:1f3:0:0:0:26 listed in]

[dnsbl.ahbl.org]

[2603:10b6:610:1f3:cafe:0:0:21 listed in]

[dnsbl.ahbl.org]

[2603:10b6:610:1f3:cafe:0:0:21 listed in]

[dnsbl.ahbl.org]

[2603:10b6:610:1f3:cafe:0:0:21 listed in]

[dnsbl.ahbl.org]

[2603:10b6:610:1f3:cafe:0:0:21 listed in]

[dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[40.93.20.59 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[40.93.20.59 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[40.93.20.59 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[40.93.20.59 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.208.71 listed in will-spam-for-food.eu.org]

[209.85.208.71 listed in will-spam-for-food.eu.org]

[209.85.208.71 listed in will-spam-for-food.eu.org]

[209.85.208.71 listed in will-spam-for-food.eu.org]

[209.85.208.71 listed in will-spam-for-food.eu.org]

[209.85.208.71 listed in will-spam-for-food.eu.org]

[209.85.208.71 listed in will-spam-for-food.eu.org]

[209.85.208.71 listed in will-spam-for-food.eu.org]

[2603:10b6:610:1f3:cafe:0:0:21 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:1f3:cafe:0:0:21 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:1f3:cafe:0:0:21 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:1f3:cafe:0:0:21 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:1f3:cafe:0:0:21 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:1f3:cafe:0:0:21 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:1f3:cafe:0:0:21 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:1f3:cafe:0:0:21 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:1f3:0:0:0:26 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:1f3:0:0:0:26 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:1f3:0:0:0:26 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:1f3:0:0:0:26 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:1f3:0:0:0:26 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:1f3:0:0:0:26 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:1f3:0:0:0:26 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:1f3:0:0:0:26 listed in]

[will-spam-for-food.eu.org]

[40.93.20.59 listed in will-spam-for-food.eu.org]

[40.93.20.59 listed in will-spam-for-food.eu.org]

[40.93.20.59 listed in will-spam-for-food.eu.org]

[40.93.20.59 listed in will-spam-for-food.eu.org]

[40.93.20.59 listed in will-spam-for-food.eu.org]

[40.93.20.59 listed in will-spam-for-food.eu.org]

[40.93.20.59 listed in will-spam-for-food.eu.org]

[40.93.20.59 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[40.93.20.59 listed in list.dnswl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[40.93.20.59 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[40.93.20.59 listed in bl.score.senderscore.com]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

1.0 HK_RANDOM_FROM From username looks random

1.0 HK_RANDOM_REPLYTO Reply-To username looks random

0.5 FROM_LOCAL_NOVOWEL From: localpart has series of non-vowel letters

3.5 VOWEL_FROM_7 Impronouncable from header (7+ consecutive vowels)

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[haressaznzxrrsxaxz321(at)gmail.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[haressaznzxrrsxaxz321(at)gmail.com]

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.6 MEGALONGWORD BODY: Uses really overlong words

0.3 LONGWORD BODY: Uses overlong words

0.1 TW_RW BODY: Odd Letter Triples with RW

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.2 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and EnvelopeFrom

freemail headers are different

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.1 TO_IN_SUBJ To address is in Subject

3.0 LONG_INVISIBLE_TEXT Long block of hidden text - bayes poison?

Subject: {SPAM?} =?UTF-8?Q?Pozv=C3=A1nky=3A_PayPal_Payment_Received_=2D_Bitcoin_Order_P?=

=?UTF-8?Q?rocessing_=40_st_8=2E_j=C3=BAl_2026_=28cynthiaperez389903=40groups=2Eoutlo?=

=?UTF-8?Q?ok=2Ecom=29?=

Bitcoin paypal phish from Microsoft Outlook Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 08 Jul 2026 13:40:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1whY7j-000000000ZX-144P

for dave@doctor.nl2k.ab.ca;

Wed, 08 Jul 2026 13:39:59 -0600

Resent-From: The Doctor

Resent-Date: Wed, 8 Jul 2026 13:39:59 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-northcentralusazlp17013059.outbound.protection.outlook.com ([40.93.20.59]:43609 helo=CH4PR04CU002.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1whUyC-00000000F9w-42iL

for doctor@doctor.nl2k.ab.ca;

Wed, 08 Jul 2026 10:18:08 -0600

Received: from CH5P223CA0012.NAMP223.PROD.OUTLOOK.COM (2603:10b6:610:1f3::26)

by SA3PR18MB5297.namprd18.prod.outlook.com (2603:10b6:806:2f5::21) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.181.8; Wed, 8 Jul 2026

16:16:52 +0000

Received: from CH2PEPF00000142.namprd02.prod.outlook.com

(2603:10b6:610:1f3:cafe::21) by CH5P223CA0012.outlook.office365.com

(2603:10b6:610:1f3::26) with Microsoft SMTP Server (version=TLS1_3,

cipher=TLS_AES_256_GCM_SHA384) id 15.21.202.10 via Frontend Transport; Wed, 8

Jul 2026 16:16:52 +0000

Authentication-Results: spf=pass (sender IP is 209.85.208.71)

smtp.mailfrom=gmail.com; dkim=pass (signature was verified)

header.d=google.com;dkim=pass (signature was verified)

header.d=gmail.com;dmarc=pass action=none header.from=gmail.com;compauth=pass

reason=100

Received-SPF: Pass (protection.outlook.com: domain of gmail.com designates

209.85.208.71 as permitted sender) receiver=protection.outlook.com;

client-ip=209.85.208.71; helo=mail-ed1-f71.google.com; pr=C

Received: from mail-ed1-f71.google.com (209.85.208.71) by

CH2PEPF00000142.mail.protection.outlook.com (10.167.244.75) with Microsoft

SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.181.6

via Frontend Transport; Wed, 8 Jul 2026 16:16:52 +0000

X-IncomingTopHeaderMarker:

OriginalChecksum:1EA79E97E65E2B7DC29FE722E92FD6438F828F1DF45FA6321AA092EA34F57726;UpperCasedChecksum:244DFA4593E86FB87BCE59FFACB32ECD109CBFAE4326CA501E630FAB11B03B90;SizeAsReceived:3520;Count:15

Received: by mail-ed1-f71.google.com with SMTP id 4fb4d7f45d1cf-698a99b6140so1406083a12.1

for ; Wed, 08 Jul 2026 09:16:52 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=google.com; s=20251104; t=1783527411; x=1784132211; darn=groups.outlook.com;

h=content-type:to:from:subject:date:message-id:sender:reply-to

:mime-version:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=RrtI0PdFi3vgg3TInDGMo/ZU5qO8Ll+UGGMq3GBIYEE=;

b=PVc5h7c1qBW/JSCrCqYJJwNFfWgAKb1ra4ewKfGNPWpw4XHamMu3do/Jama5ez6RoW

ho1QSxTU5fPWKnxx1Cou65p0Gw2uOxqIrFAzZZ7GCbgT722d28ePD49N5Pw07NH3J3/G

2P23wjEpHe9BfRuksgS6l2M4mr/O5vG5RDOJqlUYQTGIq1BEb0WHREb0u+QIG7nOH8Y3

oXAWelfwFcWTyKn1idoBcTQLKcPGWjvudb3ESaAgcYJaBPEw5J5kRpDTEUnlei7rH6Q2

UxpHp/SAWI/xaUHagBbuvE3jEPb9M9aWrBr5I0Jnp3wdrcCgVrXdOwkaXvtNDkplbnNQ

bGmg==

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1783527411; x=1784132211; darn=groups.outlook.com;

h=content-type:to:from:subject:date:message-id:sender:reply-to

:mime-version:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=RrtI0PdFi3vgg3TInDGMo/ZU5qO8Ll+UGGMq3GBIYEE=;

b=ZpEaA5Ugie+Jv/Ua3KJNyziiqJPvWYdHGc/tYKGG55BT/RW/CMzaBqmx7vxPuM7vQT

o9ILwrD1GdtMVfYw+bjmgx7KmNGaqUplCk81KrVelnLOoaSQ4pdRzGjx88j/wEZP7J3R

KKYW5Vwq9ttRjXHruBeV572nj25iErtIHvjbbo6FX7e6tzgaH/qiUBbCZ5rD4VmoHlLU

Qy5OBMc2FoP4CjKHVaPskusy99CP5+2tKpeYW7VEBikAhfh4aQy3Mt+Ujo+naBhgj9kT

r06ytSwQGSVRMOaOkeYOqFzGkhZQzXmyh+sGHlD39LKb5Iy3QoTeAg9Ds1pKaNI8OdDV

3ilg==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1783527411; x=1784132211;

h=content-type:to:from:subject:date:message-id:sender:reply-to

:mime-version:x-gm-message-state:from:to:cc:subject:date:message-id

:reply-to:content-type;

bh=RrtI0PdFi3vgg3TInDGMo/ZU5qO8Ll+UGGMq3GBIYEE=;

b=GDJAcSLxs+N2GoIbEOk2wjzFYiquRJsRcf4aYQnAJxYO7fm3MjamcFH57aFevbff9p

LubTLedlsJ/6+c70tFAyrlXbnHm8vKV5ZjauFDgOwxd8n0d/9s7wXkt1A67RcdVqfY0J

BOOpLdHB6KwtbsDC8Jd7uPrPH4qaPwfz65H3jXhDArS/OdEhvMBlz6jmJDJD5IjWsvO7

7AGzZZidcoKm2U4GdlNYgcX/8W+63e6CTaExfAmeajxk6R2NyENV9rWVQIKeAIUZFe4Q

XlfL0Oync0gyEpKLipGaZPGeclGhpfy68rytqkoZMxtxq4UMV+bxHwNYLiHmK83pYSiY

oDzQ==

X-Gm-Message-State: AOJu0YwIvLOiPiqvefjlYpnUfl3T4bRFqxBYcOj4EY21vff1Je9KKn+3

KzobdRfkQygIv0rmpVOYznkaqIov77BkuWMAWb3MuUL6ts5LUSkOyE2uC20//6HNU3DF1jZ/VcO

gnhPJb2ygxL8UQudhrfseuzfMUKUh+pWFp6s=

MIME-Version: 1.0

X-Received: by 2002:a05:6402:146b:b0:698:821d:aa37 with SMTP id

4fb4d7f45d1cf-69ab449d979mr1296070a12.24.1783527411343; Wed, 08 Jul 2026

09:16:51 -0700 (PDT)

Reply-To: Haresasz Nxysarwsa

Sender: =?UTF-8?Q?Kalend=C3=A1r_Google?=

Message-ID:

Date: Wed, 08 Jul 2026 16:16:51 +0000

Subject: =?UTF-8?Q?Pozv=C3=A1nky=3A_PayPal_Payment_Received_=2D_Bitcoin_Order_P?=

=?UTF-8?Q?rocessing_=40_st_8=2E_j=C3=BAl_2026_=28cynthiaperez389903=40groups=2Eoutlo?=

=?UTF-8?Q?ok=2Ecom=29?=

From: Haresasz Nxysarwsa

To: cynthiaperez389903@groups.outlook.com

Content-Type: multipart/mixed; boundary="000000000000cce8b006561bd54f"

X-IncomingHeaderCount: 15

X-EOPAttributedMessage: 0

X-EOPTenantAttributedMessage: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa:0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: CH2PEPF00000142:EE_|SA3PR18MB5297:EE_

X-MS-Office365-Filtering-Correlation-Id: f7c0d972-a3cd-4503-0b98-08dedd0c5276

X-Sender-IP: 209.85.208.71

X-MS-Exchange-EOPDirect: true

X-SID-PRA: HARESSAZNZXRRSXAXZ321@GMAIL.COM

X-SID-Result: PASS

X-MS-Consumer-Group-Expansion-Loop: cynthiaperez389903@groups.outlook.com

X-MS-Exchange-Group-Expansion-Loop: cynthiaperez389903@groups.outlook.com

X-Microsoft-Antispam:

BCL:0;ARA:1444111002|1680799066|6019299003|6092099016|9400799043|5139299004|9020799019|3151999006|6149299003|9000799056|22000799015|34130799006|29080799009|16200799027|970799063|26000799027|24102599021|32020799003|26130799012|4040799016|4302099013|3412199025|440099028|21002599022;

Webroot phish from Google Gmail

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 08 Jul 2026 09:20:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1whU3q-00000000BwY-2QmT

for dave@doctor.nl2k.ab.ca;

Wed, 08 Jul 2026 09:19:42 -0600

Resent-From: The Doctor

Resent-Date: Wed, 8 Jul 2026 09:19:42 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pf1-f179.google.com ([209.85.210.179]:48306)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1whSWj-00000000MCm-2OVg

for doctor@nl2k.ab.ca;

Wed, 08 Jul 2026 07:41:35 -0600

Received: by mail-pf1-f179.google.com with SMTP id d2e1a72fcca58-8478fe07f0fso660939b3a.0

for ; Wed, 08 Jul 2026 06:40:38 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1783518032; x=1784122832; darn=nl2k.ab.ca;

h=to:from:subject:mime-version:date:message-id:from:to:cc:subject

:date:message-id:reply-to;

bh=qX1F1lIVnxcr4Ooy7aQlME6qLGyJQBhSvG7at1banGs=;

b=DsGVTQzONr/m8PlwufmmtNp3372Xb+yEphXqu92rCsyimQrSqOlYC6A+lbLP8fphcS

XKpAA7GsJ75m9Ntys26miP/3cDfYIBnpGYaq9EsKQeLsbHfeJxy+h9fS5xXDljv5LKfl

dDj8BzPHOU9EZBYVMNuEUkaDQChO8jkGKGFminRv1TB4nbHSJmqRmDhh7oqs8XdJenVm

vBehtKOrIGvgLWcnWjFfKbEwH6DVFNqlWiEZ+lbK/2MRiEmd13Sr0XwvDZNlB+4bFP8i

OjCDshG3wlZoQXwk6HiRGYahorWNAb10TUp7EVIrgDccrJZSscmV/s1pVw9uEubg/F94

Xi9g==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1783518032; x=1784122832;

h=to:from:subject:mime-version:date:message-id:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=qX1F1lIVnxcr4Ooy7aQlME6qLGyJQBhSvG7at1banGs=;

b=VW14L6x0jQxFLl5vzav4XZPlGGHaVskrJwvnhzCi5jEcv2qe6ZjF8aEPI3Qytgxs0C

sM4mFkgvEP14n5/XzP7rrrBJ/oZZTRIdGfCPsv0+JSx7SdjE15C3tleFqqkE+wYDN45r

qymXYZwtQ04W72okBm/MugWbCgfYVNJ4Z2xuhLaVm9GPIIdvXsx4s0M3uK6fLrcLUnbG

Kp0/7Bsup+OnTfU8QwQnzzAwJR/vpQHtY+UqAogVSFqU1ko6IE5jvT4xP0tEKZqJ+rVK

3ISF6dEtkZ8Pz21vrE3aQpjXuzeyz8YEYhhi8I8MtaYUJR8MIIjBBDZ7N1O0s6vDKAtj

3kXg==

X-Gm-Message-State: AOJu0Yz1HloL+bvB10ydiVUmzROiWjzzwMxCu+dGKGnQXm0seH6vzF6t

G+fdyAlLyBUlzloch6uRd/leOK3VwyRmaL3+IlUYV/QC5EG6zIb+HJxsqYcaxzaxFm6EB3z9

X-Gm-Gg: AfdE7cmzHh4NHcgOsc0zeqPo5lU0blnlNQzo65O5EGrfLly/SX8hh7xQRSF4BowLC/x

+yld1UrXRjQqcMnM+Fh5S3I/JSpZzRYilfxjbH+67SuDHeyhNKkxET67LhEfFzhs8sn+dyKWcC2

EcFnsfJi19E4Q/49ZigIPpKizG+7FCGx4YFOsubnHBiMLJaoY9jkkt6DH2RGj65WAaQZqDwKO18

hxqaIU2qy8GbgWtpr/kUMZp3ojlNGo9i9fqwq+rTDXYPPu63xTJWxNVnFEU2KmGhzAZ4aZznaSM

lH5pnT+gvs9jIsvcrOg+1xjsx9DPFRpm39SOd9EjjpPJ9Rj/8H13nH3SH7nG5FXO9eGQp+cEOCX

SXpal3kFCU25FxRwaf9V/A+R70Pa6uVQc/EtL3e3SvJUivtkc7DsEZksSR2QlWfw/oVs+InQlDA

d1zcQcO13FoTSIE7ZtkesWPdeBil1L8qpt9QfVUfpvWh6M9JDC

X-Received: by 2002:a05:6a00:9510:b0:848:2d1d:836f with SMTP id d2e1a72fcca58-84842f090c1mr2597088b3a.28.1783518031879;

Wed, 08 Jul 2026 06:40:31 -0700 (PDT)

Received: from [10.203.17.91] ([43.163.207.239])

by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-847f6b609acsm6981812b3a.1.2026.07.08.06.40.31

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Wed, 08 Jul 2026 06:40:31 -0700 (PDT)

Message-ID: <6a4e534f.4f595882.28ff01.a729@mx.google.com>

Date: Wed, 08 Jul 2026 06:40:31 -0700 (PDT)

Content-Type: multipart/alternative; boundary="===============1313688276998946526=="

MIME-Version: 1.0

Subject: Transaction 39666186 is processed

From: Doctor

To: doctor@nl2k.ab.ca



Webroot



Transaction Date: Wednesday, July 8, 2026

Transaction No: 39666186

Reference Id: 98J36QIEXFT118

Order received and being prepared.



Hey Doctor



We appreciate your continued membership. This is to inform you that your Webroot subscription will renew automatically today.



Your payment will be processed securely using the payment method on file.



Invoice Info

Product: Webroot All-in-One Protection

Product Key: IZFR8-2RKTQ-OKESA-NC54A-O2I2L

Quantity: 2 Devices

Subscription Period: 2 Years

Renewal Amount: $200.79



No further action is necessary unless you wish to make changes before the renewal is processed.



Respectfully,

Webroot SecureAnywhere

+1 (805) 215-5466

+1 (810) 228-0845



© 2009-2026 Webroot, Inc. All rights reserved.

Accounting Bookkeeping spam from Google Gmail Part 3








link=3D"#467886" vlink=3D"#96607D" style=3D'word-wrap:break-word'>

class=3DWordSection1>


style=3D'font-family:"Calibri",sans-serif'>Hi,


class=3DMsoNoSpacing>
style=3D'font-family:"Calibri",sans-serif'> 


class=3DMsoNoSpacing>A =

quick overview of our accounting =

support.


style=3D'font-family:"Calibri",sans-serif'>About =

us:


style=3D'font-family:"Calibri",sans-serif'>


class=3DMsoNoSpacing =

style=3D'margin-left:.5in;text-indent:-.25in;mso-list:l0 level1 =

lfo2'>
style=3D'font-size:10.0pt;font-family:Symbol'>
style=3D'mso-list:Ignore'>·
Roman"'>         =


style=3D'font-family:"Calibri",sans-serif'>Team of 750+ trained =

bookkeeping and accounting professionals based in =

India


style=3D'margin-left:.5in;text-indent:-.25in;mso-list:l0 level1 =

lfo2'>
style=3D'font-size:10.0pt;font-family:Symbol'>
style=3D'mso-list:Ignore'>·
Roman"'>         =


style=3D'font-family:"Calibri",sans-serif'>Experts in Xero, QuickBooks =

Online, and more


style=3D'margin-left:.5in;text-indent:-.25in;mso-list:l0 level1 =

lfo2'>
style=3D'font-size:10.0pt;font-family:Symbol'>
style=3D'mso-list:Ignore'>·
Roman"'>         =


style=3D'font-family:"Calibri",sans-serif'>Currently supporting over =

1,000 clients


style=3D'margin-left:.5in;text-indent:-.25in;mso-list:l0 level1 =

lfo2'>
style=3D'font-size:10.0pt;font-family:Symbol'>
style=3D'mso-list:Ignore'>·
Roman"'>         =


style=3D'font-family:"Calibri",sans-serif'>ISO-certified and =

GDPR-compliant company


style=3D'margin-left:.5in;text-indent:-.25in;mso-list:l0 level1 =

lfo2'>
style=3D'font-size:10.0pt;font-family:Symbol'>
style=3D'mso-list:Ignore'>·
Roman"'>         =


style=3D'font-family:"Calibri",sans-serif'>Happy to share client =

references upon request


class=3DMsoNoSpacing>
style=3D'font-family:"Calibri",sans-serif'>Are you considering a remote =

accounting partner?
 


class=3DMsoNoSpacing>
style=3D'font-family:"Calibri",sans-serif'>Best =

Regards,


style=3D'font-family:"Calibri",sans-serif'>Lauren Smith

style=3D'font-family:"Calibri",sans-serif'>


class=3DMsoNoSpacing>
style=3D'font-family:"Calibri",sans-serif'> 


class=3DMsoNoSpacing>
style=3D'font-family:"Calibri",sans-serif'> 


class=3DMsoNoSpacing>
style=3D'font-family:"Calibri",sans-serif'> 


class=3DMsoNoSpacing>
style=3D'font-family:"Calibri",sans-serif'>Disclaimer

style=3D'font-family:"Calibri",sans-serif'>: If you no longer wish to =

receive emails from us, simply reply with "NO " to =

unsubscribe.



------=_NextPart_000_0646_01DD0F08.A95D1E30--



Accounting Bookkeeping spam from Google Gmail Part 2

------=_NextPart_000_0646_01DD0F08.A95D1E30

Content-Type: text/html;

charset="us-ascii"

Content-Transfer-Encoding: quoted-printable




xmlns:o=3D"urn:schemas-microsoft-com:office:office" =

xmlns:w=3D"urn:schemas-microsoft-com:office:word" =

xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" =

xmlns=3D"http://www.w3.org/TR/REC-html40">
HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; =

charset=3Dus-ascii">
(filtered medium)">

Accounting Bookkeeping spam from Google Gmail Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 08 Jul 2026 07:37:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1whSS3-00000000LTe-2t5A

for dave@doctor.nl2k.ab.ca;

Wed, 08 Jul 2026 07:36:35 -0600

Resent-From: The Doctor

Resent-Date: Wed, 8 Jul 2026 07:36:35 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-qv1-f54.google.com ([209.85.219.54]:42328)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1whRzf-000000002pw-3vU3

for sales@nk.ca;

Wed, 08 Jul 2026 07:07:26 -0600

Received: by mail-qv1-f54.google.com with SMTP id 6a1803df08f44-8ea70ca4fc8so4589216d6.1

for ; Wed, 08 Jul 2026 06:06:27 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1783515981; x=1784120781; darn=nk.ca;

h=disposition-notification-to:content-language:thread-index

:mime-version:message-id:date:subject:to:from:from:to:cc:subject

:date:message-id:reply-to;

bh=GERc/WMJSc4uUTCdiNlwfVY4+MRFA1Gaz5GfEF932HY=;

b=e0mQO3e9HQu6CNKwtkM4nH7xs9fcXUukI5hhX2+T787GpNqgIn9Ez0zsWYjBd/X2vA

pj/V1tNLwbDvQ2JTgIeiVy4HlYM7OeG7P4QmiJ/VUMMssEaBpCALPsRM5KtzAKyQh5ts

anRW7L6Epr0H1MPzGlbosoiWdPu1R6jVpCQ5mB6lQ4fVF8ywcSkGlFPCwap3wnf8571S

TAbXfyLvGyFp1hHJ6IGj6lWoMBVGQewUJ+UIHSC+xHT24z1wuvJWlnrWvBOBgjOoznFt

kFxyWTv2IiUBxdGqq9xyuMTAQArMrZgUgcOA+K3kXfW4t1i8vrgg17KpFOMzNp/zEeZo

XHWg==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1783515981; x=1784120781;

h=disposition-notification-to:content-language:thread-index

:mime-version:message-id:date:subject:to:from:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=GERc/WMJSc4uUTCdiNlwfVY4+MRFA1Gaz5GfEF932HY=;

b=gsx/HXxOS7F0urVE4STSGyuMHWLb+L13oso+JFweSnGtOlcZKwZrWDxjv/8lQpgXQQ

ET3/HrgXNM6EuMCeyRZX6ngYnDnBiSw4eynMlzyUA8ZnH5xMC4Ryny4VJ2kJCrH/jiGP

Z0b12xEvlHUjDBmsoVZWuwZydx/bxLS5cf2uGk599cAySWQv68HYWlulbKvaET6osfO7

4kETgqo+yUv7g1wN6DLRVtDyzqpwpSe2pT+1bWjRI+Swo3EGxkG0aCT4B1jeSVjLQnSV

AIR/A5tWKEOepCxCN2JUNtEVsR1v1LizdawUqIkz7fA0Z8fVbE6P+fDiXJKRuJQsZNNb

9jLA==

X-Gm-Message-State: AOJu0YwE9Gvw9bZKI4qgZoYIQmItOq9jmroar2+ickCj9HQ/YT+waaB/

Sk1EHoKoHC0a0hgHbP2/5wVfuLgRWcBZWev8lAYUCpyrD+hLqLX5UrNRTdRxBNLX

X-Gm-Gg: AfdE7clhvsFC2aWPK2UF5/0XrBKlUgP1+CcaAJxxtH02aN5ieOkFLPt9kYmxMPqk3EB

5+omaBhl2tIF6kQxYwW2SPAbTo8+K4kTCiBwSGxcgulgsZmc+dDrZWbawIvZnqLOlh1IJNbk6V+

3ftO9HfysaTtlSbS1DTmvA/+m4EpHPKu3wqeWap/VCnSR1fVnYndivW1fhawBUijrGLE1PPIMIY

sQJh9hWQQku4M2as4oo9w+O1Ob2RH6tw4EGlNMpTqA+8J3PAHXjfYiFnyGegAMbBZr/8bXAHm5P

i3Q1csqT+bXiFYown38cZloXTxkER9Y9AQToVUZ0H1Qg3rPrzdJPfYDQ7nmO3/ivnxyz9Tmo+Fz

lhZsv1tPLKZv8js2OiCiPIxw9cd4jAFZ8Bu4D35DSVuxSgXqJQYgADOR4HbnHMk5Xj5dixe1LZE

cw/qmVhHdAPLMfjPIjP8RXUmk3L592ajQc

X-Received: by 2002:a05:6214:4101:b0:8f1:5e32:9b06 with SMTP id 6a1803df08f44-8fd39b72b46mr74756326d6.13.1783515976903;

Wed, 08 Jul 2026 06:06:16 -0700 (PDT)

Received: from DESKTOP5AD1N3E ([2401:4900:8845:3cf5:bd41:4d79:5ae0:700a])

by smtp.gmail.com with ESMTPSA id 6a1803df08f44-8fec643b63bsm12102796d6.21.2026.07.08.06.06.15

for

(version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);

Wed, 08 Jul 2026 06:06:16 -0700 (PDT)

From: "Lauren Smith"

To:

Subject: Quick chat? Accounting-Bookkeeping

Date: Wed, 8 Jul 2026 18:36:08 +0530

Message-ID: <064501dd0eda$8fa46d00$aeed4700$@gmail.com>

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="----=_NextPart_000_0646_01DD0F08.A95D1E30"

X-Mailer: Microsoft Outlook 16.0

Thread-Index: Ad0O2ktJchnVkKYMToiUFL3822hMRg==

Content-Language: en-us

Disposition-Notification-To: "Lauren Smith"



This is a multipart message in MIME format.



------=_NextPart_000_0646_01DD0F08.A95D1E30

Content-Type: text/plain;

charset="us-ascii"

Content-Transfer-Encoding: 7bit



Hi,







A quick overview of our accounting support.







About us:







Team of 750+ trained bookkeeping and accounting professionals

based in India



Experts in Xero, QuickBooks Online, and more



Currently supporting over 1,000 clients



ISO-certified and GDPR-compliant company



* Happy to share client references upon request







Are you considering a remote accounting partner?





Best Regards,



Lauren Smith















Disclaimer: If you no longer wish to receive emails from us, simply reply

with "NO " to unsubscribe.

WEb/SEO/App spam Part 3








link=3D"#467886" vlink=3D"#96607D" style=3D'word-wrap:break-word'>

class=3DWordSection1>

We =

hope you are doing well.


style=3D'margin-bottom:0in'>We are 
style=3D'color:#3A7C22'>Digital Ranker
, a UAE-based guest =

posting and backlink service provider. We work with SEO agencies, =

digital marketers, and businesses looking for reliable guest post =

placements, link insertions, and custom backlink packages.


class=3DMsoNormal style=3D'margin-bottom:0in'> 


class=3DMsoNormal style=3D'margin-bottom:0in'>We have guest posting =

websites available in UAE, Saudi Arabia, UK, USA, and other =

international markets
. We also accept both English and =

Arabic articles
, making our service suitable for regional and global =

SEO campaigns.


style=3D'margin-bottom:0in'>What We Offer


    style=3D'margin-top:0in' type=3Ddisc>

  • style=3D'margin-bottom:0in;mso-list:l0 level1 lfo2'>Guest post =

    publishing on niche-relevant websites

  • style=3D'margin-bottom:0in;mso-list:l0 level1 lfo2'>Link insertion =

    opportunities on existing articles

  • style=3D'margin-bottom:0in;mso-list:l0 level1 lfo2'>Custom backlink =

    packages for agencies and resellers

  • style=3D'margin-bottom:0in;mso-list:l0 level1 lfo2'>Do-follow =

    backlinks

  • style=3D'margin-bottom:0in;mso-list:l0 level1 lfo2'>Permanent =

    placement

  • style=3D'margin-bottom:0in;mso-list:l0 level1 lfo2'>No sponsored =

    tag

  • level1 lfo2'>Up to 2 links per article

  • style=3D'margin-bottom:0in;mso-list:l0 level1 lfo2'>Fast publishing =

    within 24–48 hours

  • style=3D'margin-bottom:0in;mso-list:l0 level1 lfo2'>English and Arabic =

    content accepted


style=3D'margin-bottom:0in'>You can view our guest posting service =

and full website inventory using the links below:


class=3DMsoListParagraphCxSpFirst =

style=3D'mso-margin-top-alt:0in;margin-right:0in;margin-bottom:0in;margin=

-left:1.0in;mso-add-space:auto;text-indent:-.25in;mso-list:l0 level2 =

lfo2'>
style=3D'mso-list:Ignore'>1-
Roman"'>    

dir=3DLTR>

href=3D"https://ranker.ae/services/guest-posting/">
style=3D'font-size:14.0pt;line-height:115%;font-family:"Aptos =

Display",sans-serif;color:#00B0F0;text-decoration:none'>Guest Posting =

Services

style=3D'font-size:9.0pt;line-height:115%;font-family:"Haettenschweiler",=

sans-serif;color:windowtext;text-decoration:none'>    =

; =

            &=

nbsp; 

style=3D'font-size:9.0pt;line-height:115%;font-family:"Haettenschweiler",=

sans-serif'> 


class=3DMsoListParagraphCxSpLast =

style=3D'mso-margin-top-alt:0in;margin-right:0in;margin-bottom:0in;margin=

-left:1.0in;mso-add-space:auto;text-indent:-.25in;mso-list:l0 level2 =

lfo2'>2-
style=3D'font:7.0pt "Times New Roman"'>     =


href=3D"https://docs.google.com/spreadsheets/d/1e6T0ujoZBi2eZJdtrAf-1In2W=

JVSOAqvNEcrkNcMkfM/edit?gid=3D410538523#gid=3D410538523">
style=3D'font-size:14.0pt;line-height:115%;font-family:"Aptos =

Display",sans-serif;color:#00B0F0;text-decoration:none'>Inventory =

Sheet

We =

offer flexible pricing depending on the website, niche, and order =

volume. If you are working on guest posting, link building, or monthly =

SEO campaigns, we would be happy to share suitable options based on your =

requirements.


style=3D'margin-bottom:0in'> 


style=3D'margin-bottom:0in'>Please share your target country, niche, =

preferred DA/DR range, and budget, and we will send you the best =

available sites from our inventory.


style=3D'margin-bottom:0in'> 


style=3D'margin-bottom:0in'>Looking forward to building a long-term =

business relationship with you.


style=3D'margin-bottom:0in;line-height:18.0pt'>
style=3D'font-size:11.5pt;font-family:"Arial",sans-serif;color:#374151;ms=

o-ligatures:none'> 


style=3D'margin-bottom:0in;line-height:18.0pt'>
style=3D'font-size:11.5pt;font-family:"Arial",sans-serif;color:#374151;ms=

o-ligatures:none'>Best regards

style=3D'font-size:11.5pt;font-family:"Arial",sans-serif;color:#374151;ms=

o-ligatures:none'>,


style=3D'margin-bottom:0in'>
style=3D'font-size:13.5pt;line-height:115%;font-family:"Arial",sans-serif=

;color:#0B7A2A;mso-ligatures:none'>Digital =

Ranker


style=3D'margin-bottom:0in'>Guest Posting & SEO Backlink =

Services


style=3D'margin-bottom:0in'>UAE-Based Guest Posting =

Company


style=3D'margin-bottom:0in'>
style=3D'text-decoration:none'>Website
,
href=3D"https://ranker.ae/services/guest-posting/">
style=3D'text-decoration:none'>Service Page
,
href=3D"https://docs.google.com/spreadsheets/d/1e6T0ujoZBi2eZJdtrAf-1In2W=

JVSOAqvNEcrkNcMkfM/edit?pli=3D1&gid=3D410538523#gid=3D410538523">
n style=3D'text-decoration:none'>Inventory Sheet
,
href=3D"https://wa.link/hkh3bk">
style=3D'text-decoration:none'>WhatsApp


class=3DMsoNormal align=3Dcenter =

style=3D'margin-bottom:0in;text-align:center'>
style=3D'font-size:10.0pt;line-height:115%'> 

<=

p class=3DMsoNormal align=3Dcenter =

style=3D'margin-bottom:0in;text-align:center'>
style=3D'font-size:10.0pt;line-height:115%'> 

<=

p class=3DMsoNormal align=3Dcenter =

style=3D'margin-bottom:0in;text-align:center'>
style=3D'font-size:10.0pt;line-height:115%'> 

<=

p class=3DMsoNormal align=3Dcenter =

style=3D'margin-bottom:0in;text-align:center'>
style=3D'font-size:10.0pt;line-height:115%'> 

<=

p class=3DMsoNormal align=3Dcenter =

style=3D'margin-bottom:0in;text-align:center'>
style=3D'font-size:10.0pt;line-height:115%'> 

<=

/div>

------=_NextPart_000_04AB_01DD0ED4.4BEE0A90--



WEb/SEO/App spam Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 08 Jul 2026 01:22:00 -0600

Received: from buffalo.ash.relay.mailchannels.net ([23.83.222.24]:57593)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1whMay-00000000DPr-0j26

for dave@doctor.nl2k.ab.ca;

Wed, 08 Jul 2026 01:21:34 -0600

X-Sender-Id: hostingeremail|x-authuser|info@digitalranker.ae

Received: from relay.mailchannels.net (localhost [127.0.0.1])

by relay.mailchannels.net (Postfix) with ESMTP id 8607440293D

for ; Wed, 08 Jul 2026 07:20:30 +0000 (UTC)

Received: from de-fra-smtpout1.hostinger.io (100-99-175-78.trex-nlb.outbound.svc.cluster.local [100.99.175.78])

(Authenticated sender: hostingeremail)

by relay.mailchannels.net (Postfix) with ESMTPA id AFD49401BBF

for ; Wed, 08 Jul 2026 07:20:29 +0000 (UTC)

X-Sender-Id: hostingeremail|x-authuser|info@digitalranker.ae

X-MC-Relay: Neutral

X-MailChannels-SenderId: hostingeremail|x-authuser|info@digitalranker.ae

X-MailChannels-Auth-Id: hostingeremail

X-Interest-Ski: 3a3439012d485592_1783495230504_3630678849

X-MC-Loop-Signature: 1783495230504:3490515462

X-MC-Ingress-Time: 1783495230504

Received: from de-fra-smtpout1.hostinger.io (de-fra-smtpout1.hostinger.io

[148.222.55.8])

(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384)

by 100.99.175.78 (trex/8.0.2);

Wed, 08 Jul 2026 07:20:30 +0000

Received: from Muhammad (unknown [66.102.121.110])

(Authenticated sender: info@digitalranker.ae)

by smtp.hostinger.com (smtp.hostinger.com) with ESMTPSA id 4gw8d72J3cz46gh

for ; Wed, 8 Jul 2026 07:20:27 +0000 (UTC)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=digitalranker.ae;

s=hostingermail-a; t=1783495227;

h=from:from:reply-to:subject:subject:date:date:message-id:message-id:

to:to:cc:mime-version:mime-version:content-type:content-type;

bh=dyXhHe/1HT8QsfWeTe6gWyhJkdUU/fVV49XwodYLR+A=;

b=agcnjjuQLZkZxPXDH0qsruodAuajGy5UEq6vgc5/jPh0Rb3v58mybZ2p6YEfJfv4lms2xe

A3mYK8DN3OWCaTY9D4Rr/CRtUpXxHN7RAds9PVzmyNIMl3lcCuhCLUGNtGQZk4h9+U2XeQ

kwZxfVgA706ofh5hBLoy2sMWZxnyjsXVa69EPXf3jkmxi+/glEC4aWSwzLKc0CFi+JCKXl

OCfyFyTV3lXKw6tSxd81vl942ng6zg5Zog0SqN/uAInqlf253ouZvLGGLF5l42opMoC1Yt

xq5Jzgl6RMgugqZeR63c7jAR+PrpEOSFRlTF2wmeFZ75+HVQO2tJSMXvxHl+nA==

Return-Receipt-To:

From:

To:

Subject: Guest Posting & Backlink Opportunities for Your SEO Campaigns

Message-ID:

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="----=_NextPart_000_04AB_01DD0ED4.4BEE0A90"

X-Mailer: Microsoft Outlook 16.0

Thread-Index: Ad0OqKEtr0FjKcGETD6MJ9w04YsT+w==

Content-Language: en-us

Disposition-Notification-To:

Date: Wed, 8 Jul 2026 07:20:27 +0000 (UTC)

X-CM-Envelope: MS4xfLpddfE97Dy9MpHKanm9c/+ih92mtXUV77d8njOYw38d93WJ7K5r2KT0MWBaQQ85SxTr6rr31ik9BSA9ICI8auoMS+C5Km+fxXfQUc4exGvF5sSbWK7r LsFwb03GZs/4AQZFYPHdmXCsNjINQSIfOUfzrCjYbt2Ed5p060ONDXwaKfik6mMt0yws/K3QIMKHYQ==

X-CM-Analysis: v=2.4 cv=fr2OZ04f c=1 sm=1 tr=0 ts=6a4dfa3b a=zevg4RpxF0I+qp7Ij8qhdA==:117 a=zevg4RpxF0I+qp7Ij8qhdA==:17 a=DAwyPP_o2Byb1YXLmDAA:9 a=oXKEahFCAAAA:8 a=B6KMzFptAAAA:20 a=0-GVMVYVAAAA:20 a=TfcMdZ2tuSAy9ven4MIA:9 a=CjuIK1q_8ugA:10 a=-FEs8UIgK8oA:10 a=coFBbNDeAAAA:20 a=yMhMjlubAAAA:8 a=SSmOFEACAAAA:8 a=UrhCsGuSFDsYfvbnq_4A:9 a=1vsyERDJIXn7Dhpw:21 a=gKO2Hq4RSVkA:10 a=UiCQ7L4-1S4A:10 a=hTZeC7Yk6K0A:10 a=frz4AuCg-hUA:10 a=k5yS741xaF-lL316-gfm:22 a=ZT_8zCgGubuJgGonBfBE:22

X-AuthUser: info@digitalranker.ae



This is a multipart message in MIME format.



------=_NextPart_000_04AB_01DD0ED4.4BEE0A90

Content-Type: text/plain;

charset="us-ascii"

Content-Transfer-Encoding: 7bit



We hope you are doing well.



We are Digital Ranker, a UAE-based guest posting and backlink service

provider. We work with SEO agencies, digital marketers, and businesses

looking for reliable guest post placements, link insertions, and custom

backlink packages.







We have guest posting websites available in UAE, Saudi Arabia, UK, USA, and

other international markets. We also accept both English and Arabic

articles, making our service suitable for regional and global SEO campaigns.



What We Offer



Guest post publishing on niche-relevant websites

Link insertion opportunities on existing articles

Custom backlink packages for agencies and resellers

Do-follow backlinks

Permanent placement

No sponsored tag

Up to 2 links per article

Fast publishing within 24-48 hours

* English and Arabic content accepted



You can view our guest posting service and full website inventory using the

links below:



1- Guest Posting Services





2-


rkNcMkfM/edit?gid=410538523#gid=410538523> Inventory Sheet



We offer flexible pricing depending on the website, niche, and order volume.

If you are working on guest posting, link building, or monthly SEO

campaigns, we would be happy to share suitable options based on your

requirements.







Please share your target country, niche, preferred DA/DR range, and budget,

and we will send you the best available sites from our inventory.







Looking forward to building a long-term business relationship with you.







Best regards,



Digital Ranker



Guest Posting & SEO Backlink Services



UAE-Based Guest Posting Company



Website,

Service Page,


rkNcMkfM/edit?pli=1&gid=410538523#gid=410538523> Inventory Sheet,

WhatsApp

WEb/SEO/App spam Part 2

------=_NextPart_000_04AB_01DD0ED4.4BEE0A90

Content-Type: text/html;

charset="us-ascii"

Content-Transfer-Encoding: quoted-printable




xmlns:o=3D"urn:schemas-microsoft-com:office:office" =

xmlns:w=3D"urn:schemas-microsoft-com:office:word" =

xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" =

xmlns=3D"http://www.w3.org/TR/REC-html40">
HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; =

charset=3Dus-ascii">
(filtered medium)">

Chinese products spam

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 07 Jul 2026 23:45:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1whL5f-000000008il-3TMm

for dave@doctor.nl2k.ab.ca;

Tue, 07 Jul 2026 23:44:59 -0600

Resent-From: The Doctor

Resent-Date: Tue, 7 Jul 2026 23:44:59 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [8.221.36.169] (port=40356 helo=mail-m822136169.xmail.ntesmail.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1whJHc-000000001dr-45G7

for sales@nk.ca;

Tue, 07 Jul 2026 21:49:24 -0600

Content-Type: multipart/alternative; BOUNDARY="=_Part_512584_1711100758.1783482425979"

To: sales@nk.ca

Reply-To: annie@loffepet.cn

Subject: =?UTF-8?B?TkVXIERFU0lHTiBGUk9NIExPRkZFIFBFVCBGQUNUT1JZ?=

X-Priority: 3

MIME-Version: 1.0

Received: from lina@loffepet.cn( [10.139.5.212] ) by ajax-webmail ( [127.0.0.1] ) ; Wed, 8 Jul 2026 11:47:05 +0800 (GMT+08:00)

From: Annie

Date: Wed, 8 Jul 2026 11:47:05 +0800 (GMT+08:00)

X-WM-Tid: 0a9f3fd62273d095kusy046e291ea5bf2

Message-ID:





HI,



Hope this email finds you well.



Our factory's strength is cat/dog products-durable, safe, stylish felt designs.

All products hold BSCI, ISO, and FSC certifications.



Advantages:

1. Fast delivery via the factory location

2. Stable quality, competitive prices

3. OEM & ODM customization.



We aim for a trust-based partnership, not just sales. Contact me anytime for catalogs, quotations or discussion.

Looking forward to your reply.



Best Regards,

Annie































Docusign Phish from Google Gmail Part 2





=EF=BB=BF


name=3D"viewport" />

Docusign Phish from Google Gmail Part 3









3D"Logo"
src=3D"https://docucdn-a.akamaihd.net/olive/images/2.62.=

0/global-assets/email-templates/email-logo.png" width=3D"116" />






3D""
src=3D"https://docucdn-a.akamaihd.net/olive/images/2.76.=

0/email/iconFileWithCheckWhite.png" width=3D"75" />

A document has been sent for your review



target=3D"_blank">View Document








Please review the attached document at your convenience. Contact the =

sender if you have questions.





This invitation is intended only for the recipient and contains secure =

access information.











Confidential: Do not share this email or link with =

others.









About Docusign: Sign securely and legally in minutes, =

from anywhere.





Need help? Contact the sender or visit our support page=

.









Download the app:
.com/features-and-benefits/mobile" target=3D"_blank"> 3D""
height=3D"18" src=3D"https://docucdn-a.akamaihd.net/olive/images/2.62.=

0/global-assets/email-templates/icon-download-app.png" width=3D"18" />Get =

Docusign





Sent by Ashley Allen via Docusign. To unsubscribe, =

contact the sender.





This message contains =

confidential information. If you are not the intended recipient, please =

delete immediately.











Docusign Phish from Google Gmail Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 07 Jul 2026 20:16:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1whHob-00000000M1R-2f3o

for dave@doctor.nl2k.ab.ca;

Tue, 07 Jul 2026 20:15:09 -0600

Resent-From: The Doctor

Resent-Date: Tue, 7 Jul 2026 20:15:09 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pj1-f103.google.com ([209.85.216.103]:58499)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1whG5m-00000000GtM-0uzf

for games@nl2k.ab.ca;

Tue, 07 Jul 2026 18:24:55 -0600

Received: by mail-pj1-f103.google.com with SMTP id 98e67ed59e1d1-381b831d535so150441a91.0

for ; Tue, 07 Jul 2026 17:23:58 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=sabeng.it; s=google; t=1783470232; x=1784075032; darn=nl2k.ab.ca;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=EWV8XmCUvffytCAcw2TyXcQCDCinzlDmbMB2SDY4DX4=;

b=SCp5xMR1I83OvKRm+V6Wp3eYwUUExN5Q9VDYRizckZ4s/OYk9QddZUdBVQZPd5vomb

3HQmTjjEJj3PHBcUR1yrpDMujlnHMS5+wQgkp0l009veoNroGDcWz5KcIioQflHNkFaN

CRrSx5abWYCDZ9Fa86KAVuphxNAm1cURlXQAw=

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1783470232; x=1784075032;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=EWV8XmCUvffytCAcw2TyXcQCDCinzlDmbMB2SDY4DX4=;

b=TkMMZjYxZZwkL1hv/VGKg8MtVPlsJkKei7+aP5eUoraYs8ajmkkTO9bnsQmko/lp2k

0+LHx/BoWCDw3mEwRnNdk4xsiDoI+n5B82hH/K2ZdiN832s9K160s7UPufPWZ9mCiRHK

lyHdDgeu3EQKs2fEtdfFFnLiw1VHwD9OU4/Fdw79MxsYK0UxX15aB5Z5HUbV7O2EO5NY

E1I6pGOJUSeoyc+ZxBW40wU1+AIt5ShMTuMsnSLzoRVoVPnoEmoZTc2s847R4CYzmHer

o+EZpzNyeTn4tvSeILJ6+qdxJtmomxa7ZlC2xqHQV0QMZzIRRE7eIDUHCFUZ5+6A6wB2

Nlrw==

X-Gm-Message-State: AOJu0YyeEKcTI6lTKeK7Ra5xgIbiykv94CKDr2XWPggQhjRYYoEjKyvE

W0KYUzZtiWn4iHqRQZpJ0lWIH4hJvkVSkBQfT3NkifSx/1cp5hNNV1o74zgp6CO2822EhswFdhG

RJ0D5yDm01Ql4ggfMM5SF8qaf4nS95E5D1q5TXa+Uv3utUpw=

X-Gm-Gg: AfdE7cmxuk0MU1oaZALI3HZpl4JZOKzcPSGhG8ZgAnZ9EgBtraVy4zZAaJINMWla442

FV0nQlnePz23WP55ls+uzPYqbsHySolG33upmT0rRWWZe08HD8rMMGL1xIlVZOnuK3w2eXF+rm3

QE8/Mc78nUXURY3gJzK/vE1PHuQo6mhmGLGufhV1NWwU//a8ctBAPby7kB/l5aVlRnDviYKO58C

QtvQ0pdfadHP8wSnN17drv7mSDbgctXpCKG2PAIGmx/G5hPsgDuJ3iuKA9baU56EFvUrur6XeKg

jnBMMZh74zvMz4Jr8nSSQdqG28KOW1PmALv9sfoFfrQl9yWgN6VIN+XYHYStl05zCIjZgnb5m3q

MsAK62e4B+Ir99Tu0NQ==

X-Received: by 2002:a17:90b:4a11:b0:366:132:fda7 with SMTP id 98e67ed59e1d1-38940150894mr161299a91.10.1783470232524;

Tue, 07 Jul 2026 17:23:52 -0700 (PDT)

Received: from sabprogetti.com ([192.210.236.148])

by smtp-relay.gmail.com with ESMTPS id 98e67ed59e1d1-387d3c6bee2sm373673a91.8.2026.07.07.17.23.52

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Tue, 07 Jul 2026 17:23:52 -0700 (PDT)

X-Relaying-Domain: sabeng.it

From: "Incoming_Remittance| Scheduled | Online/OU=EXCHANGE ADMINISTRATIVE

GROUP (FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=B7A707497B564FD-51036"



To: games@nl2k.ab.ca

Subject: =?UTF-8?Q?Request_for_Review=3A_Sortcode=2C_Invoic?=

=?UTF-8?Q?e_=26_Payment_Report_=EF=BF=BD_07/07/202?=

=?UTF-8?Q?6_=EF=BF=BD_games=40nl2k=2Eab=2Eca?=

Message-ID: <5e816cae-6587-96bc-848c-39711f4f75a1@sabeng.it>

Content-Transfer-Encoding: quoted-printable

Date: Wed, 08 Jul 2026 00:23:50 +0000

MIME-Version: 1.0

Content-Type: text/html; charset=utf-8

X-Spam_score: 6.3

X-Spam_score_int: 63

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:  A document has been sent for your review View Document

Please review the attached document at your convenience. Contact the sender

if you have questions.



Content analysis details: (6.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.216.103 listed in dnsbl.ahbl.org]

[209.85.216.103 listed in dnsbl.ahbl.org]

[209.85.216.103 listed in dnsbl.ahbl.org]

[209.85.216.103 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.216.103 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.216.103 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.216.103 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.216.103 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[209.85.216.103 listed in will-spam-for-food.eu.org]

[209.85.216.103 listed in will-spam-for-food.eu.org]

[209.85.216.103 listed in will-spam-for-food.eu.org]

[209.85.216.103 listed in will-spam-for-food.eu.org]

[209.85.216.103 listed in will-spam-for-food.eu.org]

[209.85.216.103 listed in will-spam-for-food.eu.org]

[209.85.216.103 listed in will-spam-for-food.eu.org]

[209.85.216.103 listed in will-spam-for-food.eu.org]

1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net

[Blocked - see ]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.216.103 listed in list.dnswl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.216.103 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.216.103 listed in bl.score.senderscore.com]

Subject: {SPAM?} =?UTF-8?Q?Request_for_Review=3A_Sortcode=2C_Invoic?=

=?UTF-8?Q?e_=26_Payment_Report_=EF=BF=BD_07/07/202?=

=?UTF-8?Q?6_=EF=BF=BD_games=40nl2k=2Eab=2Eca?=