Nigerian spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 18 May 2026 16:57:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wP6t2-00000000CIJ-0afv

for dave@doctor.nl2k.ab.ca;

Mon, 18 May 2026 16:56:36 -0600

Resent-From: The Doctor

Resent-Date: Mon, 18 May 2026 16:56:36 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mta2out.kdo.de ([194.76.65.119]:55236)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wP6UF-000000007Ev-46LE

for doctor@doctor.nl2k.ab.ca;

Mon, 18 May 2026 16:31:08 -0600

Received: from smtp2out.kdo.de (mgwaccvpd2.kdo.de [10.243.52.196])

by mta2out.kdo.de (Postfix) with ESMTPS id C5C5D40C7C;

Tue, 19 May 2026 00:28:22 +0200 (CEST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=celle.de; s=dkim;

t=1779143400; h=from:from:reply-to:reply-to:subject:subject:date:date:

message-id:message-id:to:cc:mime-version:mime-version:

content-type:content-type; bh=tTW2HfnGPpwxzsC5Y5EWarf69cBM9387Q42/GRmiyZk=;

b=q21/9BBqUUPm7g19c3DWYkl5isBu0bRvamt39Vy5PoIL1DRHp8BOGe2OR9+o75KSnOGpPq

hLhD3GBaYFCmb5BjEc4OcSUMrIVwODM5bKdNmim7257j6KTd9dRJaLd+viUqM9F5TkZoc2

ZOIFa+6Ay+/n1l8qf1rsATJ5rp1vSN+p6y+EQm8iKTCd8Ms4crZTOWjGdDVY3i5ySEcCYC

uWDccuY+KoUShNWmoFkeJ71KloqqiBhLp/GxZGZqMi0oQfHD44oM6bCDUwOoyPYJns7W3V

V0iXUYM7Sqt94Mi1BsPCXVa3sOP5Zz1t7HVg6CmPdiOXhBGbkah5eEb06BgzPw==

Received: from mgwsigvpc1.kdo.de (mgwsigvpc1.kdo.de [10.243.52.23])

by smtp2out.kdo.de (Postfix) with ESMTP id D36F840985;

Tue, 19 May 2026 00:26:39 +0200 (CEST)

Received: from mgwsigvpc1.kdo.de (localhost [127.0.0.1])

by mgwsigvpc1.kdo.de (Postfix) with ESMTP id C1FB7C4457AC;

Tue, 19 May 2026 00:26:39 +0200 (CEST)

Received: from smtp1.cloud.kdo.de (0000p2exc0102.cloud.kdo.de [10.97.16.25])

by mgwsigvpc1.kdo.de (Postfix) with ESMTPS id 9CB04C445798;

Tue, 19 May 2026 00:26:38 +0200 (CEST)

Received: from 0000p1exc0103.cloud.kdo.de (10.97.16.23) by

0000p2exc0102.cloud.kdo.de (10.97.16.25) with Microsoft SMTP Server

(version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id

15.2.2562.37; Tue, 19 May 2026 00:26:38 +0200

Received: from 0000p1exc0103.cloud.kdo.de ([10.97.16.23]) by

0000p1exc0103.cloud.kdo.de ([10.97.16.23]) with mapi id 15.02.2562.037; Tue,

19 May 2026 00:26:38 +0200

From: "Homann, Christina"

Subject: Re: Please, I need your assistance,

Thread-Topic: Re: Please, I need your assistance,

Thread-Index: Adzm5sb8bYU3+lBDQEqJr0intii8dQAAAj+QAAEDhQAAAAAu8AAAAB/AAAAAHrAAAAAdEAAAACEAAAAAHDAAAAAdkAAAACAgAAAAIEAAAAAfcAAAACNgAAAAHMAAAAAjwAAAACRQAAAAJKAAAAAhcAAAACRgAAAAI1AAAAAlgAAAACQQAAAAJDAAAAAnwAAAACaAAAAAJ7AAAAAmAAAAACdgAAAAJiAAAAAngAAAACigAAAAK9AAAAArYAAAACiwAAAAKOAAAAAqMAAAACfAAAAALYAAAAA6sAAAADqQAAAAKyAAAAA5sAAAACvQAAAAK5AAAAAoUAAAACmAAAAALaAAAAArwAAAADXwAAAALBAAAAAwAAAAAC/AAAAALOAAAAAu4AAAAC3QAAAALmAAAAAtUAAAADMQAAAAL9AAAgzR4AABxCZgAAAAGmAAAAAWUAAAABaAAAAAF1AAAAAWcAAAABcQAAAAGQAAAAAYAAAAABowAAAAFiAAAAAYIAAAABkQAAAAGaAAAAAfoAAAABiQAAAAHDA=

Date: Mon, 18 May 2026 22:26:38 +0000

Message-ID: <8a732196116a4a8cbd2f8cbf57f0ed4e@Celle.de>

Reply-To: "weeb023@hotmail.com"

Accept-Language: de-DE, en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

x-originating-ip: [10.97.32.250]

Content-Type: multipart/alternative;

boundary="_000_8a732196116a4a8cbd2f8cbf57f0ed4eCellede_"

MIME-Version: 1.0

X-MSME-URL-REPUTATION-SCORE: 0

X-Spam_score: 7.2

X-Spam_score_int: 72

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Please, I need your assistance as i am currently serving as

a member of the Ukrainian military. I am writing to ask if you could contact

me at your earliest convenience to discuss some private matters [...]



Content analysis details: (7.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[194.76.65.119 listed in dnsbl.ahbl.org]

[194.76.65.119 listed in dnsbl.ahbl.org]

[194.76.65.119 listed in dnsbl.ahbl.org]

[194.76.65.119 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[194.76.65.119 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[194.76.65.119 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[194.76.65.119 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[194.76.65.119 listed in dnsbl.ahbl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[194.76.65.119 listed in bl.score.senderscore.com]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[194.76.65.119 listed in will-spam-for-food.eu.org]

[194.76.65.119 listed in will-spam-for-food.eu.org]

[194.76.65.119 listed in will-spam-for-food.eu.org]

[194.76.65.119 listed in will-spam-for-food.eu.org]

[194.76.65.119 listed in will-spam-for-food.eu.org]

[194.76.65.119 listed in will-spam-for-food.eu.org]

[194.76.65.119 listed in will-spam-for-food.eu.org]

[194.76.65.119 listed in will-spam-for-food.eu.org]

-0.0 SPF_PASS SPF: sender matches SPF record

1.2 MISSING_HEADERS Missing To: header

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[weeb023(at)hotmail.com]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.9 REPLYTO_WITHOUT_TO_CC No description available.

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 NO_RDNS2 Sending MTA has no reverse DNS

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

Subject: {SPAM?} Re: Please, I need your assistance,



--_000_8a732196116a4a8cbd2f8cbf57f0ed4eCellede_

Content-Type: text/plain; charset="us-ascii"

Content-Transfer-Encoding: quoted-printable



Please, I need your assistance as i am currently serving as a member of the=

Ukrainian military. I am writing to ask if you could contact me at your ea=

rliest convenience to discuss some private matters that I believe might be =

of interest to you. I look forward to your response.



Thanks



--_000_8a732196116a4a8cbd2f8cbf57f0ed4eCellede_

Content-Type: text/html; charset="us-ascii"

Content-Transfer-Encoding: quoted-printable




osoft-com:office:office" xmlns:w=3D"urn:schemas-microsoft-com:office:word" =

xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" xmlns=3D"http:=

//www.w3.org/TR/REC-html40">




>











Please, I need your=

assistance as i am currently serving as a member of the Ukrainian military=

. I am writing to ask if you could contact me at your earliest convenience =

to discuss some private matters that

I believe might be of interest to you. I look forward to your response.
p>



 
span>



Thanks
span>











--_000_8a732196116a4a8cbd2f8cbf57f0ed4eCellede_--

Ominshield Phish from Google Gmail Part 4

Posted by Dave Yadallee on

/InformAction">
emtype=3D"http://schema.org/EmailMessage">
ntent=3D"Ania Wisian: Updated order information is now ready for 4560-MZHB-=

EZRS"/>
.org/Event">
ntScheduled"/>
ema.org/Organization">=


NSF2T5WEXTl"/>
ne-height: 1px; height: 0; max-height: 0; width: 0; max-width: 0; opacity: =

0; overflow: hidden;" itemprop=3D"name">Recent progress is now available fo=

r order 6129-ZTAK-GNRI
=3D"0" cellspacing=3D"0" role=3D"presentation" align=3D"center" style=3D"wi=

dth:100%;" class=3D"body-container">=


ign=3D"left">
 
div>
lpadding=3D"0" cellspacing=3D"0" role=3D"presentation" align=3D"center" sty=

le=3D"width:100%;" class=3D"">

"left">


rop=3D"description">Updated order information is now ready for 4560-MZHB-EZ=

RS


" cellspacing=3D"0" role=3D"presentation" align=3D"center" style=3D"width:1=

00%;" class=3D"">

radius: 8px; direction: rtl; font-size: 0; padding: 24px 32px; text-align: =

left; vertical-align: top;" class=3D"main-container-inner">

left; direction: ltr; display: inline-block; vertical-align: top; width: 10=

0%;overflow: hidden; word-wrap: break-word;">
g=3D"0" cellspacing=3D"0" role=3D"presentation" width=3D"100%" class=3D"mai=

n-column-table-ltr" style=3D"padding-right: 32px; padding-left: 0;;table-la=

yout: fixed;">

ertical-align:top;">
role=3D"presentation" width=3D"100%" style=3D"table-layout: fixed;">
d style=3D"font-size: 0; padding: 0; text-align: left; word-break: break-wo=

rd;;padding-bottom:2px;">

Roboto, sans-serif;font-weight: 400; font-size: 22px; line-height: 28px;col=

or: #3c4043; text-decoration: none;" class=3D"primary-text" role=3D"present=

ation">Recent progress is now available for order 6=

129-ZTAK-GNRI

0; text-align: left; word-break: break-word;;padding-bottom:24px;">

yle=3D"font-family: Roboto, sans-serif;font-style: normal; font-weight: 400=

; font-size: 14px; line-height: 20px; letter-spacing: 0.2px;color: #3c4043;=

text-decoration: none;" class=3D"primary-text" role=3D"presentation">
aria-hidden=3D"true">

ign: left; word-break: break-word;;padding-bottom:24px;">

-family: Roboto, sans-serif;font-style: normal; font-weight: 400; font-size=

: 14px; line-height: 20px; letter-spacing: 0.2px;color: #3c4043; text-decor=

ation: none;" class=3D"primary-text" role=3D"presentation">Bill date:=

Tuesday, 19 May 2026
Bill Id: 6129-ZTAK-GNRI

Valued Customer,

T=

his notice confirms that your 4 Years subscription with McAfee has reached =

the end of its service period. We appreciate your continued trust in our se=

rvices.

If you need assistance, please contact 1 856 620-6865.


>Transaction Records Center
Quantity: 1 Device
Product: OmniShield Pl=

an
Plan: 4 Years Warranty
Payment Method: Auto Debit
Total Amount =

Processed: $ 530.14

For any questions regarding your account or servi=

ces, please contact 1 856 620-6865.

Sending positive thoughts,
Ma=

rk Mcclain
McAfee, Inc.
P.O. Box 8626 New Haven Ct 06513-2121 Us

<=

/span>
2026

Bill Id: 6129-ZTAK-GNRI



Valued Customer,



This notice confirms that your 4 Years subscription with McAfee has reached=

the end of its service period. We appreciate your continued trust in our s=

ervices.



If you need assistance, please contact 1 856 620-6865.



Transaction Records Center

Quantity: 1 Device

Product: OmniShield Plan

Plan: 4 Years Warranty

Payment Method: Auto Debit

Total Amount Processed: $ 530.14



For any questions regarding your account or services, please contact 1 856 =

620-6865.



Sending positive thoughts,

Mark Mcclain

McAfee, Inc.

P.O. Box 8626 New Haven Ct 06513-2121 Us"/>

"font-size: 0; padding: 0; text-align: left; word-break: break-word;;paddin=

g-bottom:24px;">

ormal; font-weight: 400; font-size: 14px; line-height: 20px; letter-spacing=

: 0.2px;color: #3c4043; text-decoration: none;" class=3D"primary-text" role=

=3D"presentation">
ole=3D"presentation" style=3D"padding-bottom: 4px;">


imary-text" style=3D"font-size: 14px;color: #3c4043; text-decoration: none;=

font-weight: 700;-webkit-font-smoothing: antialiased;margin: 0; padding: 0;=

">Guests

(Guest list has been hidden at organiser's r=

equest)


--00000000000050b95806521b9f2b--

Ominshield Phish from Google Gmail Part 3

Posted by Dave Yadallee on
.primary-button {

background-color: #1a73e8 !important;

}



.primary-button-text {

color: #fff !important;

}



.underline-on-hover:hover {

text-decoration: underline !important;

}



.grey-infobar-text {

color: #202124 !important;

}



@media (prefers-color-scheme: dark) {

.primary-text:not([class^=3D"x_"]) {

color: #e8eaed !important;

}



.secondary-text:not([class^=3D"x_"]),

.phone-number:not([class^=3D"x_"]) a {

color: #9aa0a6 !important;

}



.grey-button-text:not([class^=3D"x_"]),

.attachment-chip:not([class^=3D"x_"]) a {

color: #bdc1c6 !important;

}



.accent-text:not([class^=3D"x_"]),

.hairline-button-text:not([class^=3D"x_"]) {

color: #8ab4f8 !important;

}



.primary-button:not([class^=3D"x_"]) {

background-color: #8ab4f8 !important;

}



.primary-button-text:not([class^=3D"x_"]) {

color: #202124 !important;

}

}















Ominshield Phish from Google Gmail Part 2

Posted by Dave Yadallee on
Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable




schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-microsoft-com:office:offi=

ce">
t=3D"text/html; charset=3DUTF-8">
=3Ddevice-width,initial-scale=3D1">
ight dark">





















=20



=20



=20



=20

















Webroot Phish from Google Gmail Part 2

Posted by Dave Yadallee on
Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable




schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-microsoft-com:office:offi=

ce">
t=3D"text/html; charset=3DUTF-8">
=3Ddevice-width,initial-scale=3D1">
ight dark">





















=20



=20



=20



=20

Webroot Phish from Google Gmail Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 18 May 2026 16:55:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wP6qk-000000009p2-42mM

for dave@doctor.nl2k.ab.ca;

Mon, 18 May 2026 16:54:14 -0600

Resent-From: The Doctor

Resent-Date: Mon, 18 May 2026 16:54:14 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-oa1-f73.google.com ([209.85.160.73]:56595)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wP1cT-00000000Kye-0UHN

for root@nk.ca;

Mon, 18 May 2026 11:19:18 -0600

Received: by mail-oa1-f73.google.com with SMTP id 586e51a60fabf-43a281ca836so5560363fac.1

for ; Mon, 18 May 2026 10:18:21 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=google.com; s=20251104; t=1779124695; x=1779729495; darn=nk.ca;

h=from:subject:date:message-id:sender:reply-to:mime-version:from:to

:cc:subject:date:message-id:reply-to;

bh=huOFsqBulKDEkvgMeDzN+JYFkAm+GKMa317UCey+ZuU=;

b=TNl8FqYod3tkey82wp5SRrxub8g4Lc2uibhuDPM0rKgSfgUVJfTYyxrbw15moayhBk

u2Z61akVK9YHDBVMPDiKpFX46W1dNXHzQbsCHI2kdQmkxhBcThwXAaOdM0XtxrUB1hy/

CIiV+q8ebdeJPeJkRlXPUZTxdAtvbIsNBc9iXLOZK2kgeiXVYIAEUY8v/+5suagwZWWo

bWfIXWjNk2Dt4JAskAPgGYTKAg220ZA3mnSZpp0oZOctlm0X/+hdKNt8bwipYgQUclJo

DGpH+Lqieum3jG9YumtV8/rdf3fK6oKzKYc1eMe6cTEhX6cbEvHotysA+7SSuXb9pQCf

PkTQ==

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=emailora-org.20251104.gappssmtp.com; s=20251104; t=1779124695; x=1779729495; darn=nk.ca;

h=from:subject:date:message-id:sender:reply-to:mime-version:from:to

:cc:subject:date:message-id:reply-to;

bh=huOFsqBulKDEkvgMeDzN+JYFkAm+GKMa317UCey+ZuU=;

b=Bc899/KOwMPDrNZI3Ns740qcjc0XEOC0FGnPdjxDLEimw7nxtrCliu0MiCBos/iA8h

1pUg2WeQUaHsEJ0EUfAuigd68b+1CHFj3kQMtOu6tT6NB0i6uGfcp+B8F8N5k0Iqu6Xa

GKGXYLsQERpwgyLos7JkScq7rkLjiUufgAlQMBeZ5+04f865YRUr43V7EGjFrwbWSTQ+

/qre/4klkEmQCLTSEKj+17sqEcb1zkcimC49s7dFqoiR8I1eNqUVP+a7iql39MuI3XZT

MCXxQqb0A9c+9H519MCbLbzj4Sj0s7hxCkEGGO9euMg1rWEmDF/CDE5WP02m15CdsqL4

ib2A==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1779124695; x=1779729495;

h=from:subject:date:message-id:sender:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=huOFsqBulKDEkvgMeDzN+JYFkAm+GKMa317UCey+ZuU=;

b=Bvdzq+f3d3jHof4/VTPt9jrXBMtFlUAcINSHTtdq7PZJhiUra1jo5991GYIt4enoZq

jRBGo7DuuHaV7JE4q4mnanqgfrLmbZ4JJ616yWLxGYrShxr1u3ujUMCEgKyirJZYlE2d

91n+NAI6gkbkcN2CFkH1gEclo62I45M3yfljyNOOvLthqUDFTO3OR6DmIfhthEiuyGla

zPTh6/HhTOIIlID2ax+KpT8whb6JD7aP+M62l08GS9tj6D65uVyhI39edFfLexsjs/9v

bPMamjRkLZCru8ozvX8RivV7nCXo7frUJZZ1Fo+AwdpUQpkSLH7i9RWuxqGUsN9GxhYJ

biDg==

X-Forwarded-Encrypted: i=1; AFNElJ9zWVBJI/GLDVOtMXvXk2IbNhgJ0LpaNTJxpB8CDASsmeFRp03ANZHvZgSeiqbW0+eTW6bp@nk.ca

X-Gm-Message-State: AOJu0YwzG/LVgL7TI4tqYDXb6gneX7QqE/vmshXJ57z814lIgYjY3Euv

nC7JLa4Or+KWdiUKI3r7VTq4OAjngoYm93DD3UgKDLJXCUJ0iW0U7d2A8we2lIype59l96sD3rr

ojIgmm54TqBUApAM5pc0ql48lbSsj9ttodFOcyljLGEG7aA==

MIME-Version: 1.0

X-Received: by 2002:a05:6830:3591:b0:7d7:fb8c:3c29 with SMTP id

46e09a7af769-7e4f2b93801mt12421283a34.14.1779124695169; Mon, 18 May 2026

10:18:15 -0700 (PDT)

Reply-To: no reply

Sender: Google Calendar

Message-ID:

Date: Mon, 18 May 2026 17:18:15 +0000

Subject: #IYE1Z59

From: no reply

Content-Type: multipart/alternative; boundary="00000000000081f25e06521abf21"

X-Spam_score: 8.6

X-Spam_score_int: 86

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: #IYE1Z59 #IYE1Z59 Tuesday May 19, 2026 â‹… 2:17am Eastern

Time - New York Your Subscription Renewal Has Been Scheduled Dear Customer,





Content analysis details: (8.6 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.160.73 listed in dnsbl.ahbl.org]

[209.85.160.73 listed in dnsbl.ahbl.org]

[209.85.160.73 listed in dnsbl.ahbl.org]

[209.85.160.73 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.160.73 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.160.73 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.160.73 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.160.73 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.160.73 listed in will-spam-for-food.eu.org]

[209.85.160.73 listed in will-spam-for-food.eu.org]

[209.85.160.73 listed in will-spam-for-food.eu.org]

[209.85.160.73 listed in will-spam-for-food.eu.org]

[209.85.160.73 listed in will-spam-for-food.eu.org]

[209.85.160.73 listed in will-spam-for-food.eu.org]

[209.85.160.73 listed in will-spam-for-food.eu.org]

[209.85.160.73 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.160.73 listed in list.dnswl.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.2 MISSING_HEADERS Missing To: header

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.160.73 listed in bl.score.senderscore.com]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.160.73 listed in wl.mailspike.net]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

1.9 REPLYTO_WITHOUT_TO_CC No description available.

0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

1.5 IMPRONONCABLE_2 Too much mixed numbers and lower-case letters

0.6 LONG_INVISIBLE_TEXT Long block of hidden text - bayes poison?

Subject: {SPAM?} #IYE1Z59



--00000000000081f25e06521abf21

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes

Content-Transfer-Encoding: base64



I0lZRTFaNTkNCg0KI0lZRTFaNTkNClR1ZXNkYXkgTWF5IDE5LCAyMDI2IOKLhSAyOjE3YW0NCkVh

c3Rlcm4gVGltZSAtIE5ldyBZb3JrDQoNCg0KDQpZb3VyIFN1YnNjcmlwdGlvbiBSZW5ld2FsIEhh

cyBCZWVuIFNjaGVkdWxlZA0KRGVhciBDdXN0b21lciwNCg0KWW91ciBjdXJyZW50IHByb3RlY3Rp

b24gcGxhbiBhc3NvY2lhdGVkIHdpdGggTm9ydG9uIGlzIGFwcHJvYWNoaW5nIGl0cyAgDQpyZW5l

d2FsIGRhdGUgb2YgVHVlc2RheSwgMTkgTWF5IDIwMjYuIFRvIG1haW50YWluIGFjdGl2ZSBjb3Zl

cmFnZSwgdGhlICANCmFtb3VudCBvZiAkNTgxLjc3IHdpbGwgYmUgYXV0b21hdGljYWxseSBjaGFy

Z2VkIHVzaW5nIHlvdXIgcHJlZmVycmVkICANCmJpbGxpbmcgbWV0aG9kLg0KDQoqKlJlbmV3YWwg

U3VtbWFyeSoqDQoNCuKAoiBTZXJ2aWNlIFBhY2thZ2U6IFdlYnJvb3QgU3RhbmRhcmQNCuKAoiBE

ZXZpY2VzIEVucm9sbGVkOiA0eA0K4oCiIENvdmVyYWdlIFRlcm06IDYwIE1vbnRocyBZZWFyKHMp

DQrigKIgQmlsbGluZyBNZXRob2Q6IEF1dG9tYXRpYyBEZWJpdA0K4oCiIFRvdGFsIER1ZTogJDU4

MS43Nw0KDQpSZWZlcmVuY2UgTnVtYmVyOiBYV1BWVTZQTDMwDQpBY3RpdmF0aW9uIFZlcmlmaWNh

dGlvbjogZGFkYjRiYzgtNWJmOC00NTc4LWIzZjgtZjdiMmY2NjgwNzFkDQoNClBsZWFzZSByZXZp

ZXcgeW91ciBhY2NvdW50IGRldGFpbHMgY2FyZWZ1bGx5LiBBbnkgY2FuY2VsbGF0aW9uIG9yICAN

CnN1YnNjcmlwdGlvbiB1cGRhdGUgcmVxdWVzdHMgc2hvdWxkIGJlIHN1Ym1pdHRlZCBubyBsYXRl

ciB0aGFuIDQ4IGhvdXJzICANCmJlZm9yZSB0aGUgc2NoZWR1bGVkIGJpbGxpbmcgZGF0ZS4NCg0K

Rm9yIGFzc2lzdGFuY2UsIHJlYWNoIG91ciBjdXN0b21lciBzZXJ2aWNlIHRlYW0gYXQgMSA4NTQg

NTAwLTQyMTEuDQoNCldpdGggc2luY2VyZSByZXNwZWN0LCwNCk5vcnRvbiBMaWZlTG9jayBzZWN1

cml0eQ0KRmluYW5jZSBNYW5hZ2VyOiBDcnlzdGFsIE1pbGxlcg0KQ29udGFjdCBIZWxwbGluZTog

MSA4NTYgNjIwLTY4MTYNCkZvcm1hbCBDb3JyZXNwb25kZW5jZSBBZGRyZXNzLDogMTA5MjQgTncg

MzBUaCBQbCwgU3VucmlzZSBFbmZpZWxkIEN0IDYwODIgIA0KVVNBDQpTdXBwb3J0IEhvdXJzOiA2

IEFNIOKAkyA2IFBNDQoNCg0KT3JnYW5pemVyDQpubyByZXBseQ0Kbm8uci5lLnAubC55LnUucGQu

YXQuZXNAZW1haWxvcmEub3JnDQoNCkd1ZXN0cw0KKEd1ZXN0IGxpc3QgaGFzIGJlZW4gaGlkZGVu

IGF0IG9yZ2FuaXplcidzIHJlcXVlc3QpDQoNCg==

--00000000000081f25e06521abf21

Norton Phish from Google Gmail Part 4

Posted by Dave Yadallee on

/InformAction">
emtype=3D"http://schema.org/EmailMessage">
ntent=3D"no reply: #JRHYMQO"/>
emtype=3D"http://schema.org/Event">
=3D"http://schema.org/EventScheduled"/>
pe itemtype=3D"http://schema.org/Organization">
ent=3D"Google Calendar"/>
ontent=3D"04ier77IL3wBYIuEQcbaMHPfhH"/>
ize: 1px; color: #fff; line-height: 1px; height: 0; max-height: 0; width: 0=

; max-width: 0; opacity: 0; overflow: hidden;" itemprop=3D"name">#OPHFBZX
span>
role=3D"presentation" align=3D"center" style=3D"width:100%;" class=3D"body-=

container">

e=3D"height:16px;" aria-hidden=3D"true">  

g=3D"0" role=3D"presentation" align=3D"center" style=3D"width:100%;" class=

=3D"">

temtype=3D"http://schema.org/EmailMessage">

#JRH=

YMQO


"0" cellspacing=3D"0" role=3D"presentation" align=3D"center" style=3D"width=

:100%;" class=3D"">
>

r-radius: 8px; direction: rtl; font-size: 0; padding: 24px 32px; text-align=

: left; vertical-align: top;" class=3D"main-container-inner">

: left; direction: ltr; display: inline-block; vertical-align: top; width: =

100%;overflow: hidden; word-wrap: break-word;">
ing=3D"0" cellspacing=3D"0" role=3D"presentation" width=3D"100%" class=3D"m=

ain-column-table-ltr" style=3D"padding-right: 32px; padding-left: 0;;table-=

layout: fixed;">
>

vertical-align:top;">
0" role=3D"presentation" width=3D"100%" style=3D"table-layout: fixed;">=


word;;padding-bottom:2px;">

, Roboto, sans-serif;font-weight: 400; font-size: 22px; line-height: 28px;c=

olor: #3c4043; text-decoration: none;" class=3D"primary-text" role=3D"prese=

ntation">#OPHFBZX

le=3D"font-size: 0; padding: 0; text-align: left; word-break: break-word;;p=

adding-bottom:24px;">

le: normal; font-weight: 400; font-size: 14px; line-height: 20px; letter-sp=

acing: 0.2px;color: #3c4043; text-decoration: none;" class=3D"primary-text"=

role=3D"presentation">Tuesday May 19, 2026 =E2=8B=85 2=

:12am (Eastern Time - New York)

-size: 0; padding: 0; text-align: left; word-break: break-word;;padding-bot=

tom:24px;">

; font-weight: 400; font-size: 14px; line-height: 20px; letter-spacing: 0.2=

px;color: #3c4043; text-decoration: none;" class=3D"primary-text" role=3D"p=

resentation">Important Reminder About Your Upcoming Renewal
Dear V=

alued Customer,

This is an important reminder regarding the renewal of yo=

ur active coverage linked to Norton. Your subscription is set to renew on T=

uesday, 19 May 2026, and the renewal fee of USD548.66 will be billed automa=

tically.

**Coverage Information**

=E2=80=A2 Registered Item: Fu=

ll Membership
=E2=80=A2 Number of Devices: x1 Device(s)
=E2=80=A2 Ser=

vice Coverage: Five Years Year(s)
=E2=80=A2 Payment Arrangement: Auto Pa=

y
=E2=80=A2 Renewal Total: USD548.66

Account Reference: P1GD5BS276=


Confirmation Signature: 106e1150-245f-447d-867b-8dfeb1ed32e0

To a=

void interruption or unwanted renewal charges, please submit any cancellati=

on requests at least 48 hours before the renewal processing date.

Nee=

d help? Please contact our support center at 1 854 500-4211.

Grateful=

always,,
Norton LifeLock Protection
Billing Director: Robert Collins=


Customer Helpdesk Line: 1 854 500-4235
Administrative Address,: 4512=

Hwy 90 East Bear De 19701 US
Daily Operation Hours: 6 AM =E2=80=93 6 PM=



About Your Upcoming Renewal

Dear Valued Customer,



This is an important reminder regarding the renewal of your active coverage=

linked to Norton. Your subscription is set to renew on Tuesday, 19 May 202=

6, and the renewal fee of USD548.66 will be billed automatically.



**Coverage Information**



=E2=80=A2 Registered Item: Full Membership

=E2=80=A2 Number of Devices: x1 Device(s)

=E2=80=A2 Service Coverage: Five Years Year(s)

=E2=80=A2 Payment Arrangement: Auto Pay

=E2=80=A2 Renewal Total: USD548.66



Account Reference: P1GD5BS276

Confirmation Signature: 106e1150-245f-447d-867b-8dfeb1ed32e0



To avoid interruption or unwanted renewal charges, please submit any cancel=

lation requests at least 48 hours before the renewal processing date.



Need help? Please contact our support center at 1 854 500-4211.



Grateful always,,

Norton LifeLock Protection

Billing Director: Robert Collins

Customer Helpdesk Line: 1 854 500-4235

Administrative Address,: 4512 Hwy 90 East Bear De 19701 US

Daily Operation Hours: 6 AM =E2=80=93 6 PM

"/>

eft; word-break: break-word;;padding-bottom:24px;">

y: Roboto, sans-serif;font-style: normal; font-weight: 400; font-size: 14px=

; line-height: 20px; letter-spacing: 0.2px;color: #3c4043; text-decoration:=

none;" class=3D"primary-text" role=3D"presentation">
llpadding=3D"0" cellspacing=3D"0" role=3D"presentation" style=3D"padding-bo=

ttom: 4px;">


or: #3c4043; text-decoration: none;font-weight: 700;-webkit-font-smoothing:=

antialiased;margin: 0; padding: 0;">Guests

(Guest li=

st has been hidden at organizer's request)


--000000000000a7852406521aaedb--

Norton Phish from Google Gmail Part 3

Posted by Dave Yadallee on
.primary-button {

background-color: #1a73e8 !important;

}



.primary-button-text {

color: #fff !important;

}



.underline-on-hover:hover {

text-decoration: underline !important;

}



.grey-infobar-text {

color: #202124 !important;

}



@media (prefers-color-scheme: dark) {

.primary-text:not([class^=3D"x_"]) {

color: #e8eaed !important;

}



.secondary-text:not([class^=3D"x_"]),

.phone-number:not([class^=3D"x_"]) a {

color: #9aa0a6 !important;

}



.grey-button-text:not([class^=3D"x_"]),

.attachment-chip:not([class^=3D"x_"]) a {

color: #bdc1c6 !important;

}



.accent-text:not([class^=3D"x_"]),

.hairline-button-text:not([class^=3D"x_"]) {

color: #8ab4f8 !important;

}



.primary-button:not([class^=3D"x_"]) {

background-color: #8ab4f8 !important;

}



.primary-button-text:not([class^=3D"x_"]) {

color: #202124 !important;

}

}















Norton Phish from Google Gmail Part 2

Posted by Dave Yadallee on
Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable




schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-microsoft-com:office:offi=

ce">
t=3D"text/html; charset=3DUTF-8">
=3Ddevice-width,initial-scale=3D1">
ight dark">





















=20



=20



=20



=20