Chinese products spam
Posted by Dave Yadallee on
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Mon, 13 Jul 2026 16:11:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))
(envelope-from)
id 1wjOrM-00000000MHG-2b1j
for dave@doctor.nl2k.ab.ca;
Mon, 13 Jul 2026 16:10:44 -0600
Resent-From: The Doctor
Resent-Date: Mon, 13 Jul 2026 16:10:44 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-m4785125127.xmail.ntesmail.com ([47.85.125.127]:14314)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384
(Exim 4.99.3 (FreeBSD))
(envelope-from)
id 1wjKyn-000000006un-2h05
for sales@nk.ca;
Mon, 13 Jul 2026 12:02:23 -0600
Content-Type: multipart/alternative; BOUNDARY="=_Part_33398_294669893.1783965670429"
To: sales
Reply-To: huangyi@nmtbiotech.com
Subject: =?UTF-8?B?SW5xdWlyeSBSZWdhcmRpbmcgTmF0dXJhbCBBS0cgUHJvZHVjdHM=?=
X-Priority: 3
MIME-Version: 1.0
Received: from td@nmtbiotech.com( [10.139.0.42] ) by ajax-webmail ( [127.0.0.1] ) ; Tue, 14 Jul 2026 02:01:10 +0800 (GMT+08:00)
From: Vivian
Date: Tue, 14 Jul 2026 02:01:10 +0800 (GMT+08:00)
X-WM-Tid: 0a9f5ca3dc15d068kusy9fb0e49ca444
DKIM-Signature: a=rsa-sha256;
b=KaHqUrMo0573ApTbLUxZLQ+Ha4B0rM9kthWo3jiyrpxTTW3WVFVcYkdoCPpvbqscVokDfZEcWL5q7DR1rHffc7HV4nMqxT8+IUFyd9Sfa2FjwcBEnpIKzA0naTtRp70P6OD641oaKxCp5F9kDBzVq+6nEWw7S9t8VxWH5NWpJws=; s=default; c=relaxed/relaxed; d=nmtbiotech.com; v=1;
bh=m+KKC6f+ZRQ7Xc5fVBb+RulLdf8dCzi25dMdH1qrljA=;
h=date:mime-version:subject:message-id:from;
Message-ID:
Greetings Sales,
I hope this message finds you well. This is Adam from NMT Biotech.
NMT Biotech is a multinational company based in Hong Kong, specializing in a global biochemicals business. We leverage an extensive production supply chain in mainland China alongside cutting-edge biotechnology from the United States, Japan, and Europe. This enables us to produce high-quality pharmaceutical ingredients, food supplement ingredients, cosmetic ingredients, flavor and fragrance ingredients, feed additives, and fertilizer additives that meet diverse industry standards worldwide. We have established or are in the process of establishing processing plants and warehouses in the United States, Europe, Japan, and other regions to facilitate global distribution.
I would like to explore opportunities to collaborate with you regarding our Natural (Alpha Ketoglutaric Acid / AKG) series products. I look forward to hearing from you soon.
For further details about our company, kindly explore our website: www.nmtbiotech.net. Linkedin Thank you for your attention.
Best regards,
Vivian
NMT Biotech
Email: sales@nmtbiotech.com
WhatsApp: 8615806215916
--_000_TYSPR02MB77610E1A7597F6EACCD694F5ABFA2TYSPR02MB7761apcp_
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
1">
Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Hi,
nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=
olor: rgb(0, 0, 0);">
nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=
olor: rgb(0, 0, 0);">
I found that your website isn't doing well and has customers in Google sear=
ch results.
nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=
olor: rgb(0, 0, 0);">
nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=
olor: rgb(0, 0, 0);">
We can place your website on Google's first page.
nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=
olor: rgb(0, 0, 0);">
nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=
olor: rgb(0, 0, 0);">
May I send an SEO proposal and price?
nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=
olor: rgb(0, 0, 0);">
Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Thank you.
--_000_TYSPR02MB77610E1A7597F6EACCD694F5ABFA2TYSPR02MB7761apcp_--
Haresasz Nxysarwsa has invited you to Urgent: Your PayPal Order Confirmation - Invoice #INV-9942-XPS processed successfully
Title: Urgent: Your PayPal Order Confirmation - Invoice #INV-9942-XPS processed successfully
When: July 13, 2026
Organizer:
Haresasz Nxysarwsa
Description: Dear Valued Customer,
Thank you for your recent order with PayPal. We are pleased to confirm that your order has been processed successfully and that your payment has been authorized.
We appreciate your business and look forward to serving you.
The authorized payment will be reflected in your account activity shortly.
For any inquiries, please contact us at +1 805 302 5662.
Invoice Details:
Invoice ID: INV-9942-XPS
Product: Dell XPS 13 Laptop
Order Date: Jul 13, 2026
Amount Due: $749.00 USD
Payment Method: Authorized PayPal Auto-Debit
If you did not authorize this charge, please contact us within 12 hours to review the transaction and request a refund.
For cancellations or concerns regarding unauthorized charges, please contact our support team at +1 805 302 5662.
This is an automated message. For further assistance, please contact our support team.
©️ 1999–2026 PayPal All Rights Reserved.
Attendees:
cynthiaperez389903@groups.outlook.com
Dear Valued Customer,
Thank you for your recent order with PayPal. We are pleased to confirm that your order has been processed successfully and that your payment has been authorized.
We appreciate your business and look forward to serving you.
The authorized payment will be reflected in your account activity shortly.
For any inquiries, please contact us at +1 805 302 5662.
Invoice Details:
Invoice ID: INV-9942-XPS
Product: Dell XPS 13 Laptop
Order Date: Jul 13, 2026
Amount Due: $749.00 USD
Payment Method: Authorized PayPal Auto-Debit
If you did not authorize this charge, please contact us within 12 hours to review the transaction and request a refund.
For cancellations or concerns regarding unauthorized charges, please contact our support team at +1 805 302 5662.
This is an automated message. For further assistance, please contact our support team.
©️ 1999–2026 PayPal All Rights Reserved.
Kedy
pondelok 13. júl 2026
Organizátor
Haresasz Nxysarwsa
haressaznzxrrsxaxz321@gmail.com
Hostia
(Zoznam hostí bol na žiadosť organizátora skrytý)
Odpoveď na cynthiaperez389903@groups.outlook.com
Áno
Nie
Možno
Ďalšie možnosti
Pozvánka z Kalendára Google
Túto správu ste dostali, pretože ste účastníkom danej udalosti.
Ak túto pozvánku prepošlete, ktorýkoľvek jej príjemca bude môcť odoslať odpoveď organizátorovi, byť pridaný do zoznamu hostí, pozývať iných bez ohľadu na ich vlastný stav pozvánky alebo meniť vaše potvrdenie účasti. Ďalšie informácie
X-EOPTenantAttributedMessage: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa:0
X-MS-PublicTrafficType: Email
X-MS-TrafficTypeDiagnostic: BN2PEPF0000449F:EE_|DS0PR18MB5393:EE_
X-MS-Office365-Filtering-Correlation-Id: 409fca8a-4902-4570-225c-08dee104f292
X-Sender-IP: 209.85.128.69
X-MS-Exchange-EOPDirect: true
X-SID-PRA: HARESSAZNZXRRSXAXZ321@GMAIL.COM
X-SID-Result: PASS
X-MS-Consumer-Group-Expansion-Loop: cynthiaperez389903@groups.outlook.com
X-MS-Exchange-Group-Expansion-Loop: cynthiaperez389903@groups.outlook.com
X-Microsoft-Antispam:
BCL:0;ARA:1444111002|6092099016|26000799027|9000799056|9400799043|9020799019|32020799003|1680799066|3151999006|16200799027|34130799006|4040799016|970799063|26130799012|3069299007|29080799009|5139299004|24102599021|6019299003|22000799015|1041999012|1602099012|30041999003|22062799003|2145499017|18021999003|56899033|1370799030|1360799030|1380799030|3412199025|26104999009|440099028|4302099013;
X-Microsoft-Antispam-Message-Info:
=?utf-8?B?MUUyZXNVUXF2ZW5PUkRSWTFhS1MwczFlZ3h0cXRsUTlVTnYyUllqNEQzZWVq?=
=?utf-8?B?cXg4UXo1eTVSQzZOZ0R6MFZWbmxGMHVJcENrWVdSYmNIcERUZ0txbXJ4aEFz?=
=?utf-8?B?eXNKQ24vZ0p0MkZZajF0ZVdkd0Zjb3oxKzYydlB0dzc5OUFnOGRkYmRrREVt?=
=?utf-8?B?cDV2TG0wcmxLSEN0N05MbHdWUHJhaXYxMlNUdTZ3VFpQKzMrZC9VMkNYYWNN?=
=?utf-8?B?S0laeFZXYUwxMSsrdy9NSWtXOXBicWFqYmhoNlJFYVVMcjQxOFZ5V2pPNytL?=
=?utf-8?B?WEFtTytVbXJOcHkxQ0JjTmY0Q0x1VkxYK1kwY2xnb2c5ZkhkT05VQVMwMmRa?=
=?utf-8?B?T0F5SjRma09MN3VESU41WHpwU21zRXIxbDZWZmFuUzdRam56SGFQRWd3RmZz?=
=?utf-8?B?QnduT2FLWXNsbTVCUzVmUDZWMkdXZHh5VHVacWwrR0tYSmszYUcxY3dqOG1K?=
=?utf-8?B?OEg2Qm9jQkY1QVBDUDBzYzJjRmxCNmxSTm42MlhuTjRsZUlkWSthVDkrS0VJ?=
=?utf-8?B?RjZoWTE2T1dsZHVQU1NyWDBDTWVDWnNVMkxLNUR5d0lJQy91R0RseTJ6Y3Rt?=
=?utf-8?B?Y1Q0V2ttR1E3TjdFajRJQXdpbE8rKzlLWjJEU1ZoM2ptNSsybDdiVWpIV3FK?=
=?utf-8?B?T1ZBR2pPWThId2lQTUFmS09qM25rWnZndHhRclA5TlpveVBWVkJ4Q2s2TC9L?=
=?utf-8?B?cXhQQ3B1Y21lU05yOTdJZGZRaXA4dkp2WG4rOUZ2WEF4VWlDWmZrMURXOTVD?=
=?utf-8?B?eElSYnRqaDBoc0pWUFIyZ3pSb08rOG5rWmhMZUx3QyswRzQyc1NDZFowaFFK?=
=?utf-8?B?a3pHdTBmaUZnejIyQmV6NVhGNVlIQUZSMXRQVXh2Y09BK3ZMMGI0amZZUXBY?=
=?utf-8?B?bEZLV3hsZGp4ckNUZXBpbWZRMytyQ3BDNkRnU21VM3YwSzdUNjRPamlnVlhZ?=
=?utf-8?B?T3lkUlA5RzBqSk5OYUh1UUNYTzZXcnhrN1Rtd2NZL2JtRGlOSUgrVEVKZ0xS?=
=?utf-8?B?a3FXSzBFOVppRVFFdHR3RHRuLzVnTTM1dGRuYW01UnBKZU41UEdtNzlqMFp4?=
=?utf-8?B?WTh1cWtlSlhsYjFPVmhWN292eERmcUthM0lJejBTR28zSjkwK0pTNlNEZVBL?=
=?utf-8?B?U1gyMjk0ZGNkUTBCSDZHNWVxRFpITU9sUkg5RkdvbU9RNzFFMFV2TnhaYVRy?=
=?utf-8?B?OENoZTlYczFHNGlLNVp6bURwWFExbnd0N2tYdjRlT0QwRC9wbjZ2ekU5ek9a?=
=?utf-8?B?VHErVXVmQ1hhcm4xTml3eFVsMlE4b2c1RFZQMXVBa1lGdXBKdGtpc3FNclgz?=
=?utf-8?B?cEQyUkRjQ1NLajNYL2N0c2FoQzVvS0NhOW9hTlRmUm0yZlFMNmJqN2hmYm9n?=
=?utf-8?B?bGxBeWZVNnRqaVptdXNMclN5alZheStUa2hYSk1hODY0cTJ2UHZZanp3WG1T?=
=?utf-8?B?R1B5K21WempINnN3NTlxVkVlYjU4dVRxMlI2bTFHVkk3dlZMQzhUWSs4RS84?=
=?utf-8?B?Tk5GdW9jYkpldWJ0NHFmQ0QvQzVKMnpTWnVZZXY0bG5yRDZKQU1iZmpQOTZm?=
=?utf-8?B?K21ORTg4WWRxMUVveGpqMTF2SW5EVnFtZ3RaeS8rT21lU29CajNyMStCQ3Fn?=
=?utf-8?B?RjdhY2JXVGc3elNIdlhEQ3VIZnNQeDBMYkVKb1NQSit2ZDB6Q3lmODRIU3g5?=
=?utf-8?B?end3NlE0Vi9YRTZ6aU1xV0NqcE5udk5ZeGZtRmtoTlpaUDRkd0dZRjZ3YXpP?=
=?utf-8?B?T2RSNmlpSStSdHE0anJuNlRSTVRSTm5JN2VxU2szeHo0dGo3R25yNTE3QlFD?=
=?utf-8?B?M0w1d3lOMFNCemhxckFrdjR3NWc3RmI5UHRsbi9hS1AzS1UyTXRKaGlBWS9u?=
=?utf-8?B?M0tqUDRybmRObElnWnFxUkxhdTFHbVN0bjFjTjJHMkZMdGtSOTExYjFNUXpM?=
=?utf-8?B?eDkvL25FNjNZRTRySGJxMzRPTUxtZkk5QnBQYWsyQ3lDam9vaVArdGdNTGNB?=
=?utf-8?B?NjJ3S0dibnlUaXdvWC9Ga25XSDQ0NG1hM2I3dk1ITW42eG1qNjFMU3ZSTUcx?=
=?utf-8?B?UWlUcGo3bEwwbURER1h4RGdCZHJjS0ROZjFaUkZMZE1ubHRLM2M1WmFHOTlT?=
=?utf-8?B?dDh0YmFUenRKUGlKM3ZNZ25JSlVTT1ZUS3RpNWIzbFI1VlJZcmJFWVlSaXlk?=
=?utf-8?B?a2FUNEd2WHBDNEx1b0E2a29DR3BvY0NHZkY4aXd4Zy9QYmR0UGo2aUorRyt1?=
=?utf-8?B?MStmaElFTENiWERkeDdjMGdxSVdJUnAyL1UyblYvOGxubUI5VVlPZGFLbHkv?=
=?utf-8?B?V2c1SUhzUW1hSFNJNTNmSUR3VTJRZUkwWVpESUJIZWJ3OWhPWWpqWjBNTjEr?=
=?utf-8?B?ZVdvRVlMU3dWbEl5cmZIM1hhUGFvVTUvd2szYkpOeU9XUkNKVU1JQ3ArYXVR?=
=?utf-8?B?YUNJTThMbTZhSVBxTjZvRkpEdGh2a2ZGNCtCeWttS3d6ZHhSOGNxOEdwV3Ri?=
=?utf-8?B?dWtranRMdm50SnJCSW5ZRWhBcXdEcENsZllRc1pQSXArdVBjVTVua0pJVTFt?=
=?utf-8?B?R2FaMFhKdm9XV1gvVG1NaXpQWUpOWTBEdXp6am9ZbEtTY2Zqc2x4K1hjdith?=
=?utf-8?B?Zk5OSU44dmpsb2lWNTlRQzFKMmxSdXh0V0pNN3d0cnVGWktsUk11UEE4WFFj?=
=?utf-8?B?d1ZmMitOTEg4TFZaSnc1OTBGMkx5aEVHUWNnaWhzelJRdXVsTWhERnAxczBn?=
=?utf-8?B?bTVXcjJEczNiUHhGMVhtR2dxc0xaTjh2ZkIrLzU2RHFxYUR0T08wbm9tQml1?=
=?utf-8?B?N2owWU84SkpHRlBqZlpqWHR4eFNXQnpOcWF2R0h2ZDRMRXgrRVNMNXVseDJt?=
=?utf-8?B?aitaZExmUm1XZ2FwK2tML3BUNWEyVWlxbEVyVUdCK2RCM2U0eEYzNGFBMUR2?=
=?utf-8?B?KzRiSVpPck1QOVhVUk1QazB6V2RiRHRaVDczS3JrT3hYaWMrbHVuM1JDeVhi?=
=?utf-8?B?NExOcUM4SGFDa2psT0s5U0l3aHNNTlUxVGJOTEROeHpEVHpSY3FDbGRuUnFy?=
=?utf-8?B?YTVqMEZkNXJmc0Ixa09qNWRic3VNaGZLeXJSVjl5M1ZXa1JnVk1lT3BqR0Rz?=
=?utf-8?B?VXU2RThiWDFiV3RKTTFWN2dWTC8zN0RIMFJ4RUxWWi9OL0g0eExhZ2xXaDFY?=
=?utf-8?B?ZU9YbGdBRkNWa1NtUmpLcnMxNVlGZkw2c0hWQTdVZjFvNHArT2U3Y2ZZK1Zt?=
=?utf-8?B?Kzd0YW1Rc3RadjhhQXRjblA1clZtdnIzUm1jZUQxTUhyaWxWYVVjUDJ2WDdJ?=
=?utf-8?B?NURaZDlBeDJyZ2owUnhLbjIxY0VYSitwWnczMytDaklOeitOM1BlekcrSjlZ?=
=?utf-8?B?WHpxRDlKUVdCM3luUThIREh5a0ZET25CalNkcnJRYVN2Z21JMkw5UUJHdz09?=
X-Auto-Response-Suppress: DR, OOF, AutoReply
X-OriginatorOrg: sct-15-20-9412-4-msonline-outlook-090a5.templateTenant
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 13 Jul 2026 17:34:09.8666
(UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 409fca8a-4902-4570-225c-08dee104f292
X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa
X-MS-Exchange-CrossTenant-AuthSource: BN2PEPF0000449F.namprd02.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: Internet
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DS0PR18MB5393
X-Spam_score: 13.7
X-Spam_score_int: 137
X-Spam_bar: +++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Urgent: Your PayPal Order Confirmation - Invoice #INV-9942-XPS
processed successfully pondelok 13. júl 2026 Dear Valued Customer, Thank
you for your recent order with PayPal. We are pleased to confirm that your
order has been processed successfully and that your payment has been authorized.
We appreciate yo [...]
Content analysis details: (13.7 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[40.93.14.11 listed in dnsbl.ahbl.org]
[40.93.14.11 listed in dnsbl.ahbl.org]
[40.93.14.11 listed in dnsbl.ahbl.org]
[40.93.14.11 listed in dnsbl.ahbl.org]
[209.85.128.69 listed in dnsbl.ahbl.org]
[209.85.128.69 listed in dnsbl.ahbl.org]
[209.85.128.69 listed in dnsbl.ahbl.org]
[209.85.128.69 listed in dnsbl.ahbl.org]
[2603:10b6:408:109:cafe:0:0:c listed in]
[dnsbl.ahbl.org]
[2603:10b6:408:109:cafe:0:0:c listed in]
[dnsbl.ahbl.org]
[2603:10b6:408:109:cafe:0:0:c listed in]
[dnsbl.ahbl.org]
[2603:10b6:408:109:cafe:0:0:c listed in]
[dnsbl.ahbl.org]
[2603:10b6:408:109:0:0:0:15 listed in]
[dnsbl.ahbl.org]
[2603:10b6:408:109:0:0:0:15 listed in]
[dnsbl.ahbl.org]
[2603:10b6:408:109:0:0:0:15 listed in]
[dnsbl.ahbl.org]
[2603:10b6:408:109:0:0:0:15 listed in]
[dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[40.93.14.11 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[40.93.14.11 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[40.93.14.11 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[40.93.14.11 listed in dnsbl.ahbl.org]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[209.85.128.69 listed in will-spam-for-food.eu.org]
[209.85.128.69 listed in will-spam-for-food.eu.org]
[209.85.128.69 listed in will-spam-for-food.eu.org]
[209.85.128.69 listed in will-spam-for-food.eu.org]
[209.85.128.69 listed in will-spam-for-food.eu.org]
[209.85.128.69 listed in will-spam-for-food.eu.org]
[209.85.128.69 listed in will-spam-for-food.eu.org]
[209.85.128.69 listed in will-spam-for-food.eu.org]
[2603:10b6:408:109:cafe:0:0:c listed in]
[will-spam-for-food.eu.org]
[2603:10b6:408:109:cafe:0:0:c listed in]
[will-spam-for-food.eu.org]
[2603:10b6:408:109:cafe:0:0:c listed in]
[will-spam-for-food.eu.org]
[2603:10b6:408:109:cafe:0:0:c listed in]
[will-spam-for-food.eu.org]
[2603:10b6:408:109:cafe:0:0:c listed in]
[will-spam-for-food.eu.org]
[2603:10b6:408:109:cafe:0:0:c listed in]
[will-spam-for-food.eu.org]
[2603:10b6:408:109:cafe:0:0:c listed in]
[will-spam-for-food.eu.org]
[2603:10b6:408:109:cafe:0:0:c listed in]
[will-spam-for-food.eu.org]
[2603:10b6:408:109:0:0:0:15 listed in]
[will-spam-for-food.eu.org]
[2603:10b6:408:109:0:0:0:15 listed in]
[will-spam-for-food.eu.org]
[2603:10b6:408:109:0:0:0:15 listed in]
[will-spam-for-food.eu.org]
[2603:10b6:408:109:0:0:0:15 listed in]
[will-spam-for-food.eu.org]
[2603:10b6:408:109:0:0:0:15 listed in]
[will-spam-for-food.eu.org]
[2603:10b6:408:109:0:0:0:15 listed in]
[will-spam-for-food.eu.org]
[2603:10b6:408:109:0:0:0:15 listed in]
[will-spam-for-food.eu.org]
[2603:10b6:408:109:0:0:0:15 listed in]
[will-spam-for-food.eu.org]
[40.93.14.11 listed in will-spam-for-food.eu.org]
[40.93.14.11 listed in will-spam-for-food.eu.org]
[40.93.14.11 listed in will-spam-for-food.eu.org]
[40.93.14.11 listed in will-spam-for-food.eu.org]
[40.93.14.11 listed in will-spam-for-food.eu.org]
[40.93.14.11 listed in will-spam-for-food.eu.org]
[40.93.14.11 listed in will-spam-for-food.eu.org]
[40.93.14.11 listed in will-spam-for-food.eu.org]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[40.93.14.11 listed in list.dnswl.org]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |]
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |]
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[40.93.14.11 listed in wl.mailspike.net]
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[40.93.14.11 listed in bl.score.senderscore.com]
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
-0.0 SPF_PASS SPF: sender matches SPF record
1.0 HK_RANDOM_FROM From username looks random
1.0 HK_RANDOM_REPLYTO Reply-To username looks random
0.5 FROM_LOCAL_NOVOWEL From: localpart has series of non-vowel letters
3.5 VOWEL_FROM_7 Impronouncable from header (7+ consecutive vowels)
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
[haressaznzxrrsxaxz321(at)gmail.com]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[haressaznzxrrsxaxz321(at)gmail.com]
0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail
domains are different
-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay
domain
0.6 MEGALONGWORD BODY: Uses really overlong words
0.3 LONGWORD BODY: Uses overlong words
0.1 TW_RW BODY: Odd Letter Triples with RW
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.2 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and EnvelopeFrom
freemail headers are different
2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.1 TO_IN_SUBJ To address is in Subject
3.0 LONG_INVISIBLE_TEXT Long block of hidden text - bayes poison?
Subject: {SPAM?} =?UTF-8?Q?Pozv=C3=A1nky=3A_Urgent=3A_Your_PayPal_Order_Confirmation_=2D_?=
=?UTF-8?Q?Invoice_=23INV=2D994=2E=2E=2E_=40_po_13=2E_j=C3=BAl_2026_=28cynthiaperez389903=40g?=
=?UTF-8?Q?roups=2Eoutlook=2Ecom=29?=
ransform: none; text-indent: 0px; letter-spacing: normal; font-family: Aria=
l, Helvetica, sans-serif; font-size: small; font-style: normal; font-weight=
: 400; word-spacing: 0px; white-space: normal; orphans: 2; widows: 2; backg=
round-color: rgb(255, 255, 255); font-variant-ligatures: normal; font-varia=
nt-caps: normal; -webkit-text-stroke-width: 0px; text-decoration-thickness:=
initial; text-decoration-style: initial;=20
text-decoration-color: initial;">
ransform: none; text-indent: 0px; letter-spacing: normal; font-family: Aria=
l, Helvetica, sans-serif; font-size: small; font-style: normal; font-weight=
: 400; word-spacing: 0px; white-space: normal; orphans: 2; widows: 2; backg=
round-color: rgb(255, 255, 255); font-variant-ligatures: normal; font-varia=
nt-caps: normal; -webkit-text-stroke-width: 0px; text-decoration-thickness:=
initial; text-decoration-style: initial;=20
text-decoration-color: initial;">Thank you.
ransform: none; text-indent: 0px; letter-spacing: normal; font-family: Aria=
l, Helvetica, sans-serif; font-size: small; font-style: normal; font-weight=
: 400; word-spacing: 0px; white-space: normal; orphans: 2; widows: 2; backg=
round-color: rgb(255, 255, 255); font-variant-ligatures: normal; font-varia=
nt-caps: normal; -webkit-text-stroke-width: 0px; text-decoration-thickness:=
initial; text-decoration-style: initial;=20
text-decoration-color: initial;">
1pt;">
ransform: none; text-indent: 0px; letter-spacing: normal; font-family: Aria=
l, Helvetica, sans-serif; font-size: small; font-style: normal; font-weight=
: 400; word-spacing: 0px; white-space: normal; orphans: 2; widows: 2; backg=
round-color: rgb(255, 255, 255); font-variant-ligatures: normal; font-varia=
nt-caps: normal; -webkit-text-stroke-width: 0px; text-decoration-thickness:=
initial; text-decoration-style: initial;=20
text-decoration-color: initial;">Have a great day!
ransform: none; text-indent: 0px; letter-spacing: normal; font-family: Aria=
l, Helvetica, sans-serif; font-size: small; font-style: normal; font-weight=
: 400; word-spacing: 0px; white-space: normal; orphans: 2; widows: 2; backg=
round-color: rgb(255, 255, 255); font-variant-ligatures: normal; font-varia=
nt-caps: normal; -webkit-text-stroke-width: 0px; text-decoration-thickness:=
initial; text-decoration-style: initial;=20
text-decoration-color: initial;">
ransform: none; text-indent: 0px; letter-spacing: normal; font-family: Aria=
l, Helvetica, sans-serif; font-size: small; font-style: normal; font-weight=
: 400; word-spacing: 0px; white-space: normal; orphans: 2; widows: 2; backg=
round-color: rgb(255, 255, 255); font-variant-ligatures: normal; font-varia=
nt-caps: normal; -webkit-text-stroke-width: 0px; text-decoration-thickness:=
initial; text-decoration-style: initial;=20
text-decoration-color: initial;">
runge";'>Snehpal Brar
34, 34, 34); text-transform: none; text-indent: 0px; letter-spacing: normal=
; font-family: Arial, Helvetica, sans-serif; font-size: small; font-style: =
normal; font-weight: 400; word-spacing: 0px; white-space: normal; orphans: =
2; widows: 2; font-variant-ligatures: normal; font-variant-caps: normal; -w=
ebkit-text-stroke-width: 0px; text-decoration-thickness: initial; text-deco=
ration-style: initial; text-decoration-color:=20
initial;">Appointment Coord=
inator
34, 34, 34); text-transform: none; text-indent: 0px; letter-spacing: normal=
; font-family: Arial, Helvetica, sans-serif; font-size: small; font-style: =
normal; font-weight: 400; word-spacing: 0px; white-space: normal; orphans: =
2; widows: 2; font-variant-ligatures: normal; font-variant-caps: normal; -w=
ebkit-text-stroke-width: 0px; text-decoration-thickness: initial; text-deco=
ration-style: initial; text-decoration-color:=20
initial;">
t-family: Cambria, serif; font-size: 14pt;">
34, 34, 34); text-transform: none; text-indent: 0px; letter-spacing: normal=
; font-family: Arial, Helvetica, sans-serif; font-size: small; font-style: =
normal; font-weight: 400; word-spacing: 0px; white-space: normal; orphans: =
2; widows: 2; font-variant-ligatures: normal; font-variant-caps: normal; -w=
ebkit-text-stroke-width: 0px; text-decoration-thickness: initial; text-deco=
ration-style: initial; text-decoration-color:=20
initial;">GO KIA SOUTH

=3D"cid:unnamed.png" border=3D"0" hspace=3D"0" width=3D"355" height=3D"35">=
34, 34, 34); text-transform: none; text-indent: 0px; letter-spacing: normal=
; font-family: Arial, Helvetica, sans-serif; font-size: small; font-style: =
normal; font-weight: 400; word-spacing: 0px; white-space: normal; orphans: =
2; widows: 2; font-variant-ligatures: normal; font-variant-caps: normal; -w=
ebkit-text-stroke-width: 0px; text-decoration-thickness: initial; text-deco=
ration-style: initial; text-decoration-color:=20
initial;">3030 GA=
TEWAY BLVD | Edmonton, AB | T6J 6V4=
34, 34, 34); text-transform: none; text-indent: 0px; letter-spacing: normal=
; font-family: Arial, Helvetica, sans-serif; font-size: small; font-style: =
normal; font-weight: 400; word-spacing: 0px; white-space: normal; orphans: =
2; widows: 2; font-variant-ligatures: normal; font-variant-caps: normal; -w=
ebkit-text-stroke-width: 0px; text-decoration-thickness: initial; text-deco=
ration-style: initial; text-decoration-color:=20
initial;">Phone:&=
nbsp;780.465.3535 Ext. 37412
34, 34, 34); text-transform: none; text-indent: 0px; letter-spacing: normal=
; font-family: Arial, Helvetica, sans-serif; font-size: small; font-style: =
normal; font-weight: 400; word-spacing: 0px; white-space: normal; orphans: =
2; widows: 2; font-variant-ligatures: normal; font-variant-caps: normal; -w=
ebkit-text-stroke-width: 0px; text-decoration-thickness: initial; text-deco=
ration-style: initial; text-decoration-color:=20
initial;">
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Mon, 13 Jul 2026 16:11:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))
(envelope-from
id 1wjOrM-00000000MHG-2b1j
for dave@doctor.nl2k.ab.ca;
Mon, 13 Jul 2026 16:10:44 -0600
Resent-From: The Doctor
Resent-Date: Mon, 13 Jul 2026 16:10:44 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-m4785125127.xmail.ntesmail.com ([47.85.125.127]:14314)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384
(Exim 4.99.3 (FreeBSD))
(envelope-from
id 1wjKyn-000000006un-2h05
for sales@nk.ca;
Mon, 13 Jul 2026 12:02:23 -0600
Content-Type: multipart/alternative; BOUNDARY="=_Part_33398_294669893.1783965670429"
To: sales
Reply-To: huangyi@nmtbiotech.com
Subject: =?UTF-8?B?SW5xdWlyeSBSZWdhcmRpbmcgTmF0dXJhbCBBS0cgUHJvZHVjdHM=?=
X-Priority: 3
MIME-Version: 1.0
Received: from td@nmtbiotech.com( [10.139.0.42] ) by ajax-webmail ( [127.0.0.1] ) ; Tue, 14 Jul 2026 02:01:10 +0800 (GMT+08:00)
From: Vivian
Date: Tue, 14 Jul 2026 02:01:10 +0800 (GMT+08:00)
X-WM-Tid: 0a9f5ca3dc15d068kusy9fb0e49ca444
DKIM-Signature: a=rsa-sha256;
b=KaHqUrMo0573ApTbLUxZLQ+Ha4B0rM9kthWo3jiyrpxTTW3WVFVcYkdoCPpvbqscVokDfZEcWL5q7DR1rHffc7HV4nMqxT8+IUFyd9Sfa2FjwcBEnpIKzA0naTtRp70P6OD641oaKxCp5F9kDBzVq+6nEWw7S9t8VxWH5NWpJws=; s=default; c=relaxed/relaxed; d=nmtbiotech.com; v=1;
bh=m+KKC6f+ZRQ7Xc5fVBb+RulLdf8dCzi25dMdH1qrljA=;
h=date:mime-version:subject:message-id:from;
Message-ID:
Greetings Sales,
I hope this message finds you well. This is Adam from NMT Biotech.
NMT Biotech is a multinational company based in Hong Kong, specializing in a global biochemicals business. We leverage an extensive production supply chain in mainland China alongside cutting-edge biotechnology from the United States, Japan, and Europe. This enables us to produce high-quality pharmaceutical ingredients, food supplement ingredients, cosmetic ingredients, flavor and fragrance ingredients, feed additives, and fertilizer additives that meet diverse industry standards worldwide. We have established or are in the process of establishing processing plants and warehouses in the United States, Europe, Japan, and other regions to facilitate global distribution.
I would like to explore opportunities to collaborate with you regarding our Natural (Alpha Ketoglutaric Acid / AKG) series products. I look forward to hearing from you soon.
For further details about our company, kindly explore our website: www.nmtbiotech.net. Linkedin Thank you for your attention.
Best regards,
Vivian
NMT Biotech
Email: sales@nmtbiotech.com
WhatsApp: 8615806215916
Web/SEO/APp spam from Microsoft OutLook Part 2
Posted by Dave Yadallee on--_000_TYSPR02MB77610E1A7597F6EACCD694F5ABFA2TYSPR02MB7761apcp_
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
1">
Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Hi,
nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=
olor: rgb(0, 0, 0);">
nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=
olor: rgb(0, 0, 0);">
I found that your website isn't doing well and has customers in Google sear=
ch results.
nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=
olor: rgb(0, 0, 0);">
nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=
olor: rgb(0, 0, 0);">
We can place your website on Google's first page.
nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=
olor: rgb(0, 0, 0);">
nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=
olor: rgb(0, 0, 0);">
May I send an SEO proposal and price?
nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=
olor: rgb(0, 0, 0);">
Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Thank you.
--_000_TYSPR02MB77610E1A7597F6EACCD694F5ABFA2TYSPR02MB7761apcp_--
Web/SEO/APp spam from Microsoft OutLook Part 1
Posted by Dave Yadallee on
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Mon, 13 Jul 2026 16:11:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))
(envelope-from)
id 1wjOrC-00000000MH2-14r9
for dave@doctor.nl2k.ab.ca;
Mon, 13 Jul 2026 16:10:34 -0600
Resent-From: The Doctor
Resent-Date: Mon, 13 Jul 2026 16:10:34 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from [52.103.74.84] (port=9274 helo=SEYPR02CU001.outbound.protection.outlook.com)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384
(Exim 4.99.3 (FreeBSD))
(envelope-from)
id 1wjKvw-000000006a1-1P5t
for sales@nk.ca;
Mon, 13 Jul 2026 11:59:22 -0600
ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;
b=HSCj/a31gC/taqQzZwAoMExumYgquRbP05JiO3sqkpUnnIiAOz3VRfFSAcnu5hE+C76TjD0+7hfSC6xEtZVTqxBbU2FcZ3pfl1FLE8jOpbIWPD74xQxwuqROW4MCQ4Ew6+X7ONP7bwb0+4aU2Bxpw2P4ovtWUOX4T55B8Dt5pQjOmegDYI+G8zqkwUCvwKavRMaA5HJR4JOigiuGNIn0PQfGBI7PpICKHVnmwCCZnto0YfmsHiNc2E4SrlSmojhw2EI/gELmvsIUPd+xdYmKC+R1ketXvjgfDCFiCL1L/mrTAtcHm5IUJ2TnjccFG8tyFhHteeaDU1MjQ6YZnoKmjg==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
s=arcselector10001;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;
bh=8kPAvS45uhuAToe0v36tHMvfPY5YlDL6d2Es4JBA3Bo=;
b=RqDB7TkpmVxP8l1Htr+x19LJSYlp+cNNKhI1b3k8pYA51OmOCe9hulPHP0GwkL7cI8z+6FmtbIQFhNhrccGuA4ovaNrsK3K23IEXqJd/nY3kBvFjk6/0uMn51QHzNo2npQIBABxnYZk05i//gZbEED7XfWCRfPjqPoxgZgGto19snqJL8zBTwA/XPyjSUWeat6RhK4P59ee4MU7oenO8JZiJa0RaAJFyyehNO3l1tCI0Mi1XRTEWrmPNXY46qQ+BJt/OK3mK4ldmCl8eXrbWpaJn5awDTHHErKWlQEs4PR/aijsihEzILIpluMbKHM+WIeShAHf3Vwb8r9hOMplpsg==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;
dkim=none; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;
s=selector1;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
bh=8kPAvS45uhuAToe0v36tHMvfPY5YlDL6d2Es4JBA3Bo=;
b=cxx5I4lp6DNuVHlyc+Pd+qokhmeh+AXTVtcM2WQVu1wC0ZkKlTJNWCJJf79d2ajsUXhiNjhzxmjcozetCcNbdxVsGXMhjl1tZ0cB0b0U0njPE5YksW4T44Z8C1gCq8PC1Zxmt+zbCebHHaFW3SudoiISsJhYsTJe0jgSoD+ss5jRwEME7uz58hFZME0gK4681fJHi0yW4CwTTUP93e1AUc0Elf1KliUU/OnJoN0LMPpAOytEBKJDACxUJ2cx8RzFFO+K6E5ayVoBBMpKdYna2PRinz3KQFdoOoFlFt9kzTaMX67VLplVdZ/j+fZFl+o9HYb3iNL5KR/KlcNyhn2WJA==
Received: from TYSPR02MB7761.apcprd02.prod.outlook.com (2603:1096:405:50::12)
by SI1PPF9002B6152.apcprd02.prod.outlook.com (2603:1096:f:fff6::75c) with
Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.181.13; Mon, 13 Jul
2026 17:57:33 +0000
Received: from TYSPR02MB7761.apcprd02.prod.outlook.com
([fe80::4a27:7eec:7dca:f1ba]) by TYSPR02MB7761.apcprd02.prod.outlook.com
([fe80::4a27:7eec:7dca:f1ba%4]) with mapi id 15.21.0202.018; Mon, 13 Jul 2026
17:57:33 +0000
From: Steven Hessil
To: Steven Hessil
Subject: Cost?
Thread-Topic: Cost?
Thread-Index: AQHdEvC0x6qh7XH5VEi6shICtdQW1A==
Date: Mon, 13 Jul 2026 17:57:32 +0000
Message-ID:
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
msip_labels:
x-ms-publictraffictype: Email
x-ms-traffictypediagnostic: TYSPR02MB7761:EE_|SI1PPF9002B6152:EE_
x-ms-office365-filtering-correlation-id: 4fd68bc4-a4d0-4cd9-1b84-08dee1083690
x-ms-exchange-slblob-mailprops:
2xtDbzDEsjLHy/zW1UT+TKXSYW1I/uQ3aKA0teSJVdVq9OJY7fc/iZc5eD7ReffjiI7Q384IFFeLEDOJncIWJW5IvTclq/SHhfr9cXSCrNcqaqo5O/lMbhFsYidPa1Ax2agVaVrv2op2mnu/FBIsOY2YJNnqp7pNQcy6BTQ2jBRAWQh6IUI/nsFqmf2LmPDDm2b2gAGekQHpwQ+02COfhSGYvEf/UoORAzj1CwwnMsvgU3j5i2BivfyagxrrCpoofns0V4BanwYVvg1QG8iLjSeakrM0LISjkyS1nftuv/+VxU+wPkkZN7GH2a30H3ZsLGmyGuy6nhIf06wNrvK58HMRH+9XexTcZ/C76nRQbgbdRfPa2MMmTm2rqRAsBlPlDfpnrgzLQQDZBBTyzUqP1I+r3ZrNeSE46aCqzXlgmQAuE5v+7uMxf98GZbUUszvldQZpx9CVSG+OWFsBedemzSYqFXELMS+mpvsUWhCq0MR6htcHQu8s5fpOjLuKVKhqZsgZnDYMSdDtUYthtVbVeBLqoPu5DWFSgYLg9+YtLG58lMsTF9lN2mEvrFHpxDtqG2E0pGe1FXFjNQJBr2909g==
x-microsoft-antispam:
BCL:0;ARA:14566002|16051099003|704163111799003|2604032031799003|25010399006|4140399003|31061999003|37011999003|22091999003|39105399006|15030799006|15080799012|24121999003|19101099003|55001999006|8062599012|19110799012|8060799015|3412199025|440099028|102099032|41105399003|40105399003|39145399003|11120399003|18071099003|26121999007|1710799026;
x-microsoft-antispam-message-info:
=?iso-8859-1?Q?evEUxsR9Kc44/XCvTrpF3697BCUctZbkKkkB0EQSiZ2a0Z922SHDER6/JE?=
=?iso-8859-1?Q?Bk1C36gJ2TDdrrXKAdcC89cwciwrNVrfyFNIp0F2fTPTOZTPcLZM+Rs+rg?=
=?iso-8859-1?Q?BFMzbkJZE5CQJLl/k0BgpPC5jDEgB91RRev+4cBRrd/XLA69Wtqf+E5RIJ?=
=?iso-8859-1?Q?1X8HZTD6mHRT6cSG+qOSI1Bil4iB77DrujCrxr6dHt0fJ9Z/uCwsk1xKr9?=
=?iso-8859-1?Q?DMiOcDmkY+NUzqOsrrxXiyZmWpfK5BV/Aki04MFZWV5Sp9xS+0/8HZhOxo?=
=?iso-8859-1?Q?keabY9HY0Y3fpndkcD1HmrRUE75r3PmloeFXHKpW5+BJXhruVeEZqffz4L?=
=?iso-8859-1?Q?SBiRKJaZKnVBAO6Vt4IWhUl98vYslb8Yperppl76CrGh6mFJBIlT3m57g1?=
=?iso-8859-1?Q?OrwiSSmIdUgTL0VWRtsxih2AwocL8Ysp+iUgpnLZHRJj2LrhVc3s2b8Lqf?=
=?iso-8859-1?Q?RBsntUvkBO3BaFzxIeqJPAg1/vBqKkRseamrY3n+JfTjh4jBfzcseS/ZXh?=
=?iso-8859-1?Q?NQVGPJwGlcJThDUF27TF583Znze5cSM5cc/gWoYSjFNfBXLM4MtYbtGK/D?=
=?iso-8859-1?Q?fSTvqFvnH15qpHQlAoD83f47iXvSN2F4TjrDlxUYuK2DJYnmF+AnaJaiGU?=
=?iso-8859-1?Q?fkya6lHa0y9MGhPxWSPd+FkrJMymB+zSlj2VdDvlSgJfPFzaQtPkPjMjRp?=
=?iso-8859-1?Q?Gjazrpivv6s3/KM3Pt/2UaYKZ4FvdRPPzbr/6lTRQ7us6Pjw0Yr4SdyAqb?=
=?iso-8859-1?Q?3XCEJU+W/l2OPfRUMIv1XFOuHuSGLgDcizf0kaoo2J5LvWli63NH9mb6oL?=
=?iso-8859-1?Q?4FaqITW7S91h5ORQBhoy4NXbishUBE5j/+Znt0fzry5SNLoPmgjrD8/tjm?=
=?iso-8859-1?Q?kliIYDbPZ+TSeSWHHNajbBMjKb2VnU7XOsicdiP73NeyabLV8k0gmK96B8?=
=?iso-8859-1?Q?jsL0+3omxyMq4THXvLjPA5U/s2AFsV3LxpxKPJ2wYKcFrUspHClfPEq7LZ?=
=?iso-8859-1?Q?swMYU3i2Dg8U4Lz17R2JdiD4S1dl8WDfPB/zvSZgHOGTN9suLuf4YHRWBx?=
=?iso-8859-1?Q?OCHJU8EI4D6377TYqGiUEv+Zj+Ds641taac9SCmHz3PxCIV9p7ombPsIaQ?=
=?iso-8859-1?Q?xI+6WM2l/NbSK+tZQGlD1Z5XUDFgyPjY//YA8ZHngKCYWcDtGBEOP5N7ZX?=
=?iso-8859-1?Q?PSUwcQu6I0SqrTrrodlnAOZkfrM3rHz08HQ1swjhkachX/wq6LpBEx+ZdO?=
=?iso-8859-1?Q?J0py70pngJg9UZPocVMfhIZgRObnLtCJqIR2uUA8YxzGT+tnVBCTzk2Q0B?=
=?iso-8859-1?Q?RPrnk+wLeJ/SzUq1QCbBkWLLuA5BTQz3VMghb8UEVuuxUlDYMnlapXEBWw?=
=?iso-8859-1?Q?x4r9erfgUMxnm+a/4fcUm9IdWQxxNVH9NWuo0fp1o9JCOiYsq7s+8=3D?=
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0:
=?iso-8859-1?Q?0Zb6qc+2yF95MAQxxQwj5HVWCKqC/4Eyc28NdoFQhy5z2UPUAOs8nfj0DT?=
=?iso-8859-1?Q?deuD5bqIb9Jjc3t/WNjaQ4JUB3ZS+8eA1ACTIXkl3FYMmRl2ZkaHno0xBz?=
=?iso-8859-1?Q?tglnWRJwEZ51XjxhuN8/pclqNK0xr/YlxA/iiFk8PcOLTojijBKSTQzJBY?=
=?iso-8859-1?Q?EyMFav9HrHdp5hrwhEiJ437BdhemHberu3umvqh+mMSR8TbylTi6kHQULO?=
=?iso-8859-1?Q?GaQyOQVtqnL+zFdJ2mTYgPKoRZ43c3yj3pQtNwiO0syfVnZg7bJpG6aDDn?=
=?iso-8859-1?Q?AXKIkW3XcHMOJe9QsH0wJ0zaO6pvUivGkODBQimr4vUTObNUAYfnp+aU3O?=
=?iso-8859-1?Q?VH0WGvvYpW/KrFrTj+PouvAPTW0gJVBR8Wh5cJncMQ0qVTxwSSQwRNJPyw?=
=?iso-8859-1?Q?cpw9sFEDGKZNTCKF5P0kBm24KnGYDfYRIVPV5NJdFmbhvcv4RJmYxLQ2V0?=
=?iso-8859-1?Q?Dc8hjIgS2a7VqJJoB4MH70iaOxA579sV4j8fLDBFgNBWv5YByscNl5/mS0?=
=?iso-8859-1?Q?0N7T2L1RJYWd7G+3A/4+UNgDn9HYzrzsN6ekcWqb23bh5R9G96MYCmLmVT?=
=?iso-8859-1?Q?X6ZPwC2xESiIMkhO/8esBdbmfYTMBKze5zh3V+44E375vR+ankQXrFFyP6?=
=?iso-8859-1?Q?nM4KNesamI9uOvRTEnRXEmiUIVB4Lbd52C9c7fN03vkwC23z74pPcNw0Sz?=
=?iso-8859-1?Q?W3pc8jHsm3xq1w9sPDU4HbPbKsv59ZpCOlt2wCJBf9mPRWqBCBsNaSmrs+?=
=?iso-8859-1?Q?wSSlVtLwytc2KPMsIS93tESpxRtfqKhvehK1xDSdFYyyLCdOlyPnzCMJbG?=
=?iso-8859-1?Q?7JXH524LpvAo4VABe3gEpMO/dcXKQbSM8tIhJDycwmpv1db0YueGW1mfFu?=
=?iso-8859-1?Q?0Q+FLaGATobAdlqAFjQzbm17CeVF0SzLmsLFeNP5hUpNAOUO4Djat5+Y8I?=
=?iso-8859-1?Q?r+ArGObigspKMB/pL0aBXsPkPsCg9adg9fRYxYP/SRTzuN0oRbAiGtJsPq?=
=?iso-8859-1?Q?pZO8sXyFcRgnfjAYStZA+TAVKVP4dwitY8oPlW2xI+l4tN8WhthhHeUjew?=
=?iso-8859-1?Q?Qbvh3EMO/rn5ehJGI598fKW8w622GpIO8G1pnQbMAdzsP99LicnS2D8bHa?=
=?iso-8859-1?Q?CPm9DtrLnm9XeD5Xm5cpXbkGwAweJm0Lj5JFV8BHFdImYvQ7jjTW9LPL/Y?=
=?iso-8859-1?Q?FY7EvtbfqF9hhyQ1xKEg4oRkYpnP+zZdTzyNObvacxlFAWQHstLFz2dceI?=
=?iso-8859-1?Q?qVKF9VFwJSFU1U58DjQvJylWlwC5ho8P1jvqoYlkIckgQsGuUFFwj33Jrh?=
=?iso-8859-1?Q?BccRPZ1xU7un73ytTA9D8CS2ZkGeKLLXyyMlWBVI8KFnank+zN0OTyZjdZ?=
=?iso-8859-1?Q?MJqtC90db3x5sIDGMqr8BSEeDefOlzGIxeewrRnvGUDNHKbfaKutPwbZxk?=
=?iso-8859-1?Q?vt+CQKp+ZkfZajiJ5M8myLTT0ozy9YsKORBbdChrP8u7cr2bC9uDny3dRa?=
=?iso-8859-1?Q?g=3D?=
Content-Type: multipart/alternative;
boundary="_000_TYSPR02MB77610E1A7597F6EACCD694F5ABFA2TYSPR02MB7761apcp_"
MIME-Version: 1.0
X-OriginatorOrg: outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: TYSPR02MB7761.apcprd02.prod.outlook.com
X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000
X-MS-Exchange-CrossTenant-Network-Message-Id: 4fd68bc4-a4d0-4cd9-1b84-08dee1083690
X-MS-Exchange-CrossTenant-originalarrivaltime: 13 Jul 2026 17:57:32.3568
(UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa
X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SI1PPF9002B6152
--_000_TYSPR02MB77610E1A7597F6EACCD694F5ABFA2TYSPR02MB7761apcp_
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Hi,
I found that your website isn't doing well and has customers in Google sear=
ch results.
We can place your website on Google's first page.
May I send an SEO proposal and price?
Thank you.
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Mon, 13 Jul 2026 16:11:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))
(envelope-from
id 1wjOrC-00000000MH2-14r9
for dave@doctor.nl2k.ab.ca;
Mon, 13 Jul 2026 16:10:34 -0600
Resent-From: The Doctor
Resent-Date: Mon, 13 Jul 2026 16:10:34 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from [52.103.74.84] (port=9274 helo=SEYPR02CU001.outbound.protection.outlook.com)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384
(Exim 4.99.3 (FreeBSD))
(envelope-from
id 1wjKvw-000000006a1-1P5t
for sales@nk.ca;
Mon, 13 Jul 2026 11:59:22 -0600
ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;
b=HSCj/a31gC/taqQzZwAoMExumYgquRbP05JiO3sqkpUnnIiAOz3VRfFSAcnu5hE+C76TjD0+7hfSC6xEtZVTqxBbU2FcZ3pfl1FLE8jOpbIWPD74xQxwuqROW4MCQ4Ew6+X7ONP7bwb0+4aU2Bxpw2P4ovtWUOX4T55B8Dt5pQjOmegDYI+G8zqkwUCvwKavRMaA5HJR4JOigiuGNIn0PQfGBI7PpICKHVnmwCCZnto0YfmsHiNc2E4SrlSmojhw2EI/gELmvsIUPd+xdYmKC+R1ketXvjgfDCFiCL1L/mrTAtcHm5IUJ2TnjccFG8tyFhHteeaDU1MjQ6YZnoKmjg==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
s=arcselector10001;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;
bh=8kPAvS45uhuAToe0v36tHMvfPY5YlDL6d2Es4JBA3Bo=;
b=RqDB7TkpmVxP8l1Htr+x19LJSYlp+cNNKhI1b3k8pYA51OmOCe9hulPHP0GwkL7cI8z+6FmtbIQFhNhrccGuA4ovaNrsK3K23IEXqJd/nY3kBvFjk6/0uMn51QHzNo2npQIBABxnYZk05i//gZbEED7XfWCRfPjqPoxgZgGto19snqJL8zBTwA/XPyjSUWeat6RhK4P59ee4MU7oenO8JZiJa0RaAJFyyehNO3l1tCI0Mi1XRTEWrmPNXY46qQ+BJt/OK3mK4ldmCl8eXrbWpaJn5awDTHHErKWlQEs4PR/aijsihEzILIpluMbKHM+WIeShAHf3Vwb8r9hOMplpsg==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;
dkim=none; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;
s=selector1;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
bh=8kPAvS45uhuAToe0v36tHMvfPY5YlDL6d2Es4JBA3Bo=;
b=cxx5I4lp6DNuVHlyc+Pd+qokhmeh+AXTVtcM2WQVu1wC0ZkKlTJNWCJJf79d2ajsUXhiNjhzxmjcozetCcNbdxVsGXMhjl1tZ0cB0b0U0njPE5YksW4T44Z8C1gCq8PC1Zxmt+zbCebHHaFW3SudoiISsJhYsTJe0jgSoD+ss5jRwEME7uz58hFZME0gK4681fJHi0yW4CwTTUP93e1AUc0Elf1KliUU/OnJoN0LMPpAOytEBKJDACxUJ2cx8RzFFO+K6E5ayVoBBMpKdYna2PRinz3KQFdoOoFlFt9kzTaMX67VLplVdZ/j+fZFl+o9HYb3iNL5KR/KlcNyhn2WJA==
Received: from TYSPR02MB7761.apcprd02.prod.outlook.com (2603:1096:405:50::12)
by SI1PPF9002B6152.apcprd02.prod.outlook.com (2603:1096:f:fff6::75c) with
Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.181.13; Mon, 13 Jul
2026 17:57:33 +0000
Received: from TYSPR02MB7761.apcprd02.prod.outlook.com
([fe80::4a27:7eec:7dca:f1ba]) by TYSPR02MB7761.apcprd02.prod.outlook.com
([fe80::4a27:7eec:7dca:f1ba%4]) with mapi id 15.21.0202.018; Mon, 13 Jul 2026
17:57:33 +0000
From: Steven Hessil
To: Steven Hessil
Subject: Cost?
Thread-Topic: Cost?
Thread-Index: AQHdEvC0x6qh7XH5VEi6shICtdQW1A==
Date: Mon, 13 Jul 2026 17:57:32 +0000
Message-ID:
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
msip_labels:
x-ms-publictraffictype: Email
x-ms-traffictypediagnostic: TYSPR02MB7761:EE_|SI1PPF9002B6152:EE_
x-ms-office365-filtering-correlation-id: 4fd68bc4-a4d0-4cd9-1b84-08dee1083690
x-ms-exchange-slblob-mailprops:
2xtDbzDEsjLHy/zW1UT+TKXSYW1I/uQ3aKA0teSJVdVq9OJY7fc/iZc5eD7ReffjiI7Q384IFFeLEDOJncIWJW5IvTclq/SHhfr9cXSCrNcqaqo5O/lMbhFsYidPa1Ax2agVaVrv2op2mnu/FBIsOY2YJNnqp7pNQcy6BTQ2jBRAWQh6IUI/nsFqmf2LmPDDm2b2gAGekQHpwQ+02COfhSGYvEf/UoORAzj1CwwnMsvgU3j5i2BivfyagxrrCpoofns0V4BanwYVvg1QG8iLjSeakrM0LISjkyS1nftuv/+VxU+wPkkZN7GH2a30H3ZsLGmyGuy6nhIf06wNrvK58HMRH+9XexTcZ/C76nRQbgbdRfPa2MMmTm2rqRAsBlPlDfpnrgzLQQDZBBTyzUqP1I+r3ZrNeSE46aCqzXlgmQAuE5v+7uMxf98GZbUUszvldQZpx9CVSG+OWFsBedemzSYqFXELMS+mpvsUWhCq0MR6htcHQu8s5fpOjLuKVKhqZsgZnDYMSdDtUYthtVbVeBLqoPu5DWFSgYLg9+YtLG58lMsTF9lN2mEvrFHpxDtqG2E0pGe1FXFjNQJBr2909g==
x-microsoft-antispam:
BCL:0;ARA:14566002|16051099003|704163111799003|2604032031799003|25010399006|4140399003|31061999003|37011999003|22091999003|39105399006|15030799006|15080799012|24121999003|19101099003|55001999006|8062599012|19110799012|8060799015|3412199025|440099028|102099032|41105399003|40105399003|39145399003|11120399003|18071099003|26121999007|1710799026;
x-microsoft-antispam-message-info:
=?iso-8859-1?Q?evEUxsR9Kc44/XCvTrpF3697BCUctZbkKkkB0EQSiZ2a0Z922SHDER6/JE?=
=?iso-8859-1?Q?Bk1C36gJ2TDdrrXKAdcC89cwciwrNVrfyFNIp0F2fTPTOZTPcLZM+Rs+rg?=
=?iso-8859-1?Q?BFMzbkJZE5CQJLl/k0BgpPC5jDEgB91RRev+4cBRrd/XLA69Wtqf+E5RIJ?=
=?iso-8859-1?Q?1X8HZTD6mHRT6cSG+qOSI1Bil4iB77DrujCrxr6dHt0fJ9Z/uCwsk1xKr9?=
=?iso-8859-1?Q?DMiOcDmkY+NUzqOsrrxXiyZmWpfK5BV/Aki04MFZWV5Sp9xS+0/8HZhOxo?=
=?iso-8859-1?Q?keabY9HY0Y3fpndkcD1HmrRUE75r3PmloeFXHKpW5+BJXhruVeEZqffz4L?=
=?iso-8859-1?Q?SBiRKJaZKnVBAO6Vt4IWhUl98vYslb8Yperppl76CrGh6mFJBIlT3m57g1?=
=?iso-8859-1?Q?OrwiSSmIdUgTL0VWRtsxih2AwocL8Ysp+iUgpnLZHRJj2LrhVc3s2b8Lqf?=
=?iso-8859-1?Q?RBsntUvkBO3BaFzxIeqJPAg1/vBqKkRseamrY3n+JfTjh4jBfzcseS/ZXh?=
=?iso-8859-1?Q?NQVGPJwGlcJThDUF27TF583Znze5cSM5cc/gWoYSjFNfBXLM4MtYbtGK/D?=
=?iso-8859-1?Q?fSTvqFvnH15qpHQlAoD83f47iXvSN2F4TjrDlxUYuK2DJYnmF+AnaJaiGU?=
=?iso-8859-1?Q?fkya6lHa0y9MGhPxWSPd+FkrJMymB+zSlj2VdDvlSgJfPFzaQtPkPjMjRp?=
=?iso-8859-1?Q?Gjazrpivv6s3/KM3Pt/2UaYKZ4FvdRPPzbr/6lTRQ7us6Pjw0Yr4SdyAqb?=
=?iso-8859-1?Q?3XCEJU+W/l2OPfRUMIv1XFOuHuSGLgDcizf0kaoo2J5LvWli63NH9mb6oL?=
=?iso-8859-1?Q?4FaqITW7S91h5ORQBhoy4NXbishUBE5j/+Znt0fzry5SNLoPmgjrD8/tjm?=
=?iso-8859-1?Q?kliIYDbPZ+TSeSWHHNajbBMjKb2VnU7XOsicdiP73NeyabLV8k0gmK96B8?=
=?iso-8859-1?Q?jsL0+3omxyMq4THXvLjPA5U/s2AFsV3LxpxKPJ2wYKcFrUspHClfPEq7LZ?=
=?iso-8859-1?Q?swMYU3i2Dg8U4Lz17R2JdiD4S1dl8WDfPB/zvSZgHOGTN9suLuf4YHRWBx?=
=?iso-8859-1?Q?OCHJU8EI4D6377TYqGiUEv+Zj+Ds641taac9SCmHz3PxCIV9p7ombPsIaQ?=
=?iso-8859-1?Q?xI+6WM2l/NbSK+tZQGlD1Z5XUDFgyPjY//YA8ZHngKCYWcDtGBEOP5N7ZX?=
=?iso-8859-1?Q?PSUwcQu6I0SqrTrrodlnAOZkfrM3rHz08HQ1swjhkachX/wq6LpBEx+ZdO?=
=?iso-8859-1?Q?J0py70pngJg9UZPocVMfhIZgRObnLtCJqIR2uUA8YxzGT+tnVBCTzk2Q0B?=
=?iso-8859-1?Q?RPrnk+wLeJ/SzUq1QCbBkWLLuA5BTQz3VMghb8UEVuuxUlDYMnlapXEBWw?=
=?iso-8859-1?Q?x4r9erfgUMxnm+a/4fcUm9IdWQxxNVH9NWuo0fp1o9JCOiYsq7s+8=3D?=
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0:
=?iso-8859-1?Q?0Zb6qc+2yF95MAQxxQwj5HVWCKqC/4Eyc28NdoFQhy5z2UPUAOs8nfj0DT?=
=?iso-8859-1?Q?deuD5bqIb9Jjc3t/WNjaQ4JUB3ZS+8eA1ACTIXkl3FYMmRl2ZkaHno0xBz?=
=?iso-8859-1?Q?tglnWRJwEZ51XjxhuN8/pclqNK0xr/YlxA/iiFk8PcOLTojijBKSTQzJBY?=
=?iso-8859-1?Q?EyMFav9HrHdp5hrwhEiJ437BdhemHberu3umvqh+mMSR8TbylTi6kHQULO?=
=?iso-8859-1?Q?GaQyOQVtqnL+zFdJ2mTYgPKoRZ43c3yj3pQtNwiO0syfVnZg7bJpG6aDDn?=
=?iso-8859-1?Q?AXKIkW3XcHMOJe9QsH0wJ0zaO6pvUivGkODBQimr4vUTObNUAYfnp+aU3O?=
=?iso-8859-1?Q?VH0WGvvYpW/KrFrTj+PouvAPTW0gJVBR8Wh5cJncMQ0qVTxwSSQwRNJPyw?=
=?iso-8859-1?Q?cpw9sFEDGKZNTCKF5P0kBm24KnGYDfYRIVPV5NJdFmbhvcv4RJmYxLQ2V0?=
=?iso-8859-1?Q?Dc8hjIgS2a7VqJJoB4MH70iaOxA579sV4j8fLDBFgNBWv5YByscNl5/mS0?=
=?iso-8859-1?Q?0N7T2L1RJYWd7G+3A/4+UNgDn9HYzrzsN6ekcWqb23bh5R9G96MYCmLmVT?=
=?iso-8859-1?Q?X6ZPwC2xESiIMkhO/8esBdbmfYTMBKze5zh3V+44E375vR+ankQXrFFyP6?=
=?iso-8859-1?Q?nM4KNesamI9uOvRTEnRXEmiUIVB4Lbd52C9c7fN03vkwC23z74pPcNw0Sz?=
=?iso-8859-1?Q?W3pc8jHsm3xq1w9sPDU4HbPbKsv59ZpCOlt2wCJBf9mPRWqBCBsNaSmrs+?=
=?iso-8859-1?Q?wSSlVtLwytc2KPMsIS93tESpxRtfqKhvehK1xDSdFYyyLCdOlyPnzCMJbG?=
=?iso-8859-1?Q?7JXH524LpvAo4VABe3gEpMO/dcXKQbSM8tIhJDycwmpv1db0YueGW1mfFu?=
=?iso-8859-1?Q?0Q+FLaGATobAdlqAFjQzbm17CeVF0SzLmsLFeNP5hUpNAOUO4Djat5+Y8I?=
=?iso-8859-1?Q?r+ArGObigspKMB/pL0aBXsPkPsCg9adg9fRYxYP/SRTzuN0oRbAiGtJsPq?=
=?iso-8859-1?Q?pZO8sXyFcRgnfjAYStZA+TAVKVP4dwitY8oPlW2xI+l4tN8WhthhHeUjew?=
=?iso-8859-1?Q?Qbvh3EMO/rn5ehJGI598fKW8w622GpIO8G1pnQbMAdzsP99LicnS2D8bHa?=
=?iso-8859-1?Q?CPm9DtrLnm9XeD5Xm5cpXbkGwAweJm0Lj5JFV8BHFdImYvQ7jjTW9LPL/Y?=
=?iso-8859-1?Q?FY7EvtbfqF9hhyQ1xKEg4oRkYpnP+zZdTzyNObvacxlFAWQHstLFz2dceI?=
=?iso-8859-1?Q?qVKF9VFwJSFU1U58DjQvJylWlwC5ho8P1jvqoYlkIckgQsGuUFFwj33Jrh?=
=?iso-8859-1?Q?BccRPZ1xU7un73ytTA9D8CS2ZkGeKLLXyyMlWBVI8KFnank+zN0OTyZjdZ?=
=?iso-8859-1?Q?MJqtC90db3x5sIDGMqr8BSEeDefOlzGIxeewrRnvGUDNHKbfaKutPwbZxk?=
=?iso-8859-1?Q?vt+CQKp+ZkfZajiJ5M8myLTT0ozy9YsKORBbdChrP8u7cr2bC9uDny3dRa?=
=?iso-8859-1?Q?g=3D?=
Content-Type: multipart/alternative;
boundary="_000_TYSPR02MB77610E1A7597F6EACCD694F5ABFA2TYSPR02MB7761apcp_"
MIME-Version: 1.0
X-OriginatorOrg: outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: TYSPR02MB7761.apcprd02.prod.outlook.com
X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000
X-MS-Exchange-CrossTenant-Network-Message-Id: 4fd68bc4-a4d0-4cd9-1b84-08dee1083690
X-MS-Exchange-CrossTenant-originalarrivaltime: 13 Jul 2026 17:57:32.3568
(UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa
X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SI1PPF9002B6152
--_000_TYSPR02MB77610E1A7597F6EACCD694F5ABFA2TYSPR02MB7761apcp_
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Hi,
I found that your website isn't doing well and has customers in Google sear=
ch results.
We can place your website on Google's first page.
May I send an SEO proposal and price?
Thank you.
Dell Laptop paypal phish from Microsoft Outlook Part 4
Posted by Dave Yadallee onHaresasz Nxysarwsa has invited you to Urgent: Your PayPal Order Confirmation - Invoice #INV-9942-XPS processed successfully
Title: Urgent: Your PayPal Order Confirmation - Invoice #INV-9942-XPS processed successfully
When: July 13, 2026
Organizer:
Haresasz Nxysarwsa
Description: Dear Valued Customer,
Thank you for your recent order with PayPal. We are pleased to confirm that your order has been processed successfully and that your payment has been authorized.
We appreciate your business and look forward to serving you.
The authorized payment will be reflected in your account activity shortly.
For any inquiries, please contact us at +1 805 302 5662.
Invoice Details:
Invoice ID: INV-9942-XPS
Product: Dell XPS 13 Laptop
Order Date: Jul 13, 2026
Amount Due: $749.00 USD
Payment Method: Authorized PayPal Auto-Debit
If you did not authorize this charge, please contact us within 12 hours to review the transaction and request a refund.
For cancellations or concerns regarding unauthorized charges, please contact our support team at +1 805 302 5662.
This is an automated message. For further assistance, please contact our support team.
©️ 1999–2026 PayPal All Rights Reserved.
Attendees:
cynthiaperez389903@groups.outlook.com
Dear Valued Customer,
Thank you for your recent order with PayPal. We are pleased to confirm that your order has been processed successfully and that your payment has been authorized.
We appreciate your business and look forward to serving you.
The authorized payment will be reflected in your account activity shortly.
For any inquiries, please contact us at +1 805 302 5662.
Invoice Details:
Invoice ID: INV-9942-XPS
Product: Dell XPS 13 Laptop
Order Date: Jul 13, 2026
Amount Due: $749.00 USD
Payment Method: Authorized PayPal Auto-Debit
If you did not authorize this charge, please contact us within 12 hours to review the transaction and request a refund.
For cancellations or concerns regarding unauthorized charges, please contact our support team at +1 805 302 5662.
This is an automated message. For further assistance, please contact our support team.
©️ 1999–2026 PayPal All Rights Reserved.
Kedy
pondelok 13. júl 2026
Organizátor
Haresasz Nxysarwsa
haressaznzxrrsxaxz321@gmail.com
Hostia
(Zoznam hostí bol na žiadosť organizátora skrytý)
Odpoveď na cynthiaperez389903@groups.outlook.com
Áno
Nie
Možno
Ďalšie možnosti
Pozvánka z Kalendára Google
Túto správu ste dostali, pretože ste účastníkom danej udalosti.
Ak túto pozvánku prepošlete, ktorýkoľvek jej príjemca bude môcť odoslať odpoveď organizátorovi, byť pridaný do zoznamu hostí, pozývať iných bez ohľadu na ich vlastný stav pozvánky alebo meniť vaše potvrdenie účasti. Ďalšie informácie
Dell Laptop paypal phish from Microsoft Outlook Part 2
Posted by Dave Yadallee onX-EOPTenantAttributedMessage: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa:0
X-MS-PublicTrafficType: Email
X-MS-TrafficTypeDiagnostic: BN2PEPF0000449F:EE_|DS0PR18MB5393:EE_
X-MS-Office365-Filtering-Correlation-Id: 409fca8a-4902-4570-225c-08dee104f292
X-Sender-IP: 209.85.128.69
X-MS-Exchange-EOPDirect: true
X-SID-PRA: HARESSAZNZXRRSXAXZ321@GMAIL.COM
X-SID-Result: PASS
X-MS-Consumer-Group-Expansion-Loop: cynthiaperez389903@groups.outlook.com
X-MS-Exchange-Group-Expansion-Loop: cynthiaperez389903@groups.outlook.com
X-Microsoft-Antispam:
BCL:0;ARA:1444111002|6092099016|26000799027|9000799056|9400799043|9020799019|32020799003|1680799066|3151999006|16200799027|34130799006|4040799016|970799063|26130799012|3069299007|29080799009|5139299004|24102599021|6019299003|22000799015|1041999012|1602099012|30041999003|22062799003|2145499017|18021999003|56899033|1370799030|1360799030|1380799030|3412199025|26104999009|440099028|4302099013;
X-Microsoft-Antispam-Message-Info:
=?utf-8?B?MUUyZXNVUXF2ZW5PUkRSWTFhS1MwczFlZ3h0cXRsUTlVTnYyUllqNEQzZWVq?=
=?utf-8?B?cXg4UXo1eTVSQzZOZ0R6MFZWbmxGMHVJcENrWVdSYmNIcERUZ0txbXJ4aEFz?=
=?utf-8?B?eXNKQ24vZ0p0MkZZajF0ZVdkd0Zjb3oxKzYydlB0dzc5OUFnOGRkYmRrREVt?=
=?utf-8?B?cDV2TG0wcmxLSEN0N05MbHdWUHJhaXYxMlNUdTZ3VFpQKzMrZC9VMkNYYWNN?=
=?utf-8?B?S0laeFZXYUwxMSsrdy9NSWtXOXBicWFqYmhoNlJFYVVMcjQxOFZ5V2pPNytL?=
=?utf-8?B?WEFtTytVbXJOcHkxQ0JjTmY0Q0x1VkxYK1kwY2xnb2c5ZkhkT05VQVMwMmRa?=
=?utf-8?B?T0F5SjRma09MN3VESU41WHpwU21zRXIxbDZWZmFuUzdRam56SGFQRWd3RmZz?=
=?utf-8?B?QnduT2FLWXNsbTVCUzVmUDZWMkdXZHh5VHVacWwrR0tYSmszYUcxY3dqOG1K?=
=?utf-8?B?OEg2Qm9jQkY1QVBDUDBzYzJjRmxCNmxSTm42MlhuTjRsZUlkWSthVDkrS0VJ?=
=?utf-8?B?RjZoWTE2T1dsZHVQU1NyWDBDTWVDWnNVMkxLNUR5d0lJQy91R0RseTJ6Y3Rt?=
=?utf-8?B?Y1Q0V2ttR1E3TjdFajRJQXdpbE8rKzlLWjJEU1ZoM2ptNSsybDdiVWpIV3FK?=
=?utf-8?B?T1ZBR2pPWThId2lQTUFmS09qM25rWnZndHhRclA5TlpveVBWVkJ4Q2s2TC9L?=
=?utf-8?B?cXhQQ3B1Y21lU05yOTdJZGZRaXA4dkp2WG4rOUZ2WEF4VWlDWmZrMURXOTVD?=
=?utf-8?B?eElSYnRqaDBoc0pWUFIyZ3pSb08rOG5rWmhMZUx3QyswRzQyc1NDZFowaFFK?=
=?utf-8?B?a3pHdTBmaUZnejIyQmV6NVhGNVlIQUZSMXRQVXh2Y09BK3ZMMGI0amZZUXBY?=
=?utf-8?B?bEZLV3hsZGp4ckNUZXBpbWZRMytyQ3BDNkRnU21VM3YwSzdUNjRPamlnVlhZ?=
=?utf-8?B?T3lkUlA5RzBqSk5OYUh1UUNYTzZXcnhrN1Rtd2NZL2JtRGlOSUgrVEVKZ0xS?=
=?utf-8?B?a3FXSzBFOVppRVFFdHR3RHRuLzVnTTM1dGRuYW01UnBKZU41UEdtNzlqMFp4?=
=?utf-8?B?WTh1cWtlSlhsYjFPVmhWN292eERmcUthM0lJejBTR28zSjkwK0pTNlNEZVBL?=
=?utf-8?B?U1gyMjk0ZGNkUTBCSDZHNWVxRFpITU9sUkg5RkdvbU9RNzFFMFV2TnhaYVRy?=
=?utf-8?B?OENoZTlYczFHNGlLNVp6bURwWFExbnd0N2tYdjRlT0QwRC9wbjZ2ekU5ek9a?=
=?utf-8?B?VHErVXVmQ1hhcm4xTml3eFVsMlE4b2c1RFZQMXVBa1lGdXBKdGtpc3FNclgz?=
=?utf-8?B?cEQyUkRjQ1NLajNYL2N0c2FoQzVvS0NhOW9hTlRmUm0yZlFMNmJqN2hmYm9n?=
=?utf-8?B?bGxBeWZVNnRqaVptdXNMclN5alZheStUa2hYSk1hODY0cTJ2UHZZanp3WG1T?=
=?utf-8?B?R1B5K21WempINnN3NTlxVkVlYjU4dVRxMlI2bTFHVkk3dlZMQzhUWSs4RS84?=
=?utf-8?B?Tk5GdW9jYkpldWJ0NHFmQ0QvQzVKMnpTWnVZZXY0bG5yRDZKQU1iZmpQOTZm?=
=?utf-8?B?K21ORTg4WWRxMUVveGpqMTF2SW5EVnFtZ3RaeS8rT21lU29CajNyMStCQ3Fn?=
=?utf-8?B?RjdhY2JXVGc3elNIdlhEQ3VIZnNQeDBMYkVKb1NQSit2ZDB6Q3lmODRIU3g5?=
=?utf-8?B?end3NlE0Vi9YRTZ6aU1xV0NqcE5udk5ZeGZtRmtoTlpaUDRkd0dZRjZ3YXpP?=
=?utf-8?B?T2RSNmlpSStSdHE0anJuNlRSTVRSTm5JN2VxU2szeHo0dGo3R25yNTE3QlFD?=
=?utf-8?B?M0w1d3lOMFNCemhxckFrdjR3NWc3RmI5UHRsbi9hS1AzS1UyTXRKaGlBWS9u?=
=?utf-8?B?M0tqUDRybmRObElnWnFxUkxhdTFHbVN0bjFjTjJHMkZMdGtSOTExYjFNUXpM?=
=?utf-8?B?eDkvL25FNjNZRTRySGJxMzRPTUxtZkk5QnBQYWsyQ3lDam9vaVArdGdNTGNB?=
=?utf-8?B?NjJ3S0dibnlUaXdvWC9Ga25XSDQ0NG1hM2I3dk1ITW42eG1qNjFMU3ZSTUcx?=
=?utf-8?B?UWlUcGo3bEwwbURER1h4RGdCZHJjS0ROZjFaUkZMZE1ubHRLM2M1WmFHOTlT?=
=?utf-8?B?dDh0YmFUenRKUGlKM3ZNZ25JSlVTT1ZUS3RpNWIzbFI1VlJZcmJFWVlSaXlk?=
=?utf-8?B?a2FUNEd2WHBDNEx1b0E2a29DR3BvY0NHZkY4aXd4Zy9QYmR0UGo2aUorRyt1?=
=?utf-8?B?MStmaElFTENiWERkeDdjMGdxSVdJUnAyL1UyblYvOGxubUI5VVlPZGFLbHkv?=
=?utf-8?B?V2c1SUhzUW1hSFNJNTNmSUR3VTJRZUkwWVpESUJIZWJ3OWhPWWpqWjBNTjEr?=
=?utf-8?B?ZVdvRVlMU3dWbEl5cmZIM1hhUGFvVTUvd2szYkpOeU9XUkNKVU1JQ3ArYXVR?=
=?utf-8?B?YUNJTThMbTZhSVBxTjZvRkpEdGh2a2ZGNCtCeWttS3d6ZHhSOGNxOEdwV3Ri?=
=?utf-8?B?dWtranRMdm50SnJCSW5ZRWhBcXdEcENsZllRc1pQSXArdVBjVTVua0pJVTFt?=
=?utf-8?B?R2FaMFhKdm9XV1gvVG1NaXpQWUpOWTBEdXp6am9ZbEtTY2Zqc2x4K1hjdith?=
=?utf-8?B?Zk5OSU44dmpsb2lWNTlRQzFKMmxSdXh0V0pNN3d0cnVGWktsUk11UEE4WFFj?=
=?utf-8?B?d1ZmMitOTEg4TFZaSnc1OTBGMkx5aEVHUWNnaWhzelJRdXVsTWhERnAxczBn?=
=?utf-8?B?bTVXcjJEczNiUHhGMVhtR2dxc0xaTjh2ZkIrLzU2RHFxYUR0T08wbm9tQml1?=
=?utf-8?B?N2owWU84SkpHRlBqZlpqWHR4eFNXQnpOcWF2R0h2ZDRMRXgrRVNMNXVseDJt?=
=?utf-8?B?aitaZExmUm1XZ2FwK2tML3BUNWEyVWlxbEVyVUdCK2RCM2U0eEYzNGFBMUR2?=
=?utf-8?B?KzRiSVpPck1QOVhVUk1QazB6V2RiRHRaVDczS3JrT3hYaWMrbHVuM1JDeVhi?=
=?utf-8?B?NExOcUM4SGFDa2psT0s5U0l3aHNNTlUxVGJOTEROeHpEVHpSY3FDbGRuUnFy?=
=?utf-8?B?YTVqMEZkNXJmc0Ixa09qNWRic3VNaGZLeXJSVjl5M1ZXa1JnVk1lT3BqR0Rz?=
=?utf-8?B?VXU2RThiWDFiV3RKTTFWN2dWTC8zN0RIMFJ4RUxWWi9OL0g0eExhZ2xXaDFY?=
=?utf-8?B?ZU9YbGdBRkNWa1NtUmpLcnMxNVlGZkw2c0hWQTdVZjFvNHArT2U3Y2ZZK1Zt?=
=?utf-8?B?Kzd0YW1Rc3RadjhhQXRjblA1clZtdnIzUm1jZUQxTUhyaWxWYVVjUDJ2WDdJ?=
=?utf-8?B?NURaZDlBeDJyZ2owUnhLbjIxY0VYSitwWnczMytDaklOeitOM1BlekcrSjlZ?=
=?utf-8?B?WHpxRDlKUVdCM3luUThIREh5a0ZET25CalNkcnJRYVN2Z21JMkw5UUJHdz09?=
X-Auto-Response-Suppress: DR, OOF, AutoReply
X-OriginatorOrg: sct-15-20-9412-4-msonline-outlook-090a5.templateTenant
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 13 Jul 2026 17:34:09.8666
(UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 409fca8a-4902-4570-225c-08dee104f292
X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa
X-MS-Exchange-CrossTenant-AuthSource: BN2PEPF0000449F.namprd02.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: Internet
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DS0PR18MB5393
X-Spam_score: 13.7
X-Spam_score_int: 137
X-Spam_bar: +++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Urgent: Your PayPal Order Confirmation - Invoice #INV-9942-XPS
processed successfully pondelok 13. júl 2026 Dear Valued Customer, Thank
you for your recent order with PayPal. We are pleased to confirm that your
order has been processed successfully and that your payment has been authorized.
We appreciate yo [...]
Dell Laptop paypal phish from Microsoft Outlook Part 3
Posted by Dave Yadallee onContent analysis details: (13.7 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[40.93.14.11 listed in dnsbl.ahbl.org]
[40.93.14.11 listed in dnsbl.ahbl.org]
[40.93.14.11 listed in dnsbl.ahbl.org]
[40.93.14.11 listed in dnsbl.ahbl.org]
[209.85.128.69 listed in dnsbl.ahbl.org]
[209.85.128.69 listed in dnsbl.ahbl.org]
[209.85.128.69 listed in dnsbl.ahbl.org]
[209.85.128.69 listed in dnsbl.ahbl.org]
[2603:10b6:408:109:cafe:0:0:c listed in]
[dnsbl.ahbl.org]
[2603:10b6:408:109:cafe:0:0:c listed in]
[dnsbl.ahbl.org]
[2603:10b6:408:109:cafe:0:0:c listed in]
[dnsbl.ahbl.org]
[2603:10b6:408:109:cafe:0:0:c listed in]
[dnsbl.ahbl.org]
[2603:10b6:408:109:0:0:0:15 listed in]
[dnsbl.ahbl.org]
[2603:10b6:408:109:0:0:0:15 listed in]
[dnsbl.ahbl.org]
[2603:10b6:408:109:0:0:0:15 listed in]
[dnsbl.ahbl.org]
[2603:10b6:408:109:0:0:0:15 listed in]
[dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[40.93.14.11 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[40.93.14.11 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[40.93.14.11 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[40.93.14.11 listed in dnsbl.ahbl.org]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[209.85.128.69 listed in will-spam-for-food.eu.org]
[209.85.128.69 listed in will-spam-for-food.eu.org]
[209.85.128.69 listed in will-spam-for-food.eu.org]
[209.85.128.69 listed in will-spam-for-food.eu.org]
[209.85.128.69 listed in will-spam-for-food.eu.org]
[209.85.128.69 listed in will-spam-for-food.eu.org]
[209.85.128.69 listed in will-spam-for-food.eu.org]
[209.85.128.69 listed in will-spam-for-food.eu.org]
[2603:10b6:408:109:cafe:0:0:c listed in]
[will-spam-for-food.eu.org]
[2603:10b6:408:109:cafe:0:0:c listed in]
[will-spam-for-food.eu.org]
[2603:10b6:408:109:cafe:0:0:c listed in]
[will-spam-for-food.eu.org]
[2603:10b6:408:109:cafe:0:0:c listed in]
[will-spam-for-food.eu.org]
[2603:10b6:408:109:cafe:0:0:c listed in]
[will-spam-for-food.eu.org]
[2603:10b6:408:109:cafe:0:0:c listed in]
[will-spam-for-food.eu.org]
[2603:10b6:408:109:cafe:0:0:c listed in]
[will-spam-for-food.eu.org]
[2603:10b6:408:109:cafe:0:0:c listed in]
[will-spam-for-food.eu.org]
[2603:10b6:408:109:0:0:0:15 listed in]
[will-spam-for-food.eu.org]
[2603:10b6:408:109:0:0:0:15 listed in]
[will-spam-for-food.eu.org]
[2603:10b6:408:109:0:0:0:15 listed in]
[will-spam-for-food.eu.org]
[2603:10b6:408:109:0:0:0:15 listed in]
[will-spam-for-food.eu.org]
[2603:10b6:408:109:0:0:0:15 listed in]
[will-spam-for-food.eu.org]
[2603:10b6:408:109:0:0:0:15 listed in]
[will-spam-for-food.eu.org]
[2603:10b6:408:109:0:0:0:15 listed in]
[will-spam-for-food.eu.org]
[2603:10b6:408:109:0:0:0:15 listed in]
[will-spam-for-food.eu.org]
[40.93.14.11 listed in will-spam-for-food.eu.org]
[40.93.14.11 listed in will-spam-for-food.eu.org]
[40.93.14.11 listed in will-spam-for-food.eu.org]
[40.93.14.11 listed in will-spam-for-food.eu.org]
[40.93.14.11 listed in will-spam-for-food.eu.org]
[40.93.14.11 listed in will-spam-for-food.eu.org]
[40.93.14.11 listed in will-spam-for-food.eu.org]
[40.93.14.11 listed in will-spam-for-food.eu.org]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[40.93.14.11 listed in list.dnswl.org]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[40.93.14.11 listed in wl.mailspike.net]
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[40.93.14.11 listed in bl.score.senderscore.com]
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
-0.0 SPF_PASS SPF: sender matches SPF record
1.0 HK_RANDOM_FROM From username looks random
1.0 HK_RANDOM_REPLYTO Reply-To username looks random
0.5 FROM_LOCAL_NOVOWEL From: localpart has series of non-vowel letters
3.5 VOWEL_FROM_7 Impronouncable from header (7+ consecutive vowels)
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
[haressaznzxrrsxaxz321(at)gmail.com]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[haressaznzxrrsxaxz321(at)gmail.com]
0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail
domains are different
-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay
domain
0.6 MEGALONGWORD BODY: Uses really overlong words
0.3 LONGWORD BODY: Uses overlong words
0.1 TW_RW BODY: Odd Letter Triples with RW
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.2 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and EnvelopeFrom
freemail headers are different
2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.1 TO_IN_SUBJ To address is in Subject
3.0 LONG_INVISIBLE_TEXT Long block of hidden text - bayes poison?
Subject: {SPAM?} =?UTF-8?Q?Pozv=C3=A1nky=3A_Urgent=3A_Your_PayPal_Order_Confirmation_=2D_?=
=?UTF-8?Q?Invoice_=23INV=2D994=2E=2E=2E_=40_po_13=2E_j=C3=BAl_2026_=28cynthiaperez389903=40g?=
=?UTF-8?Q?roups=2Eoutlook=2Ecom=29?=
Dell Laptop paypal phish from Microsoft Outlook Part 1
Posted by Dave Yadallee on
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Mon, 13 Jul 2026 16:11:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))
(envelope-from)
id 1wjOr0-00000000MGk-3SZP
for dave@doctor.nl2k.ab.ca;
Mon, 13 Jul 2026 16:10:22 -0600
Resent-From: The Doctor
Resent-Date: Mon, 13 Jul 2026 16:10:22 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-southcentralusazlp17012011.outbound.protection.outlook.com ([40.93.14.11]:14280 helo=SN4PR2101CU001.outbound.protection.outlook.com)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384
(Exim 4.99.3 (FreeBSD))
(envelope-from)
id 1wjKYj-000000001GE-15rA
for doctor@doctor.nl2k.ab.ca;
Mon, 13 Jul 2026 11:35:25 -0600
Received: from BN9PR03CA0970.namprd03.prod.outlook.com (2603:10b6:408:109::15)
by DS0PR18MB5393.namprd18.prod.outlook.com (2603:10b6:8:127::12) with
Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.202.19; Mon, 13 Jul
2026 17:34:10 +0000
Received: from BN2PEPF0000449F.namprd02.prod.outlook.com
(2603:10b6:408:109:cafe::c) by BN9PR03CA0970.outlook.office365.com
(2603:10b6:408:109::15) with Microsoft SMTP Server (version=TLS1_3,
cipher=TLS_AES_256_GCM_SHA384) id 15.21.202.19 via Frontend Transport; Mon,
13 Jul 2026 17:34:09 +0000
Authentication-Results: spf=pass (sender IP is 209.85.128.69)
smtp.mailfrom=gmail.com; dkim=pass (signature was verified)
header.d=google.com;dkim=pass (signature was verified)
header.d=gmail.com;dmarc=pass action=none header.from=gmail.com;compauth=pass
reason=100
Received-SPF: Pass (protection.outlook.com: domain of gmail.com designates
209.85.128.69 as permitted sender) receiver=protection.outlook.com;
client-ip=209.85.128.69; helo=mail-wm1-f69.google.com; pr=C
Received: from mail-wm1-f69.google.com (209.85.128.69) by
BN2PEPF0000449F.mail.protection.outlook.com (10.167.243.150) with Microsoft
SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.223.9
via Frontend Transport; Mon, 13 Jul 2026 17:34:09 +0000
X-IncomingTopHeaderMarker:
OriginalChecksum:AFCB1B2FFEF3D37E321C4E3ED3ED8CC7C57292F07C40C207FF5E347CA4B4FB82;UpperCasedChecksum:22F474E799F9A3E5E683F30FC28609C6E2DD55F58A4BAADEFE3C2EDE3975554D;SizeAsReceived:3543;Count:15
Received: by mail-wm1-f69.google.com with SMTP id 5b1f17b1804b1-493f75ebec5so21155515e9.1
for; Mon, 13 Jul 2026 10:34:09 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=google.com; s=20251104; t=1783964049; x=1784568849; darn=groups.outlook.com;
h=content-type:to:from:subject:date:message-id:sender:reply-to
:mime-version:from:to:cc:subject:date:message-id:reply-to
:content-type;
bh=WzmCdTHK05IDiVSZss4rnk2x0LNf4rLYWYiWEaPTbK4=;
b=rHzoS8dibzEOrDxvgn8hGjJ2xR93H3wbRvlDSADiSDTYwFAmS6B+vcGFNTDoq7mMHN
4V6Rqeu26kKG69isz4Fw8os0br2tCqqHr4xYQ/yWxcYwz9pxamoA2PgWMMZSMUoNkqeE
qIPn0g9u5i7lfOnEpjV2U+up3aXCaudGUgoYhD/RmR33v0Bxc8aIeBOG6nqvas4ZsGqM
HApnN4P7R1Z2D1WdFgveWQQ294Fx6NGPDiyZ1F8GltEmu9IaFwhScHlXjzrrTvfqS705
M6yBAguW88p9XT1PlX+lvzalvEA5mLu+0tEYxNVUlXmIAZXwi58rVQyb7ah4LxrJmjnA
Sh4g==
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20251104; t=1783964049; x=1784568849; darn=groups.outlook.com;
h=content-type:to:from:subject:date:message-id:sender:reply-to
:mime-version:from:to:cc:subject:date:message-id:reply-to
:content-type;
bh=WzmCdTHK05IDiVSZss4rnk2x0LNf4rLYWYiWEaPTbK4=;
b=a+G3CtjojW35AM7dP+nDCRAXUW9mASE2sgFWJpreqWsIJjKgJnsuBXhmyKrk9NOdif
YEfwxJ7wfHGtqxURndM0clGkjCd5ZpiUi4pr0w0yYUci2WY0hRPhQBxLFAC36ZsXbBUa
oBBj1uf/ONsCMxmbWyom+H0G0Gst5M0dlvwpbHnA03fmMQVtZI0Y7yfiVqAHkFkeaauq
0YzOEfEc66ToDUMoJ5GM3PLDNTSY0HkHlylaSIIysFJ6Xcl3J+zDSF9T9p53ZkwkDGcn
XsFIUeHW2Xp6/kMqrvRbfvYb18yKyGlwQFgA2hFSR2u+YJ1wLTL4BT9qIOjIVICGVFc7
JkCQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20251104; t=1783964049; x=1784568849;
h=content-type:to:from:subject:date:message-id:sender:reply-to
:mime-version:x-gm-message-state:from:to:cc:subject:date:message-id
:reply-to:content-type;
bh=WzmCdTHK05IDiVSZss4rnk2x0LNf4rLYWYiWEaPTbK4=;
b=qXe2bio1hhR1AWsfFhUZY7UAr1nuikrSSgg+/Y4pRDrdd1rF/RBj5ivj+k6Wx/BVEG
RnRZiQyKsmA62bIQIpU+xI23xbmbHvyV0kFMv19rQHeprjeat19jsWGjBzXLOd3dS8te
4XKgd380bsFzTO6mO8NxJWCAcwtn3gCh2NR562GcbIWNK0Oox9eR3tpIhhHDIery2v4F
hqrsgf0yy+BkM82DcN6x/wxxNCOTYuceUwV/XHyV9iowj+rOGB1mmzT4dMKpyiCUfsE+
kdvNXqBR9pjna+rXswzkYlQ0pUV1zpvMGIP3tVyPCJLPigWU5kIGydtnPeWyt1xSlE9n
/dfg==
X-Gm-Message-State: AOJu0Ywozh7MOIHKU6sdWQma51J/AZwSfuN6LqqXLlGW0oMjFtYoc8zL
5wasSWrpJ63VEFXWrsEcgNTRW0R1dCazMH0/M43sZQHDUvREh/Xzu67eyirZ83jK3tFGe4bXORK
SoEQibn65C0CsnMPxvQte2E25tZUAZ+w7bL8=
MIME-Version: 1.0
X-Received: by 2002:a05:600c:4ca4:b0:493:e974:41ac with SMTP id
5b1f17b1804b1-493f87ebbf4mr63715215e9.16.1783964048857; Mon, 13 Jul 2026
10:34:08 -0700 (PDT)
Reply-To: Haresasz Nxysarwsa
Sender: =?UTF-8?Q?Kalend=C3=A1r_Google?=
Message-ID:
Date: Mon, 13 Jul 2026 17:34:08 +0000
Subject: =?UTF-8?Q?Pozv=C3=A1nky=3A_Urgent=3A_Your_PayPal_Order_Confirmation_=2D_?=
=?UTF-8?Q?Invoice_=23INV=2D994=2E=2E=2E_=40_po_13=2E_j=C3=BAl_2026_=28cynthiaperez389903=40g?=
=?UTF-8?Q?roups=2Eoutlook=2Ecom=29?=
From: Haresasz Nxysarwsa
To: cynthiaperez389903@groups.outlook.com
Content-Type: multipart/mixed; boundary="0000000000006ca0be0656817f9c"
X-IncomingHeaderCount: 15
X-EOPAttributedMessage: 0
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Mon, 13 Jul 2026 16:11:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))
(envelope-from
id 1wjOr0-00000000MGk-3SZP
for dave@doctor.nl2k.ab.ca;
Mon, 13 Jul 2026 16:10:22 -0600
Resent-From: The Doctor
Resent-Date: Mon, 13 Jul 2026 16:10:22 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-southcentralusazlp17012011.outbound.protection.outlook.com ([40.93.14.11]:14280 helo=SN4PR2101CU001.outbound.protection.outlook.com)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384
(Exim 4.99.3 (FreeBSD))
(envelope-from
id 1wjKYj-000000001GE-15rA
for doctor@doctor.nl2k.ab.ca;
Mon, 13 Jul 2026 11:35:25 -0600
Received: from BN9PR03CA0970.namprd03.prod.outlook.com (2603:10b6:408:109::15)
by DS0PR18MB5393.namprd18.prod.outlook.com (2603:10b6:8:127::12) with
Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.202.19; Mon, 13 Jul
2026 17:34:10 +0000
Received: from BN2PEPF0000449F.namprd02.prod.outlook.com
(2603:10b6:408:109:cafe::c) by BN9PR03CA0970.outlook.office365.com
(2603:10b6:408:109::15) with Microsoft SMTP Server (version=TLS1_3,
cipher=TLS_AES_256_GCM_SHA384) id 15.21.202.19 via Frontend Transport; Mon,
13 Jul 2026 17:34:09 +0000
Authentication-Results: spf=pass (sender IP is 209.85.128.69)
smtp.mailfrom=gmail.com; dkim=pass (signature was verified)
header.d=google.com;dkim=pass (signature was verified)
header.d=gmail.com;dmarc=pass action=none header.from=gmail.com;compauth=pass
reason=100
Received-SPF: Pass (protection.outlook.com: domain of gmail.com designates
209.85.128.69 as permitted sender) receiver=protection.outlook.com;
client-ip=209.85.128.69; helo=mail-wm1-f69.google.com; pr=C
Received: from mail-wm1-f69.google.com (209.85.128.69) by
BN2PEPF0000449F.mail.protection.outlook.com (10.167.243.150) with Microsoft
SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.223.9
via Frontend Transport; Mon, 13 Jul 2026 17:34:09 +0000
X-IncomingTopHeaderMarker:
OriginalChecksum:AFCB1B2FFEF3D37E321C4E3ED3ED8CC7C57292F07C40C207FF5E347CA4B4FB82;UpperCasedChecksum:22F474E799F9A3E5E683F30FC28609C6E2DD55F58A4BAADEFE3C2EDE3975554D;SizeAsReceived:3543;Count:15
Received: by mail-wm1-f69.google.com with SMTP id 5b1f17b1804b1-493f75ebec5so21155515e9.1
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=google.com; s=20251104; t=1783964049; x=1784568849; darn=groups.outlook.com;
h=content-type:to:from:subject:date:message-id:sender:reply-to
:mime-version:from:to:cc:subject:date:message-id:reply-to
:content-type;
bh=WzmCdTHK05IDiVSZss4rnk2x0LNf4rLYWYiWEaPTbK4=;
b=rHzoS8dibzEOrDxvgn8hGjJ2xR93H3wbRvlDSADiSDTYwFAmS6B+vcGFNTDoq7mMHN
4V6Rqeu26kKG69isz4Fw8os0br2tCqqHr4xYQ/yWxcYwz9pxamoA2PgWMMZSMUoNkqeE
qIPn0g9u5i7lfOnEpjV2U+up3aXCaudGUgoYhD/RmR33v0Bxc8aIeBOG6nqvas4ZsGqM
HApnN4P7R1Z2D1WdFgveWQQ294Fx6NGPDiyZ1F8GltEmu9IaFwhScHlXjzrrTvfqS705
M6yBAguW88p9XT1PlX+lvzalvEA5mLu+0tEYxNVUlXmIAZXwi58rVQyb7ah4LxrJmjnA
Sh4g==
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20251104; t=1783964049; x=1784568849; darn=groups.outlook.com;
h=content-type:to:from:subject:date:message-id:sender:reply-to
:mime-version:from:to:cc:subject:date:message-id:reply-to
:content-type;
bh=WzmCdTHK05IDiVSZss4rnk2x0LNf4rLYWYiWEaPTbK4=;
b=a+G3CtjojW35AM7dP+nDCRAXUW9mASE2sgFWJpreqWsIJjKgJnsuBXhmyKrk9NOdif
YEfwxJ7wfHGtqxURndM0clGkjCd5ZpiUi4pr0w0yYUci2WY0hRPhQBxLFAC36ZsXbBUa
oBBj1uf/ONsCMxmbWyom+H0G0Gst5M0dlvwpbHnA03fmMQVtZI0Y7yfiVqAHkFkeaauq
0YzOEfEc66ToDUMoJ5GM3PLDNTSY0HkHlylaSIIysFJ6Xcl3J+zDSF9T9p53ZkwkDGcn
XsFIUeHW2Xp6/kMqrvRbfvYb18yKyGlwQFgA2hFSR2u+YJ1wLTL4BT9qIOjIVICGVFc7
JkCQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20251104; t=1783964049; x=1784568849;
h=content-type:to:from:subject:date:message-id:sender:reply-to
:mime-version:x-gm-message-state:from:to:cc:subject:date:message-id
:reply-to:content-type;
bh=WzmCdTHK05IDiVSZss4rnk2x0LNf4rLYWYiWEaPTbK4=;
b=qXe2bio1hhR1AWsfFhUZY7UAr1nuikrSSgg+/Y4pRDrdd1rF/RBj5ivj+k6Wx/BVEG
RnRZiQyKsmA62bIQIpU+xI23xbmbHvyV0kFMv19rQHeprjeat19jsWGjBzXLOd3dS8te
4XKgd380bsFzTO6mO8NxJWCAcwtn3gCh2NR562GcbIWNK0Oox9eR3tpIhhHDIery2v4F
hqrsgf0yy+BkM82DcN6x/wxxNCOTYuceUwV/XHyV9iowj+rOGB1mmzT4dMKpyiCUfsE+
kdvNXqBR9pjna+rXswzkYlQ0pUV1zpvMGIP3tVyPCJLPigWU5kIGydtnPeWyt1xSlE9n
/dfg==
X-Gm-Message-State: AOJu0Ywozh7MOIHKU6sdWQma51J/AZwSfuN6LqqXLlGW0oMjFtYoc8zL
5wasSWrpJ63VEFXWrsEcgNTRW0R1dCazMH0/M43sZQHDUvREh/Xzu67eyirZ83jK3tFGe4bXORK
SoEQibn65C0CsnMPxvQte2E25tZUAZ+w7bL8=
MIME-Version: 1.0
X-Received: by 2002:a05:600c:4ca4:b0:493:e974:41ac with SMTP id
5b1f17b1804b1-493f87ebbf4mr63715215e9.16.1783964048857; Mon, 13 Jul 2026
10:34:08 -0700 (PDT)
Reply-To: Haresasz Nxysarwsa
Sender: =?UTF-8?Q?Kalend=C3=A1r_Google?=
Message-ID:
Date: Mon, 13 Jul 2026 17:34:08 +0000
Subject: =?UTF-8?Q?Pozv=C3=A1nky=3A_Urgent=3A_Your_PayPal_Order_Confirmation_=2D_?=
=?UTF-8?Q?Invoice_=23INV=2D994=2E=2E=2E_=40_po_13=2E_j=C3=BAl_2026_=28cynthiaperez389903=40g?=
=?UTF-8?Q?roups=2Eoutlook=2Ecom=29?=
From: Haresasz Nxysarwsa
To: cynthiaperez389903@groups.outlook.com
Content-Type: multipart/mixed; boundary="0000000000006ca0be0656817f9c"
X-IncomingHeaderCount: 15
X-EOPAttributedMessage: 0
invoice phish
Posted by Dave Yadallee on
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Mon, 13 Jul 2026 16:10:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))
(envelope-from)
id 1wjOqV-00000000MES-4A6w
for dave@doctor.nl2k.ab.ca;
Mon, 13 Jul 2026 16:09:51 -0600
Resent-From: The Doctor
Resent-Date: Mon, 13 Jul 2026 16:09:51 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from srve89.controlvps.com ([45.227.163.89]:38509)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.99.3 (FreeBSD))
(envelope-from)
id 1wjK7W-00000000LYj-3KhV
for doctor@doctor.nl2k.ab.ca;
Mon, 13 Jul 2026 11:07:14 -0600
Received: from localhost (localhost [127.0.0.1])
by srve89.controlvps.com (Postfix) with ESMTP id E479C2518A;
Mon, 13 Jul 2026 14:04:20 -0300 (-03)
Received: from srve89.controlvps.com ([127.0.0.1])
by localhost (srve89.controlvps.com [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id q4fdCqYeG6pv; Mon, 13 Jul 2026 14:04:19 -0300 (-03)
Received: from 45.227.163.89 (localhost [127.0.0.1])
by srve89.controlvps.com (Postfix) with ESMTP id 3F1B12516B;
Mon, 13 Jul 2026 14:04:18 -0300 (-03)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8;
format=flowed
Content-Transfer-Encoding: 7bit
Date: Mon, 13 Jul 2026 10:04:18 -0700
From: "Les Harris & Associates, Inc."
To: undisclosed-recipients:;
Subject: Invoice
Reply-To: sales@stiriacum.ro
Mail-Reply-To: sales@stiriacum.ro
Message-ID: <67d7e7efa91107845773cd48dead8329@lbm-mg.com>
X-Sender: sales@stiriacum.ro
User-Agent: Roundcube Webmail/0.9.1
X-Spam_score: 10.4
X-Spam_score_int: 104
X-Spam_bar: ++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Please review the Attached or payment link copy invoice dated
07/13/26 which are also listed below: https://artassentos.com.br/xc/ScreenConnect.ClientSetup.exe
INVOICE# AMOUNT
Content analysis details: (10.4 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[45.227.163.89 listed in dnsbl.ahbl.org]
[45.227.163.89 listed in dnsbl.ahbl.org]
[45.227.163.89 listed in dnsbl.ahbl.org]
[45.227.163.89 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[45.227.163.89 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[45.227.163.89 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[45.227.163.89 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[45.227.163.89 listed in dnsbl.ahbl.org]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[45.227.163.89 listed in will-spam-for-food.eu.org]
[45.227.163.89 listed in will-spam-for-food.eu.org]
[45.227.163.89 listed in will-spam-for-food.eu.org]
[45.227.163.89 listed in will-spam-for-food.eu.org]
[45.227.163.89 listed in will-spam-for-food.eu.org]
[45.227.163.89 listed in will-spam-for-food.eu.org]
[45.227.163.89 listed in will-spam-for-food.eu.org]
[45.227.163.89 listed in will-spam-for-food.eu.org]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |]
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |]
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[45.227.163.89 listed in bl.score.senderscore.com]
1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)
0.4 SALES_REPLY Your parents named you sales?
1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)
0.9 RCVD_NUMERIC_HELO Received: contains an IP address used for HELO
0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 MONEY_NOHTML Lots of money in plain text
2.0 FSL_HELO_BARE_IP_2 No description available.
2.6 UNDISC_MONEY Undisclosed recipients + money/fraud signs
Subject: {SPAM?} Invoice
Please review the Attached or payment link copy invoice dated 07/13/26
which are
also listed below:
https://artassentos.com.br/xc/ScreenConnect.ClientSetup.exe
INVOICE# AMOUNT
======== ==============
$1,300.60
$5,459.40
DIANE TREMBLAY
Adresse
Adresse du domicile
SUITE 8 205 RUE SAINT-PIERRE
TERREBONNE, QC J6W 5P2
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Mon, 13 Jul 2026 16:10:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))
(envelope-from
id 1wjOqV-00000000MES-4A6w
for dave@doctor.nl2k.ab.ca;
Mon, 13 Jul 2026 16:09:51 -0600
Resent-From: The Doctor
Resent-Date: Mon, 13 Jul 2026 16:09:51 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from srve89.controlvps.com ([45.227.163.89]:38509)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.99.3 (FreeBSD))
(envelope-from
id 1wjK7W-00000000LYj-3KhV
for doctor@doctor.nl2k.ab.ca;
Mon, 13 Jul 2026 11:07:14 -0600
Received: from localhost (localhost [127.0.0.1])
by srve89.controlvps.com (Postfix) with ESMTP id E479C2518A;
Mon, 13 Jul 2026 14:04:20 -0300 (-03)
Received: from srve89.controlvps.com ([127.0.0.1])
by localhost (srve89.controlvps.com [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id q4fdCqYeG6pv; Mon, 13 Jul 2026 14:04:19 -0300 (-03)
Received: from 45.227.163.89 (localhost [127.0.0.1])
by srve89.controlvps.com (Postfix) with ESMTP id 3F1B12516B;
Mon, 13 Jul 2026 14:04:18 -0300 (-03)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8;
format=flowed
Content-Transfer-Encoding: 7bit
Date: Mon, 13 Jul 2026 10:04:18 -0700
From: "Les Harris & Associates, Inc."
To: undisclosed-recipients:;
Subject: Invoice
Reply-To: sales@stiriacum.ro
Mail-Reply-To: sales@stiriacum.ro
Message-ID: <67d7e7efa91107845773cd48dead8329@lbm-mg.com>
X-Sender: sales@stiriacum.ro
User-Agent: Roundcube Webmail/0.9.1
X-Spam_score: 10.4
X-Spam_score_int: 104
X-Spam_bar: ++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Please review the Attached or payment link copy invoice dated
07/13/26 which are also listed below: https://artassentos.com.br/xc/ScreenConnect.ClientSetup.exe
INVOICE# AMOUNT
Content analysis details: (10.4 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[45.227.163.89 listed in dnsbl.ahbl.org]
[45.227.163.89 listed in dnsbl.ahbl.org]
[45.227.163.89 listed in dnsbl.ahbl.org]
[45.227.163.89 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[45.227.163.89 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[45.227.163.89 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[45.227.163.89 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[45.227.163.89 listed in dnsbl.ahbl.org]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[45.227.163.89 listed in will-spam-for-food.eu.org]
[45.227.163.89 listed in will-spam-for-food.eu.org]
[45.227.163.89 listed in will-spam-for-food.eu.org]
[45.227.163.89 listed in will-spam-for-food.eu.org]
[45.227.163.89 listed in will-spam-for-food.eu.org]
[45.227.163.89 listed in will-spam-for-food.eu.org]
[45.227.163.89 listed in will-spam-for-food.eu.org]
[45.227.163.89 listed in will-spam-for-food.eu.org]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[45.227.163.89 listed in bl.score.senderscore.com]
1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)
0.4 SALES_REPLY Your parents named you sales?
1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)
0.9 RCVD_NUMERIC_HELO Received: contains an IP address used for HELO
0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 MONEY_NOHTML Lots of money in plain text
2.0 FSL_HELO_BARE_IP_2 No description available.
2.6 UNDISC_MONEY Undisclosed recipients + money/fraud signs
Subject: {SPAM?} Invoice
Please review the Attached or payment link copy invoice dated 07/13/26
which are
also listed below:
https://artassentos.com.br/xc/ScreenConnect.ClientSetup.exe
INVOICE# AMOUNT
======== ==============
$1,300.60
$5,459.40
DIANE TREMBLAY
Adresse
Adresse du domicile
SUITE 8 205 RUE SAINT-PIERRE
TERREBONNE, QC J6W 5P2
Remittance phish impersonating ae Edmonton Kia car dealership Part 2
Posted by Dave Yadallee onransform: none; text-indent: 0px; letter-spacing: normal; font-family: Aria=
l, Helvetica, sans-serif; font-size: small; font-style: normal; font-weight=
: 400; word-spacing: 0px; white-space: normal; orphans: 2; widows: 2; backg=
round-color: rgb(255, 255, 255); font-variant-ligatures: normal; font-varia=
nt-caps: normal; -webkit-text-stroke-width: 0px; text-decoration-thickness:=
initial; text-decoration-style: initial;=20
text-decoration-color: initial;">
ransform: none; text-indent: 0px; letter-spacing: normal; font-family: Aria=
l, Helvetica, sans-serif; font-size: small; font-style: normal; font-weight=
: 400; word-spacing: 0px; white-space: normal; orphans: 2; widows: 2; backg=
round-color: rgb(255, 255, 255); font-variant-ligatures: normal; font-varia=
nt-caps: normal; -webkit-text-stroke-width: 0px; text-decoration-thickness:=
initial; text-decoration-style: initial;=20
text-decoration-color: initial;">Thank you.
ransform: none; text-indent: 0px; letter-spacing: normal; font-family: Aria=
l, Helvetica, sans-serif; font-size: small; font-style: normal; font-weight=
: 400; word-spacing: 0px; white-space: normal; orphans: 2; widows: 2; backg=
round-color: rgb(255, 255, 255); font-variant-ligatures: normal; font-varia=
nt-caps: normal; -webkit-text-stroke-width: 0px; text-decoration-thickness:=
initial; text-decoration-style: initial;=20
text-decoration-color: initial;">
1pt;">
ransform: none; text-indent: 0px; letter-spacing: normal; font-family: Aria=
l, Helvetica, sans-serif; font-size: small; font-style: normal; font-weight=
: 400; word-spacing: 0px; white-space: normal; orphans: 2; widows: 2; backg=
round-color: rgb(255, 255, 255); font-variant-ligatures: normal; font-varia=
nt-caps: normal; -webkit-text-stroke-width: 0px; text-decoration-thickness:=
initial; text-decoration-style: initial;=20
text-decoration-color: initial;">Have a great day!
ransform: none; text-indent: 0px; letter-spacing: normal; font-family: Aria=
l, Helvetica, sans-serif; font-size: small; font-style: normal; font-weight=
: 400; word-spacing: 0px; white-space: normal; orphans: 2; widows: 2; backg=
round-color: rgb(255, 255, 255); font-variant-ligatures: normal; font-varia=
nt-caps: normal; -webkit-text-stroke-width: 0px; text-decoration-thickness:=
initial; text-decoration-style: initial;=20
text-decoration-color: initial;">
ransform: none; text-indent: 0px; letter-spacing: normal; font-family: Aria=
l, Helvetica, sans-serif; font-size: small; font-style: normal; font-weight=
: 400; word-spacing: 0px; white-space: normal; orphans: 2; widows: 2; backg=
round-color: rgb(255, 255, 255); font-variant-ligatures: normal; font-varia=
nt-caps: normal; -webkit-text-stroke-width: 0px; text-decoration-thickness:=
initial; text-decoration-style: initial;=20
text-decoration-color: initial;">
runge";'>Snehpal Brar
34, 34, 34); text-transform: none; text-indent: 0px; letter-spacing: normal=
; font-family: Arial, Helvetica, sans-serif; font-size: small; font-style: =
normal; font-weight: 400; word-spacing: 0px; white-space: normal; orphans: =
2; widows: 2; font-variant-ligatures: normal; font-variant-caps: normal; -w=
ebkit-text-stroke-width: 0px; text-decoration-thickness: initial; text-deco=
ration-style: initial; text-decoration-color:=20
initial;">Appointment Coord=
inator
34, 34, 34); text-transform: none; text-indent: 0px; letter-spacing: normal=
; font-family: Arial, Helvetica, sans-serif; font-size: small; font-style: =
normal; font-weight: 400; word-spacing: 0px; white-space: normal; orphans: =
2; widows: 2; font-variant-ligatures: normal; font-variant-caps: normal; -w=
ebkit-text-stroke-width: 0px; text-decoration-thickness: initial; text-deco=
ration-style: initial; text-decoration-color:=20
initial;">
t-family: Cambria, serif; font-size: 14pt;">
34, 34, 34); text-transform: none; text-indent: 0px; letter-spacing: normal=
; font-family: Arial, Helvetica, sans-serif; font-size: small; font-style: =
normal; font-weight: 400; word-spacing: 0px; white-space: normal; orphans: =
2; widows: 2; font-variant-ligatures: normal; font-variant-caps: normal; -w=
ebkit-text-stroke-width: 0px; text-decoration-thickness: initial; text-deco=
ration-style: initial; text-decoration-color:=20
initial;">GO KIA SOUTH
=3D"cid:unnamed.png" border=3D"0" hspace=3D"0" width=3D"355" height=3D"35">=
34, 34, 34); text-transform: none; text-indent: 0px; letter-spacing: normal=
; font-family: Arial, Helvetica, sans-serif; font-size: small; font-style: =
normal; font-weight: 400; word-spacing: 0px; white-space: normal; orphans: =
2; widows: 2; font-variant-ligatures: normal; font-variant-caps: normal; -w=
ebkit-text-stroke-width: 0px; text-decoration-thickness: initial; text-deco=
ration-style: initial; text-decoration-color:=20
initial;">3030 GA=
TEWAY BLVD | Edmonton, AB | T6J 6V4=
34, 34, 34); text-transform: none; text-indent: 0px; letter-spacing: normal=
; font-family: Arial, Helvetica, sans-serif; font-size: small; font-style: =
normal; font-weight: 400; word-spacing: 0px; white-space: normal; orphans: =
2; widows: 2; font-variant-ligatures: normal; font-variant-caps: normal; -w=
ebkit-text-stroke-width: 0px; text-decoration-thickness: initial; text-deco=
ration-style: initial; text-decoration-color:=20
initial;">Phone:&=
nbsp;780.465.3535 Ext. 37412
34, 34, 34); text-transform: none; text-indent: 0px; letter-spacing: normal=
; font-family: Arial, Helvetica, sans-serif; font-size: small; font-style: =
normal; font-weight: 400; word-spacing: 0px; white-space: normal; orphans: =
2; widows: 2; font-variant-ligatures: normal; font-variant-caps: normal; -w=
ebkit-text-stroke-width: 0px; text-decoration-thickness: initial; text-deco=
ration-style: initial; text-decoration-color:=20
initial;">