Nigerian Spam from Google Gmail Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 26 Feb 2026 10:37:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vvfHN-0000000006f-1xui

for dave@doctor.nl2k.ab.ca;

Thu, 26 Feb 2026 10:36:01 -0700

Resent-From: The Doctor

Resent-Date: Thu, 26 Feb 2026 10:36:01 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pg1-f179.google.com ([209.85.215.179]:50543)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vvbmw-00000000K3A-1zfy

for doctor@doctor.nl2k.ab.ca;

Thu, 26 Feb 2026 06:52:31 -0700

Received: by mail-pg1-f179.google.com with SMTP id 41be03b00d2f7-c70bb8ffb24so341031a12.1

for ; Thu, 26 Feb 2026 05:51:35 -0800 (PST)

ARC-Seal: i=1; a=rsa-sha256; t=1772113889; cv=none;

d=google.com; s=arc-20240605;

b=dJlYwpFRbnkvIQSYR0hCVr420wGtRXUnyop5mg+H+2dGYi9qJVEEF61ssa1MarsrZq

dgIetg6mvLATVI7cEAikG5jMc1yXg8o0o7wD2C1h+FjmNyqqCQ4noZ40BSci1ftj0Kwd

31JpxeDi65Yx1EDIwaMfKtGP2Iod8aKGcyvvm45GRiwU91U7ot4uyGGK2qFYG0pwmLY7

yHx4M/i2E69l4gi9mHXyCGwLoJIQERjt/6eX7cihbHyZK8+dFs5EWPG+5gorQ1QKPISU

hJW8+YoZvASLW34oYV91kq4AZxsu6tOQZg3w++ZCIxOyOEhZ43vBIuJm2B7HSxatDTAI

Whyw==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;

h=to:subject:message-id:date:from:reply-to:mime-version

:dkim-signature;

bh=inX+z7tP3pPAgc4pEgEQv4GNYCJcjkYI1F0HNRLzdgk=;

fh=5S0EQcyAGzaw4X1XortP9iVaBTV+kYJLA88wE11BhYg=;

b=SOZ8ETZYvvXAAoJO1A1fRUnhF4sotVPOzuNq3u4amT3I+qapV9qIv1gsYuVnsM7Z4t

REI3+R4GpBmWAzH0wQxwYtC5pH3OeJFldvIs/qc6KdwhdCRLiWRoTTL2MrtYbmIBxc7n

1BlHFnvW8XYS+ALN7ClG4q4Y8xyUtCt355pFaXKVwMhfK8F3FidgDtaKx+rOjH5MjhLa

U+HV+xMJX6/PG6ZToiDDMi7jOOSBkrIXqVoZxKRBxdUPO8zU7ORCQEtAWr+XSQ/ldncg

WKg5FhuTQAETGmHbtQGWX+TB6LO0xxd3aR0ICCMcpfsIXCZFlf1D/Fiz0883uu++u8Bw

8lcA==;

darn=doctor.nl2k.ab.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20230601; t=1772113889; x=1772718689; darn=doctor.nl2k.ab.ca;

h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc

:subject:date:message-id:reply-to;

bh=inX+z7tP3pPAgc4pEgEQv4GNYCJcjkYI1F0HNRLzdgk=;

b=Sk7xxjbqBZA79Jw3srCq/8psn6WCIHsTPvn55Hf+wmtVnw4jxPhJxEDsVVjFgNWPvw

nstXvGZhduMe5Go6z6gbC2SUOLI/bveuKBBcyveB6sFLUAFpH5VEgphxz45ZmSpsiAZv

+INXiZACj5CCc9Iq3wp/pXfubwcKKrvpgK0pTeCZ53YQGy8MaAIAcpq/3f+qBYUazeNI

ZeyTL8D/UaYIc2npCOdodcWnrk51pJrb7YzpCtxmVX9RR57V57jr9lnzzOhepk76L0+u

/pJQ3Owb9MifSNcx+Na8NDjdTirIMfO9vL/MgNHSRadd4yHKWlk/A+PdtuYs+4oLcSWP

i9tQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1772113889; x=1772718689;

h=to:subject:message-id:date:from:reply-to:mime-version:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=inX+z7tP3pPAgc4pEgEQv4GNYCJcjkYI1F0HNRLzdgk=;

b=F8lRn10PPR64iTh1aQku9/zEJzY2o3I/+TISAweLvwOo7fy62BijOgxC4RxVrXTO11

UkbA64OcZ7bAFAP7Nl8b0k1iX9WTMfx5nxZEfD+ypTp3PMgwWeWuvHcWMBmyOEz7Sqzn

rOniY2Eqd4Gt/2xTl5FEtb8oMOBw4mQJ9dZ6yQJRfuaVKMblgnM3bMEiXFGzp3qdeiFC

IkLwRSzp/Yj4Xb3igz+RNgO/1o2jopyG8e8fgCMP8zUGUKteTKNyL/EjUqB85gEoantX

VZkynCJIxFTLt8GmVB+9hi6RB/JRD4LUyJlPhBucA/xRDfoqvh/+uMVJG+qwMiwVFPVL

qriQ==

X-Forwarded-Encrypted: i=1; AJvYcCVlQy1rSy9MGlqacxbqdVyJ2zjzi1sPUNtDqVrMqNpJtNXq0u/ILS94luTDBPjw5FqHTNDJMss=@doctor.nl2k.ab.ca

X-Gm-Message-State: AOJu0YwD6QXq3IuQDOdpjljJg8ivbGqu78gVtxsqCg7OKYhCiRI8Wt06

z86XZN7e3KCt9nwOjusgJJaA4D83oGduhH6JdZ4tQb7UEflaU17wQb48PxTTVFYsa16E6dGao4a

POCjUu4uZEy6qKTNiG4Uqaqu5SqtkxQc=

X-Gm-Gg: ATEYQzwmY/XVVEr8+cIMhsvRPqL8kvQy38qZJyKengRQA+ygXhYBCedecNwdE5pRO6H

fgm3ero+Ut4sMqEv/XthN8l3aiNWYZlTxDOZHo1trEqdhkkNwvhY47nDDglvROlRR/N1jhikCyy

+n9Gtqlv3oy9K1dU6jmuUG2LYhGjIpuMAYIaBRp8HdrKjOJKEjuyGZziRQOtOHAu/P+pkIXlpcM

xQSCRVpUH72iOBEKok6Mn/WX1qUrXIyEyYfcDGgttADprFNbMOrjM/f/SZ0q4ooLwsI0BxEWli5

ji/S8A05Dap9rzjDfQl7WV5Ftzm55KUI7FxMPWQRAv5xqHAzcxymoiqanrPlHzl0sFdZ/Bkj23T

QQk3I0bl+wRQ=

X-Received: by 2002:a17:902:d2c2:b0:2a9:47ff:1020 with SMTP id

d9443c01a7336-2ade9972102mr31319575ad.8.1772113889064; Thu, 26 Feb 2026

05:51:29 -0800 (PST)

MIME-Version: 1.0

Reply-To: mmisszalanda@gmail.com

From: "Mis.Zalanda Mubarak"

Date: Thu, 26 Feb 2026 13:45:26 +0100

X-Gm-Features: AaiRm53KWHn-X-dWvVj14ArYXaPtuCgB_PYcXLc5AymBIpu8TWrlhIHeXXDdwzo

Message-ID:

Subject: Hi,

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="000000000000dbfc3b064bba6ad2"

Bcc: doctor@doctor.nl2k.ab.ca

X-Spam_score: 22.1

X-Spam_score_int: 221

X-Spam_bar: ++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Nice To Meet You, It's my pleasure to meet you,I humbly write

to solicit for your partnership and assistance with divine confidence that

you are a reliable and honest person who will be capable for this important

busin [...]



Content analysis details: (22.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.215.179 listed in will-spam-for-food.eu.org]

[209.85.215.179 listed in will-spam-for-food.eu.org]

[209.85.215.179 listed in will-spam-for-food.eu.org]

[209.85.215.179 listed in will-spam-for-food.eu.org]

[209.85.215.179 listed in will-spam-for-food.eu.org]

[209.85.215.179 listed in will-spam-for-food.eu.org]

[209.85.215.179 listed in will-spam-for-food.eu.org]

[209.85.215.179 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.215.179 listed in dnsbl.ahbl.org]

[209.85.215.179 listed in dnsbl.ahbl.org]

[209.85.215.179 listed in dnsbl.ahbl.org]

[209.85.215.179 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.215.179 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.215.179 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.215.179 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.215.179 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.215.179 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[mubarakzalanda779(at)gmail.com]

Web/SEO/App spam from Google Gmail Part 2

Posted by Dave Yadallee on
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.214.193 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.214.193 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.214.193 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.214.193 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.214.193 listed in list.dnswl.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[2401:4900:1c62:ab65:bdda:a4d7:448d:7429 listed]

[in sbl-xbl.spamhaus.org]

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Listed by XBL, see ]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: fusion360.agency]

0.4 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[209.85.214.193 listed in bl.score.senderscore.com]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.214.193 listed in bl.score.senderscore.com]

0.9 PRICES_ARE_AFFORDABLE BODY: Message says that prices aren't too

expensive

0.7 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[209.85.214.193 listed in sa-accredit.habeas.com]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.1 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The

query to Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[209.85.214.193 listed in sa-trusted.bondedsender.org]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.214.193 listed in wl.mailspike.net]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} Designer\Developer



This is a multi-part message in MIME format.



------=_NextPart_000_2B9E0_01DCA73E.E9DF2AC0

Content-Type: text/plain;

charset="us-ascii"

Content-Transfer-Encoding: 7bit



Hello,



I'm reaching out to see if there is anything that would like to create

Shopify & Wordpress, upgrade, repair, or redesign on your website or Mobile

App.



I am a web designer/developer that can do just about anything you can

imagine at very affordable prices.



If interested. May I send you sample, Portfolio and company Details?



Thank you for your time and consideration.



Kind Regards,

Aarti





------=_NextPart_000_2B9E0_01DCA73E.E9DF2AC0

Content-Type: text/html;

charset="us-ascii"

Content-Transfer-Encoding: quoted-printable




xmlns:o=3D"urn:schemas-microsoft-com:office:office" =

xmlns:w=3D"urn:schemas-microsoft-com:office:word" =

xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" =

xmlns=3D"http://www.w3.org/TR/REC-html40">
HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; =

charset=3Dus-ascii">
(filtered medium)">

class=3DWordSection1>

Hello,

I'm reaching =

out to see if there is anything that would like to create Shopify & =

Wordpress, upgrade, repair, or redesign on your website or Mobile =

App.

I am a web designer/developer that can do just about =

anything you can imagine at very affordable prices.

If =

interested. May I send you sample, Portfolio and company =

Details?

Thank you for your time and consideration.

Kind =

Regards,
Aarti



------=_NextPart_000_2B9E0_01DCA73E.E9DF2AC0--



Web/SEO/App spam from Google Gmail Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 26 Feb 2026 04:52:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vvZth-00000000EnB-2Y7i

for dave@doctor.nl2k.ab.ca;

Thu, 26 Feb 2026 04:51:13 -0700

Resent-From: The Doctor

Resent-Date: Thu, 26 Feb 2026 04:51:13 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pl1-f193.google.com ([209.85.214.193]:44088)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vvZJ7-00000000C6c-0biZ

for sales@nk.ca;

Thu, 26 Feb 2026 04:13:33 -0700

Received: by mail-pl1-f193.google.com with SMTP id d9443c01a7336-2adc1d9ec56so4915915ad.0

for ; Thu, 26 Feb 2026 03:12:38 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=fusion360.agency; s=google; t=1772104352; x=1772709152; darn=nk.ca;

h=content-language:thread-index:mime-version:message-id:date:subject

:to:from:from:to:cc:subject:date:message-id:reply-to;

bh=yAFAHvR5FrXQYi0N3ytYYrH3/fqd0DQooklnKbN48YI=;

b=uWjZmb9vUVCdLM5/YbGC0Sh/kdQFt+Jktk3YQ2kgoiQe2em+rKahN/Asp7ZgtEbTN2

/iD+rEoXTrBeh9/oBTsA9zOIqxv8cbaRTDBF8KdG5IoCWwFV32vZaILG14J5t6EoNEnv

OPAZJchZBLrmGRwjusN7dlCDsiKhzLqGT+BZGaoBlCo1sdCfk+h5itRKv6+xXdcad2RZ

DY3rBAk60oIQD/KWKnawhY7IK0HkuPjOY3yQ47tX7CjwSc/6z4DxhmYx9M4PIZK3F5Hy

eBZfAp3WvBnd1/tSzmd6fNgW8s8xDEe6XduWuGSie7C1BcI2cLfRJeqqYdZqpdzixNBo

pYlQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1772104352; x=1772709152;

h=content-language:thread-index:mime-version:message-id:date:subject

:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to;

bh=yAFAHvR5FrXQYi0N3ytYYrH3/fqd0DQooklnKbN48YI=;

b=LahOu+j/534YlB/VEqLu3U5EEX/hjnPXrAdw/ePAXyzcuNVbXaMmvHOMwBtottbDV0

HLfj6JcBEwBrCPq4JPJWogVPatB+JikCMUXl3kJdeQyPGfkse0BIQZKRc8Hvc9xIqQHt

LSR/4irByZTkax3CrUatg7O6GqPPozGzO/crVr44Qq0H/Vn00Dpbx3EcnXavC+yYRMLq

+yOZjqlD+RP9c+BArDQbBJPFjJA9978axgytWEPkpIFk5s/Y/0V0ePFuhw3rjHrLlYFh

8eZE+pra1uzcbeSjB/szspFBi4dPMWBL8v/xwY22T4nylgibVt9phymcVT4+/K2JVl+V

MfLQ==

X-Gm-Message-State: AOJu0Yzsy201Ur43Cb6z99DcPzl9ZIZNhvPku++AnUSSkNdGCK/+uL85

+bS8OB4/cjYFklqr+sIhgbCHxSvNmxJzgVfPRUtuYHKksZdiixFquHfogzASpIW6naYqnBKghrv

kQzJXiBM=

X-Gm-Gg: ATEYQzynsNgNAHmRxZYpFXWMpjEv7kuBRs7yOOITKH+o+avncbQsZSoc8rfaLJ6tJlp

makxYEhci4E2B3EzcnQN9pH3QOHWrkDSijgrY9YFghs/Js4UjNK+aC/blrhJ6nn9U6iDx2WN6TC

pktCyXusb4RpiW9Jq9hcqq8OktlOeU0+zFbJ4zVDTK+hwrSnEIsdre/vluILVEM+FgjKdDmmlyS

vbTuM43z8zRYCDCZFWY7/Dnb26ivUsDVEsfsKMJqL3IA3bzwLFbyF2pddENICCnrBBQFADTuGAJ

rq+wT5K0QAaLB3Nz4LWrapAFzwml34JeHyZV59LjDYO0Wp6BXdDjboEtkenrg9noc0TxEUEP1Kq

1p6nVKqQbuG8XX8id+SNWbIeYMSe+gDPP3mvVqrEhoyv5Gshhb9ogr3b1PptUxINcAJMoeFZEFY

WrGFVSZJ4dd+8rQc+l8IlCVU6EhYag87E7hirGPr6V+QoFXQY=

X-Received: by 2002:a17:903:1b6e:b0:2a9:6165:6e88 with SMTP id d9443c01a7336-2ad742b4ddemr169807785ad.0.1772104351752;

Thu, 26 Feb 2026 03:12:31 -0800 (PST)

Received: from Kanhaiya ([2401:4900:1c62:ab65:bdda:a4d7:448d:7429])

by smtp.gmail.com with ESMTPSA id d9443c01a7336-2adfb5dbaafsm28684455ad.36.2026.02.26.03.12.30

for

(version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);

Thu, 26 Feb 2026 03:12:31 -0800 (PST)

From: "Aarti"

To:

Subject: Designer\Developer

Date: Thu, 26 Feb 2026 16:39:27 +0530

Message-ID: <2b9df01dca710$d026eec0$7074cc40$@agency>

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="----=_NextPart_000_2B9E0_01DCA73E.E9DF2AC0"

X-Mailer: Microsoft Office Outlook 12.0

Thread-Index: Adym4fXos91YjO6tR8aKJ3HrN9MX7w==

Content-Language: en-us

X-Spam_score: 9.8

X-Spam_score_int: 98

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hello, I'm reaching out to see if there is anything that would

like to create Shopify & Wordpress, upgrade, repair, or redesign on your

website or Mobile App. I am a web designer/developer that can do just about

anything you can imagine at very affordable prices.



Content analysis details: (9.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[2401:4900:1c62:ab65:bdda:a4d7:448d:7429 listed]

[in will-spam-for-food.eu.org]

[2401:4900:1c62:ab65:bdda:a4d7:448d:7429 listed]

[in will-spam-for-food.eu.org]

[2401:4900:1c62:ab65:bdda:a4d7:448d:7429 listed]

[in will-spam-for-food.eu.org]

[2401:4900:1c62:ab65:bdda:a4d7:448d:7429 listed]

[in will-spam-for-food.eu.org]

[2401:4900:1c62:ab65:bdda:a4d7:448d:7429 listed]

[in will-spam-for-food.eu.org]

[2401:4900:1c62:ab65:bdda:a4d7:448d:7429 listed]

[in will-spam-for-food.eu.org]

[2401:4900:1c62:ab65:bdda:a4d7:448d:7429 listed]

[in will-spam-for-food.eu.org]

[2401:4900:1c62:ab65:bdda:a4d7:448d:7429 listed]

[in will-spam-for-food.eu.org]

[209.85.214.193 listed in will-spam-for-food.eu.org]

[209.85.214.193 listed in will-spam-for-food.eu.org]

[209.85.214.193 listed in will-spam-for-food.eu.org]

[209.85.214.193 listed in will-spam-for-food.eu.org]

[209.85.214.193 listed in will-spam-for-food.eu.org]

[209.85.214.193 listed in will-spam-for-food.eu.org]

[209.85.214.193 listed in will-spam-for-food.eu.org]

[209.85.214.193 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.214.193 listed in dnsbl.ahbl.org]

[209.85.214.193 listed in dnsbl.ahbl.org]

[209.85.214.193 listed in dnsbl.ahbl.org]

[209.85.214.193 listed in dnsbl.ahbl.org]

[2401:4900:1c62:ab65:bdda:a4d7:448d:7429 listed]

[in dnsbl.ahbl.org]

[2401:4900:1c62:ab65:bdda:a4d7:448d:7429 listed]

[in dnsbl.ahbl.org]

[2401:4900:1c62:ab65:bdda:a4d7:448d:7429 listed]

[in dnsbl.ahbl.org]

[2401:4900:1c62:ab65:bdda:a4d7:448d:7429 listed]

[in dnsbl.ahbl.org]

Russian Funding Offer spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 26 Feb 2026 04:51:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vvZtM-00000000El8-1osq

for dave@doctor.nl2k.ab.ca;

Thu, 26 Feb 2026 04:50:52 -0700

Resent-From: The Doctor

Resent-Date: Thu, 26 Feb 2026 04:50:52 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from send80.i.mail.ru ([89.221.237.175]:52368)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vvZ7U-00000000B7X-45gI

for sales@nk.ca;

Thu, 26 Feb 2026 04:01:34 -0700

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=mail.ru;

s=mail4; h=Content-Type:MIME-Version:Message-ID:Date:Subject:To:From:Reply-To

:From:Sender:To:Cc:Content-Type:Content-Transfer-Encoding:Content-ID:

Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc

:Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:

List-Subscribe:List-Post:List-Owner:List-Archive:X-Cloud-Ids:

Disposition-Notification-To; bh=NlgFg2YCjgLNN1naaygQxaxKoQXWlTLtFcmLlfGBIRA=;

t=1772103685; x=1772193685; b=nz7Gt4QWked83FvQgqqKNjxJylDug9r1u2GDbOP3cUgH1bA

WNYqs1wuv1HXKaoGZdrNFAJ9zQTR4UBE6JWDhggFtoPk3vAaB1lcTyUw8zNX1CFOWD0F+VoKCEXdU

j170zJ/DGZeBAGsaJjOn4maRbIF9/6sFAiSQayE1tjZq6Io0pDcW1Uog/Vgr9Tz3vyuDwlYvsAzdV

7k4fpMbveBrkiWyTzJsTZTDKG+IjJb84lnIqlF0e03TxaEgwQOY2LEPTeksomwrJDRuvMoRDyyoiC

FrXFVaQjcuhoURZAiUkNaeTRGWONhEic/Qr/absfx/4cij/UpMJ6c5ucW+5cAsmQ==;

Received: by exim-smtp-64fd7cf497-rndkc with esmtpa (envelope-from )

id 1vvZ6a-00000000Jrk-2E2u

for sales@nk.ca; Thu, 26 Feb 2026 14:00:29 +0300

Thread-Topic: Funding Offer

thread-index: AdynDx5GtgtEBI8uQIGIMEs+f3NOIA==

Reply-To:

From: =?utf-8?Q?Dr. Allen Payne?=

To:

Subject: Re: Funding Offer

Date: Thu, 26 Feb 2026 03:00:28 -0800

Message-ID:

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="----=_NextPart_000_68FB5_01DCA6CC.10259570"

X-Mailer: Microsoft CDO for Windows 2000

Content-Class: urn:content-classes:message

Importance: normal

Priority: normal

X-MimeOLE: Produced By Microsoft MimeOLE

Authentication-Results: exim-smtp-64fd7cf497-rndkc; auth=pass smtp.auth=info@grantrexx.biz smtp.mailfrom=info@grantrexx.biz

X-Mailru-Src: smtp

X-7564579A: 646B95376F6C166E

X-77F55803: 4F1203BC0FB41BD9A6EFB945BF0DEAB20ACC6F3AE0F06561C621EBC98BBAA047182A05F5380850407C65FFA07A6ABE9B3DE06ABAFEAF67058E7CE182ACC3834A8F534FB60CB164DFDAF06271CF5AE1BC

X-7FA49CB5: FF5795518A3D127A4AD6D5ED66289B5278DA827A17800CE7492D3E4238663367EA1F7E6F0F101C67BD4B6F7A4D31EC0BCC500DACC3FED6E28638F802B75D45FF8AA50765F7900637D0444E075A9D99C18638F802B75D45FF914D58D5BE9E6BC1A93B80C6DEB9DEE97C6FB206A91F05B2ABE325B1273D56602E070BE324C7D3C449A65EDB7D1CC277F6B57BC7E64490618DEB871D839B73339E8FC8737B5C224969875440691429F6CC7F00164DA146DAFE8445B8C89999729449624AB7ADAF37F6B57BC7E64490611E7FA7ABCAF51C92176DF2183F8FC7C0A633E4711A430BBE8941B15DA834481F9449624AB7ADAF37BA3038C0950A5D3613377AFFFEAFD269176DF2183F8FC7C03AB84EEFC75A4FAC7B076A6E789B0E97A8DF7F3B2552694AD5FFEEA1DED7F25D49FD398EE364050F9647ADFADE5905B1BFC1D8BB4B114D1EB3661434B16C20ACC84D3B47A649675FE827F84554CEF5019E625A9149C048EE9ECD01F8117BC8BEE2021AF6380DFAD18AA50765F790063735872C767BF85DA227C277FBC8AE2E8BD5DDBEEAE3B12F1775ECD9A6C639B01B4E70A05D1297E1BBCB5012B2E24CD356

X-C1DE0DAB: 0D63561A33F958A5B6B1BA73343BB9395002B1117B3ED6962EFD33738BB5FB6FC81EEE05487B0209823CB91A9FED034534781492E4B8EEAD4ECBDE8281F904F9BDAD6C7F3747799A

X-C8649E89: 1C3962B70DF3F0AD73CAD6646DEDE1918E10F71CB4DF9F9677DD89D51EBB774225B6776AC983F447FC0B9F89525902EE6F57B2FD27647F25E66C117BDB76D659DB9344C414EF18190BF7CFF92CC50085EEFD1740F9261B5C45B374040EAAE35994AFA10B9365FD5DB8341EE9D5BE9A0A556C514F84802D66908A8285DC1B0658F4CDB0861D994E8A52EE4E5D9E54FDA44C41F94D744909CE22316FEE5BB4DDADEED432305CE53D9DC2A3E5EA76A2126D43082AE146A756F3

X-D57D3AED: 3ZO7eAau8CL7WIMRKs4sN3D3tLDjz0dLbV79QFUyzQ2Ujvy7cMT6pYYqY16iZVKkSc3dCLJ7zSJH7+u4VD18S7Vl4ZUrpaVfd2+vE6kuoey4m4VkSEu53w8ahmwBjZKM/YPHZyZHvz5uv+WouB9+ObcCpyrx6l7KImUglyhkEat/+ysWwi0gdhEs0JGjl6ggRWTy1haxBpVdbIX1nthFXMZebaIdHP2ghjoIc/363UZI6Kf1ptIMVbwN8XFWZxQUPW/TuFCSi0A=

X-Mailru-Sender: 2B3E4445EA68B43A3A46F4EC1D982E4A8EBFFCD5802D37F787A35C9C7BBE74BE34258F36142990DFD013D1570D50D84A11C27C7EB68385A5D63E4CEE33A6911280919091D61198E03E85AF46D4829C6D3F29D7578806BE9E5FEEDEB644C299C0ED14614B50AE0675

X-Mras: Ok

X-Spam_score: 7.1

X-Spam_score_int: 71

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Greetings, are you still seecking finance ? My name is Dr.

Allen Payne. I am a financial consultant and loan broker, helping business

owners and entrepreneurs secure loan funding for startup projects and growth

capital.



Content analysis details: (7.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[89.221.237.175 listed in will-spam-for-food.eu.org]

[89.221.237.175 listed in will-spam-for-food.eu.org]

[89.221.237.175 listed in will-spam-for-food.eu.org]

[89.221.237.175 listed in will-spam-for-food.eu.org]

[89.221.237.175 listed in will-spam-for-food.eu.org]

[89.221.237.175 listed in will-spam-for-food.eu.org]

[89.221.237.175 listed in will-spam-for-food.eu.org]

[89.221.237.175 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[89.221.237.175 listed in dnsbl.ahbl.org]

[89.221.237.175 listed in dnsbl.ahbl.org]

[89.221.237.175 listed in dnsbl.ahbl.org]

[89.221.237.175 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[89.221.237.175 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[89.221.237.175 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[89.221.237.175 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[89.221.237.175 listed in dnsbl.ahbl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.1 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The

query to Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[89.221.237.175 listed in sa-trusted.bondedsender.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

0.7 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[89.221.237.175 listed in sa-accredit.habeas.com]

0.4 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[89.221.237.175 listed in bl.score.senderscore.com]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[89.221.237.175 listed in bl.score.senderscore.com]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.0 BAD_ENC_HEADER Message has bad MIME encoding in the header

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 MIME_HTML_MOSTLY BODY: Multipart message mostly text/html MIME

0.7 MPART_ALT_DIFF BODY: HTML and text parts are different

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_HK_NAME_DR No description available.

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

2.0 MIXED_HREF_CASE Has href in mixed case

Subject: {SPAM?} Re: Funding Offer



Greetings, are you still seecking finance ?



My name is Dr. Allen Payne. I am a financial consultant and loan broker, helping business owners and entrepreneurs secure loan funding for startup projects and growth capital.



I’m currently working with a finance company that is actively seeking projects or businesses to fund.



This investors offers various types of loans at competitive interest rates, ranging from 2% to 7% per annum, depending on the loan structure. Feel free to contact me for further information following the below email addresses.



Regards,



Allen Payne

Financial Consultant Services

Personal Email : allenpayne.funds@gmail.com

Office Email : info@allenpaynefinancialconsultant.com



Who's Who spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 26 Feb 2026 04:50:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vvZrs-00000000Ee5-14T3

for dave@doctor.nl2k.ab.ca;

Thu, 26 Feb 2026 04:49:20 -0700

Resent-From: The Doctor

Resent-Date: Thu, 26 Feb 2026 04:49:20 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from fenicemedia-smtp7.myhyve.com ([5.255.58.143]:53010)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vvUMo-000000004Bi-0h8N

for sales@nk.ca;

Wed, 25 Feb 2026 22:57:06 -0700

Received: from fenicemediawin7.myhyve.com (unknown [172.19.12.98])

(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))

(Client did not present a certificate)

by fenicemedia-smtp7.myhyve.com (Postfix) with ESMTPSA id 92B82315E1CA

for ; Thu, 26 Feb 2026 04:39:42 +0000 (GMT)

MIME-Version: 1.0

From: "Sophie Baker"

Reply-To: sophie@prestigeawardsguide.co.uk

To: sales@nk.ca

Subject: Canada Prestige Awards 2026

Content-Type: multipart/related;

type="text/html";

boundary="----=_NextPart_001_52BB_66FA2DB9.34B31D11"

X-Mailer: Smart_Send_4_4_2

Date: Thu, 26 Feb 2026 04:39:42 +0000

Message-ID: <6028474260640325833367@fenicemediawin7>

X-Spam_score: 25.2

X-Spam_score_int: 252

X-Spam_bar: +++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi The nomination stage of our Canada Prestige Awards 2026

is open and we would like to invite to you to take part.



Content analysis details: (25.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[5.255.58.143 listed in will-spam-for-food.eu.org]

[5.255.58.143 listed in will-spam-for-food.eu.org]

[5.255.58.143 listed in will-spam-for-food.eu.org]

[5.255.58.143 listed in will-spam-for-food.eu.org]

[5.255.58.143 listed in will-spam-for-food.eu.org]

[5.255.58.143 listed in will-spam-for-food.eu.org]

[5.255.58.143 listed in will-spam-for-food.eu.org]

[5.255.58.143 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[5.255.58.143 listed in dnsbl.ahbl.org]

[5.255.58.143 listed in dnsbl.ahbl.org]

[5.255.58.143 listed in dnsbl.ahbl.org]

[5.255.58.143 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[5.255.58.143 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[5.255.58.143 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[5.255.58.143 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[5.255.58.143 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

15 GR_DOMAIN_SILLYS1 Spammer tool signature (sillysend)

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)

1.0 OPT_OUT BODY: No description available.

1.6 HTTP_ESCAPED_HOST URI: Uses %-escapes inside a URL's hostname

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.8 HTML_IMAGE_RATIO_02 BODY: HTML has a low ratio of text to image area

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

Subject: {SPAM?} Canada Prestige Awards 2026



Hi



The nomination stage of our Canada Prestige Awards 2026 is open and we would

like to invite to you to take part.



We are reviewing submissions for companies, individuals, products

and services. The awards are open to all SMEs who provide a product

or service to people or businesses in Canada and therefore can

of course be based in other regions.



After the decision making is completed then all winners will be invited to our

annual awards event. This gives all of those involved an opportunity to

network, meet the judges and take part in promotional press activities which

we organise for winners and their guests. All of which is arranged on a

complimentary basis.



The Prestige Awards provide the latest news and developments in a variety

of industries. Content is available in hard copy print media as well

as online features, interviews, competitions and much more. The awards

recognise the important work of SME’s and celebrate their many successes

and outstanding service over the year.



To learn more about the media platform then please visit www.prestigeawardsguide.co.uk



If you wish to access any subscriber-only content on the website

then please let me know and I will provide this on a complimentary basis.



What do I need to do?



Please reply back to us confirming you wish to be considered in this

year’s programme.



After we receive your acceptance, you will be placed on the list

of shortlisted nominees. Once the allocation of nominations is met,

all organisations within that particular category are then passed

to our panel of industry expert judges who will ultimately pick a winner.

Publicly sourced information is used such as reviews, testimonials,

information on the company’s website as well as social media accounts.



Questionnaire & Categories



During the nomination process we give companies and individuals the

opportunity to specify the categories they wish to be considered for.

We also provide all nominees with the opportunity to submit additional

information that may support them being successful in the awards. This

could include details on the company, new projects, positive media

attention/ other recognition or direct us to online testimonials

and customer reviews. This may all have a positive impact on the

decision making. Please fill in the short questionnaire provided

and include any information you feel relevant.



The questionnaire will be provided once you confirm your participation.



Tell me more about the award programme & who votes



Every year, we invite companies to talk to us about themselves and provide

information on why they are worthy of recognition in the awards. We receive

submissions from SMEs in all industries who provide products and services

to the region. The judges pick a selection of winners in a range of categories.



The awards are a free to enter programme that provide exposure to subscribers

looking for information on the very best companies and services.



Once the submissions have been reviewed then winners will be notified by a member

of the awards team. Each winner will receive coverage in the awards magazine

as well as the website, press releases and will be able to attend the free

winner’s event. As previously highlighted, this will give each winner

the opportunity to network with other winners, meet the judges and have

a photo-shoot with their teams.



For more information on events then please visit our website



Are there any costs?



Unlike many award programmes, we offer no options for companies or individuals

to make any financial contributions prior to this year’s decisions being made.

This includes the booking of advertorial space or partnership opportunities

of any kind.



Winners are chosen by our independent panel made up of select industry experts

and our editor-in-chief. This ensures the most deserving are picked each year

and decisions cannot be influenced by current relationships.



Not for this year



Although we make every effort to only approach organisations which are relevant to

the award categories, we are running this year, you may feel the timing isn’t right

for you are the moment. We do not wish to contact people who would rather not

be considered so please do let us know if that is the case. You will then be

immediately removed and not contacted again about the opportunity.



I do hope we can consider you in the programme and I would be happy to answer any

other questions you may have.



Kind regards,



Sophie Baker



Awards Coordinator



Landline: +44 (0) 121 638 0411



sophie@prestigeawardsguide.co.uk



(555CND111454) This e-mail and any attachments are intended for

the above named only and may be confidential. If they have come

to you in error, you must take no action based on them, nor must

you copy or show them to anyone; please reply to the e-mail

and highlight the error. Corporate Livewire may monitor outgoing

and incoming e-mails. By replying to this e-mail, you give your

consent to such monitoring.



To opt out of further communication, please reply to this email

with "opt out." You can also opt out directly through the website

by clicking on this Link.

iPhone Paypal phish from Google Gmail Part 4

Posted by Dave Yadallee on

/InformAction">
emtype=3D"http://schema.org/EmailMessage">
ntent=3D"Joseph Hornyak: 2026-02-26 Bill: 376-OVFC-ZPJ Reference Number: 75=

297844 We have recorded your recent order. Good day, we=E2=80=99re glad to =

confirm your recent purchase from PayPal. Your payment has been received an=

d the order is now scheduled for processing. Below are the transaction deta=

ils: Transaction Details: Item: iPhone 17 Pro Quantity: 1x Payment Method: =

PayPal Total Amount: $1101.77 For further assistance, please connect with o=

ur team using the contact details below. Orders can be canceled within 24 h=

ours by calling 1{863} 409-5218. =C2=A9 2025 PayPal LLC =E2=80=93 All right=

s reserved. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .=

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . =

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .=

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . =

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .=

. . . ."/>
hema.org/Event">
/EventScheduled"/>
/schema.org/Organization">
r"/>
0r957kusnagd68k"/>
; line-height: 1px; height: 0; max-height: 0; width: 0; max-width: 0; opaci=

ty: 0; overflow: hidden;" itemprop=3D"name">Payment confirmation for Invoic=

e available
pacing=3D"0" role=3D"presentation" align=3D"center" style=3D"width:100%;" c=

lass=3D"body-container">

>
 

0" cellspacing=3D"0" role=3D"presentation" align=3D"center" style=3D"width:=

100%;" class=3D"">

itemscope itemtype=3D"http://schema.org/EmailMessage">


iption">2026-02-26
Bill: 376-OVFC-ZPJ
Reference Number: 75297844

We=

have recorded your recent order.

Good day, we=E2=80=99re glad to confirm=

your recent purchase from PayPal.

Your payment has been received and the=

order is now scheduled for processing.
Below are the transaction deta=

ils:

Transaction Details:
Item: iPhone 17 Pro
Quantity: 1x
P=

ayment Method: PayPal
Total Amount: $1101.77

For further assistance,=

please connect with our team using the contact details below.
Orders =

can be canceled within 24 hours by calling 1{863} 409-5218.

© 2025 =

PayPal LLC =E2=80=93 All rights reserved.
.
.
.
.
.
.
=

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
=

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
=

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
=

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
=

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
=

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
=

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
=

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
=

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
=

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
=

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
=

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.

=


spacing=3D"0" role=3D"presentation" align=3D"center" style=3D"width:100%;" =

class=3D"">

: 8px; direction: rtl; font-size: 0; padding: 24px 32px; text-align: left; =

vertical-align: top;" class=3D"main-container-inner">

direction: ltr; display: inline-block; vertical-align: top; width: 100%;ove=

rflow: hidden; word-wrap: break-word;">
" cellspacing=3D"0" role=3D"presentation" width=3D"100%" class=3D"main-colu=

mn-table-ltr" style=3D"padding-right: 32px; padding-left: 0;;table-layout: =

fixed;">

l-align:top;">
=3D"presentation" width=3D"100%" style=3D"table-layout: fixed;">

le=3D"font-size: 0; padding: 0; text-align: left; word-break: break-word;;p=

adding-bottom:2px;">

o, sans-serif;font-weight: 400; font-size: 22px; line-height: 28px;color: #=

3c4043; text-decoration: none;" class=3D"primary-text" role=3D"presentation=

">Payment confirmation for Invoice available=


; word-break: break-word;;padding-bottom:24px;">

Roboto, sans-serif;font-style: normal; font-weight: 400; font-size: 14px; l=

ine-height: 20px; letter-spacing: 0.2px;color: #3c4043; text-decoration: no=

ne;" class=3D"primary-text" role=3D"presentation">
">Wedne=

sday Feb 25 =E2=8B=85 11pm =E2=80=93 Thursday Feb 26, 2026 =E2=8B=85 10:30p=

m (Central Time - Chicago)

: 0; padding: 0; text-align: left; word-break: break-word;;padding-bottom:2=

4px;">

t-weight: 400; font-size: 14px; line-height: 20px; letter-spacing: 0.2px;co=

lor: #3c4043; text-decoration: none;" class=3D"primary-text" role=3D"presen=

tation">
sentation" style=3D"padding-bottom: 4px;">


" style=3D"font-size: 14px;color: #3c4043; text-decoration: none;font-weigh=

t: 700;-webkit-font-smoothing: antialiased;margin: 0; padding: 0;">Organize=

r


nslate">
ne-block;;color: #3c4043; text-decoration: none;" href=3D"mailto:seda199689=

@noatwm.org">Joseph Hornyak
e itemtype=3D"http://schema.org/Person">
Joseph Hornyak"/>
/>

ign: left; word-break: break-word;;padding-bottom:24px;">

-family: Roboto, sans-serif;font-style: normal; font-weight: 400; font-size=

: 14px; line-height: 20px; letter-spacing: 0.2px;color: #3c4043; text-decor=

ation: none;" class=3D"primary-text" role=3D"presentation">
"0" cellpadding=3D"0" cellspacing=3D"0" role=3D"presentation" style=3D"padd=

ing-bottom: 4px;">


px;color: #3c4043; text-decoration: none;font-weight: 700;-webkit-font-smoo=

thing: antialiased;margin: 0; padding: 0;">Guests

(Gu=

est list has been hidden at organizer's request)

d>

d>

l>

--000000000000aeae0a064bab49ac--

iPhone Paypal phish from Google Gmail Part 3

Posted by Dave Yadallee on




=20



=20

















iPhone Paypal phish from Google Gmail Part 2

Posted by Dave Yadallee on

schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-microsoft-com:office:offi=

ce">
t=3D"text/html; charset=3DUTF-8">
=3Ddevice-width,initial-scale=3D1">
ight dark">





















=20



=20

iPhone Paypal phish from Google Gmail Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 25 Feb 2026 16:27:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vvOH4-000000005W8-0mNh

for dave@doctor.nl2k.ab.ca;

Wed, 25 Feb 2026 16:26:34 -0700

Resent-From: The Doctor

Resent-Date: Wed, 25 Feb 2026 16:26:34 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ot1-f74.google.com ([209.85.210.74]:58504)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vvKsq-00000000AUY-1qAh

for root@doctor.nl2k.ab.ca;

Wed, 25 Feb 2026 12:49:30 -0700

Received: by mail-ot1-f74.google.com with SMTP id 46e09a7af769-7d194b631d6so101648337a34.0

for ; Wed, 25 Feb 2026 11:48:33 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=google.com; s=20230601; t=1772048908; x=1772653708; darn=doctor.nl2k.ab.ca;

h=from:subject:date:message-id:sender:reply-to:mime-version:from:to

:cc:subject:date:message-id:reply-to;

bh=fkLYrUF273UxN1KnL6coedgI+Zo8V27wCw+PndtcrV4=;

b=QNf0uPXucYWYcyxW8zIh66RnQhF7546Ygn/evB8T3krzeenupSkcV0nSgBHWbOkIWt

8pFRv9OTaUPjUXBgAy25x08v4JgKhmw9gDFBO4rcv/EtVpM1qm+b96KrUgXHxDUXR3+7

RMWT5vmOTfO3NRKgOBccsFQTVyND1NKUSAbTJ/6QcEod4XyIyJlwVSo9USFzGpb7FJjg

erLWrszCYa+i3c6IFh78Qkk1AvXFONBYFWQ+XU055C7sQQWvMZVeN4FG/9eertG0OQRr

fcgGFpMOFBkw5GcxIRVm2saKEs8J2R8TBnicQY1XD/K8ung8cfsQlfIrqDD7qdiYD8Aw

3/qA==

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=noatwm-org.20230601.gappssmtp.com; s=20230601; t=1772048908; x=1772653708; darn=doctor.nl2k.ab.ca;

h=from:subject:date:message-id:sender:reply-to:mime-version:from:to

:cc:subject:date:message-id:reply-to;

bh=fkLYrUF273UxN1KnL6coedgI+Zo8V27wCw+PndtcrV4=;

b=gjKdNoJK3xCS1308jMmNSF7A1HFr3YKEiz7aJDe6Gryfr50xZn/bRRNdeu2velfpno

s7hYzs/QnRl3c7C0AMubn9nN7HcFg8CMaYcJMLJE4ZAMndJbcr24+hPmBWEJQCvjhGmK

7EINOJ1/1Y/Zu/8vJ5rh78mz8xisaqDV6+BRIZi6cwJ0JD3hDN/sUxYUg8ES7/uG/s7t

8z5jLTCz7QPDNF97NOgVyK4XXTDnIHYenvKv7Rl9mFjhf/4FGQgszeayh4DE7CcBvIpy

LAAjjyEnWHuWAFByMbcbhsRhCOlqSPzhzJ17ZvyfZwpZZNlM1RaXz059idoqzyoAH2Z8

Mc2A==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1772048908; x=1772653708;

h=from:subject:date:message-id:sender:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=fkLYrUF273UxN1KnL6coedgI+Zo8V27wCw+PndtcrV4=;

b=hxEVsyzrwZLySXH6MLqHXGobp+oUL56UqR3kzAjlVdkGIig8LL0PrbE981pUXHGcFk

5Guc+O9uxtbEqGBoNu4pTMkA2EAoaLAiJHtb5z5HtwAmv3nQevy7A8eEgceHXue09ZMg

XZrMh8aNvN4E9lztT8gR7D+TDbS1TpKPbPlWuM5w9fHH6LpVhDGq+HaJVCdoNDkdNaBz

+JtHdt4XjzL3ws6E7KRfojfuztZDo/a1XaGukJhvo5gALQ2ZqzBpjIu3/Em3Fuke1mIo

z0Hfk6cd49vMjtzsR3gWGbO7jmroz32ZI8GsWaJjG+G9AIFWQK9tOUKiFgIYjy4GIkOv

ePYA==

X-Forwarded-Encrypted: i=1; AJvYcCU2X2Ht3BcxSzJEZe9pj7iNBWlgv2lEiH8yk5qRqpkwZU6bl1mnOtpPCWCCqGIaTFBPRDJN@doctor.nl2k.ab.ca

X-Gm-Message-State: AOJu0Yw9s4V2e6mh/E6xPr4uovj+HSAP7xb0b4gtMr3NcqrxtLBMrZBh

Wj3NsLcQOiIdYXJqwjG67X3gA+7Yo4Df8UAaPPnFSdr4uMusDRJhrBcShV5x0RtEAe4khQvT2DT

FygQ0UPmlryCwFrn02MDgJc5zb93M6AP78fIT0+rYcxUkhw==

MIME-Version: 1.0

X-Received: by 2002:a05:6830:6c11:b0:7d4:9d6f:2b5c with SMTP id

46e09a7af769-7d52be444admt15938383a34.12.1772048907702; Wed, 25 Feb 2026

11:48:27 -0800 (PST)

Reply-To: Joseph Hornyak

Sender: Google Calendar

Message-ID:

Date: Wed, 25 Feb 2026 19:48:27 +0000

Subject: Payment confirmation for Invoice available

From: Joseph Hornyak

Content-Type: multipart/alternative; boundary="000000000000aeae0a064bab49ac"

X-Spam_score: 12.8

X-Spam_score_int: 128

X-Spam_bar: ++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: 2026-02-26 Bill: 376-OVFC-ZPJ Reference Number: 75297844 We

have recorded your recent order. Good day, we’re glad to confirm your recent

purchase from PayPal. Your payment has been received and the [...]



Content analysis details: (12.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.210.74 listed in list.dnswl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.210.74 listed in will-spam-for-food.eu.org]

[209.85.210.74 listed in will-spam-for-food.eu.org]

[209.85.210.74 listed in will-spam-for-food.eu.org]

[209.85.210.74 listed in will-spam-for-food.eu.org]

[209.85.210.74 listed in will-spam-for-food.eu.org]

[209.85.210.74 listed in will-spam-for-food.eu.org]

[209.85.210.74 listed in will-spam-for-food.eu.org]

[209.85.210.74 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.210.74 listed in dnsbl.ahbl.org]

[209.85.210.74 listed in dnsbl.ahbl.org]

[209.85.210.74 listed in dnsbl.ahbl.org]

[209.85.210.74 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.210.74 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.210.74 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.210.74 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.210.74 listed in dnsbl.ahbl.org]

1.2 MISSING_HEADERS Missing To: header

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.210.74 listed in wl.mailspike.net]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 LOTS_OF_MONEY Huge... sums of money

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

1.9 REPLYTO_WITHOUT_TO_CC No description available.

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.6 LONG_INVISIBLE_TEXT Long block of hidden text - bayes poison?

Subject: {SPAM?} Payment confirmation for Invoice available



--000000000000aeae0a064bab49ac

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes

Content-Transfer-Encoding: base64



MjAyNi0wMi0yNiBCaWxsOiAzNzYtT1ZGQy1aUEogUmVmZXJlbmNlIE51bWJlcjogNzUyOTc4NDQg

V2UgaGF2ZSByZWNvcmRlZCAgDQp5b3VyIHJlY2VudCBvcmRlci4gR29vZCBkYXksIHdl4oCZcmUg

Z2xhZCB0byBjb25maXJtIHlvdXIgcmVjZW50IHB1cmNoYXNlICANCmZyb20gUGF5UGFsLiBZb3Vy

IHBheW1lbnQgaGFzIGJlZW4gcmVjZWl2ZWQgYW5kIHRoZSBvcmRlciBpcyBub3cgc2NoZWR1bGVk

ICANCmZvciBwcm9jZXNzaW5nLiBCZWxvdyBhcmUgdGhlIHRyYW5zYWN0aW9uIGRldGFpbHM6IFRy

YW5zYWN0aW9uIERldGFpbHM6ICANCkl0ZW06IGlQaG9uZSAxNyBQcm8gUXVhbnRpdHk6IDF4IFBh

eW1lbnQgTWV0aG9kOiBQYXlQYWwgVG90YWwgQW1vdW50OiAgDQokMTEwMS43NyBGb3IgZnVydGhl

ciBhc3Npc3RhbmNlLCBwbGVhc2UgY29ubmVjdCB3aXRoIG91ciB0ZWFtIHVzaW5nIHRoZSAgDQpj

b250YWN0IGRldGFpbHMgYmVsb3cuIE9yZGVycyBjYW4gYmUgY2FuY2VsZWQgd2l0aGluIDI0IGhv

dXJzIGJ5IGNhbGxpbmcgIA0KMXs4NjN9IDQwOS01MjE4LiDCqSAyMDI1IFBheVBhbCBMTEMg4oCT

IEFsbCByaWdodHMgIA0KcmVzZXJ2ZWQuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g

LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu

IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g

LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu

IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g

LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu

IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuDQoN

ClBheW1lbnQgY29uZmlybWF0aW9uIGZvciBJbnZvaWNlIGF2YWlsYWJsZQ0KV2VkbmVzZGF5IEZl

YiAyNSDii4UgMTFwbSDigJMgVGh1cnNkYXkgRmViIDI2LCAyMDI2IOKLhSAxMDozMHBtDQpDZW50

cmFsIFRpbWUgLSBDaGljYWdvDQoNCg0KDQpPcmdhbml6ZXINCkpvc2VwaCBIb3JueWFrDQpzZWRh

MTk5Njg5QG5vYXR3bS5vcmcNCg0K

--000000000000aeae0a064bab49ac

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable

Web/SEO/App spam from Microsoft Outlook Part 3

Posted by Dave Yadallee on



ont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; =

color: rgb(0, 0, 0);" class=3D"elementToProof">

We are an Indian based Website Design & Development =

;Company with PHP Development that offers services at a modest ra=

te. 



ont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; =

color: rgb(0, 0, 0);" class=3D"elementToProof">

 



ont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; =

color: rgb(0, 0, 0);" class=3D"elementToProof">

We have a dedicated team of professional designers and developers with many=

years of experience and we thrive on the idea that design makes a differen=

ce.



ont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; =

color: rgb(0, 0, 0);" class=3D"elementToProof">

 



ont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; =

color: rgb(0, 0, 0);" class=3D"elementToProof">

Our Services at a Glance: -



ont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; =

color: rgb(0, 0, 0);" class=3D"elementToProof">

 





  • alibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); margin=

    : 0cm 0cm 0.0001pt 18pt;">

    Web Design using PSD to HTML,

  • beddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size:=

    12pt; color: rgb(0, 0, 0); margin: 0cm 0cm 0.0001pt 18pt;">

    Design Templates - Layout

  • edFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12p=

    t; color: rgb(0, 0, 0); margin: 0cm 0cm 0.0001pt 18pt;">

    Custom Tailored PHP Applications

  • _EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-si=

    ze: 12pt; color: rgb(0, 0, 0); margin: 0cm 0cm 0.0001pt 18pt;">

    Customized Template Design

  • dedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12=

    pt; color: rgb(0, 0, 0); margin: 0cm 0cm 0.0001pt 18pt;">

    Re-Design & Development

  • _EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-si=

    ze: 12pt; color: rgb(0, 0, 0); margin: 0cm 0cm 0.0001pt 18pt;">

    Custom CMS (Content Management System)

  • Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; f=

    ont-size: 12pt; color: rgb(0, 0, 0); margin: 0cm 0cm 0.0001pt 18pt;">

    E-commerce Website Design

  • tos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font=

    -size: 12pt; color: rgb(0, 0, 0); margin: 0cm 0cm 0.0001pt 18pt;">

    Payment Gateway Integration

  • ddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 1=

    2pt; color: rgb(0, 0, 0); margin: 0cm 0cm 0.0001pt 18pt;">

    Custom Mobile Apps & More Info=85.



ont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; =

color: rgb(0, 0, 0);" class=3D"elementToProof">

 



ont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; =

color: rgb(0, 0, 0);" class=3D"elementToProof">

If you are interested, then please share your requirements so tha=

t I can suggest you a solution in accordance.



ont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; =

color: rgb(0, 0, 0);" class=3D"elementToProof">

 



ont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; =

color: rgb(0, 0, 0);" class=3D"elementToProof">

Looking forward to hear you from your side.



ont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; =

color: rgb(0, 0, 0);" class=3D"elementToProof">

 



ont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; =

color: rgb(0, 0, 0);" class=3D"elementToProof">

 



ont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; =

color: rgb(0, 0, 0);" class=3D"elementToProof">

Warm Regards,



ont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; =

color: rgb(0, 0, 0);" class=3D"elementToProof">

Ravi



ont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; =

color: rgb(0, 0, 0);" class=3D"elementToProof">

Marketing Manager (India)



Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=

s=3D"elementToProof">












--_000_TYZPR04MB71779E694389C305EDB7E9F7BC75ATYZPR04MB7177apcp_--

Web/SEO/App spam from Microsoft Outlook Part 2

Posted by Dave Yadallee on
Content analysis details: (7.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[2603:1096:400:458:0:0:0:5 listed in]

[will-spam-for-food.eu.org]

[2603:1096:400:458:0:0:0:5 listed in]

[will-spam-for-food.eu.org]

[2603:1096:400:458:0:0:0:5 listed in]

[will-spam-for-food.eu.org]

[2603:1096:400:458:0:0:0:5 listed in]

[will-spam-for-food.eu.org]

[2603:1096:400:458:0:0:0:5 listed in]

[will-spam-for-food.eu.org]

[2603:1096:400:458:0:0:0:5 listed in]

[will-spam-for-food.eu.org]

[2603:1096:400:458:0:0:0:5 listed in]

[will-spam-for-food.eu.org]

[2603:1096:400:458:0:0:0:5 listed in]

[will-spam-for-food.eu.org]

[52.103.66.54 listed in will-spam-for-food.eu.org]

[52.103.66.54 listed in will-spam-for-food.eu.org]

[52.103.66.54 listed in will-spam-for-food.eu.org]

[52.103.66.54 listed in will-spam-for-food.eu.org]

[52.103.66.54 listed in will-spam-for-food.eu.org]

[52.103.66.54 listed in will-spam-for-food.eu.org]

[52.103.66.54 listed in will-spam-for-food.eu.org]

[52.103.66.54 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[52.103.66.54 listed in dnsbl.ahbl.org]

[52.103.66.54 listed in dnsbl.ahbl.org]

[52.103.66.54 listed in dnsbl.ahbl.org]

[52.103.66.54 listed in dnsbl.ahbl.org]

[2603:1096:400:458:0:0:0:5 listed in]

[dnsbl.ahbl.org]

[2603:1096:400:458:0:0:0:5 listed in]

[dnsbl.ahbl.org]

[2603:1096:400:458:0:0:0:5 listed in]

[dnsbl.ahbl.org]

[2603:1096:400:458:0:0:0:5 listed in]

[dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[52.103.66.54 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[52.103.66.54 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[52.103.66.54 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[52.103.66.54 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

1.2 MISSING_HEADERS Missing To: header

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[ravi.web288(at)outlook.com]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[ravi.web288(at)outlook.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[52.103.66.54 listed in wl.mailspike.net]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.4 MALFORMED_FREEMAIL Bad headers on message from free email service

Subject: {SPAM?} Re-Design & Development!!



--_000_TYZPR04MB71779E694389C305EDB7E9F7BC75ATYZPR04MB7177apcp_

Content-Type: text/plain; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable



Dear,



Hope you are doing well.



We are an Indian based Website Design & Development Company with PHP Develo=

pment that offers services at a modest rate.



We have a dedicated team of professional designers and developers with many=

years of experience and we thrive on the idea that design makes a differen=

ce.



Our Services at a Glance: -





Web Design using PSD to HTML,

 Design Templates - Layout

Custom Tailored PHP Applications

 Customized Template Design

Re-Design & Development

 Custom CMS (Content Management System)

E-commerce Website Design

 Payment Gateway Integration

* Custom Mobile Apps & More Info=85.





If you are interested, then please share your requirements so that I can su=

ggest you a solution in accordance.



Looking forward to hear you from your side.





Warm Regards,

Ravi

Marketing Manager (India)





--_000_TYZPR04MB71779E694389C305EDB7E9F7BC75ATYZPR04MB7177apcp_

Content-Type: text/html; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable








252">








ont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; =

color: rgb(0, 0, 0);" class=3D"elementToProof">

Dear,



ont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; =

color: rgb(0, 0, 0);" class=3D"elementToProof">

 



ont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; =

color: rgb(0, 0, 0);" class=3D"elementToProof">

Hope you are doing well.



ont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; =

color: rgb(0, 0, 0);" class=3D"elementToProof">

 

Web/SEO/App spam from Microsoft Outlook Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 25 Feb 2026 11:28:00 -0700

Received: from mail-japanwestazolkn19012054.outbound.protection.outlook.com ([52.103.66.54]:34277 helo=OS8PR02CU002.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vvJbB-00000000LAG-30JA

for dave@doctor.nl2k.ab.ca;

Wed, 25 Feb 2026 11:27:13 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=nwPTvMdWKLSdgx6tOYIml48ChfmhmGGQcLK005Ie+JZm2AaQeOehB6KaOv3kCE8WDbo2ziu4V9PACYlOF2nPGSLHhgnzTpJrsfSvoIOGgxEyvBkmENx/Cg5fNitF9emV5EghlddI7yF/lPPl7XPj2bRwtnNkJRsy7KGd5hQJOryy0MauDTtXcuBbXr1M8L2pc43PEDfzPwEMrYs5BKZcPijRxbtp7VJdiXpQo2QEzBS0n34jsZMVUX8CNgVdvgzC9yapJ/sGwP1KaDMCNMi1CJyMlzB8lb93UPr5jJNdZA2DCbOsW9jvJ3ad6xLRW08p8+DGbXIWgJ6cx+QJJUKL4A==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=OISx9kS5gfvde6JDa7Q/4/PmpSIjpT0l0ru8GACDq0Q=;

b=rR/H6Pxk8084e++WWwrBcwUZQSLYkXxqAdHaOW/E50mB0igW8qvMb7x8ndpW0tfZpBTJ7UZNj5fu3I3c9nIui9wi/psGbEyNRxzV1wxcYM5ffWI6yF5PMRWmrJIKFk+mp+6oAIOjNZ8Au5VbedMEwOtCzwLw2osS/RLHbmuRPIcIt+zYspD+/wgVo8emSHAIYd7bI2DnFJM6XFDSfAtd84qMAHw7UnWNEznPXP4St6bRF/N+OMIlHZzytDzCcezLC0RYfYrWddTZ7OQ8Rye2B6bFBO/fkmFyEbtCEoAzkRXCfLpF0Zkz5bafzUo79W0PJON1MgfIocvJz8vIvKnbFg==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=OISx9kS5gfvde6JDa7Q/4/PmpSIjpT0l0ru8GACDq0Q=;

b=GNWSbFJ5GpzRhNzsbnXXQa0D4b71bj2IxdNXmTOWwE/KIWfgKSgP2xpMaPlM1qf7WYRSuyMB5fuNzZ4DHdi/BsTIVPzlYm1uePwiBXp9lbE1G5RGs3CsIuFxPGB1M0BoFOKVdEd4QNInCIoVfpRnSy6dIviN1NkRJ6rp7F6tsoDQ8nGmgA85qup8+j9XHz2PRVTCbB6W0G635wZd+WhvurYAhKvnih9FyosE2pK6/JT9OmojWMZEb21Dxs4XENMIb6YhxYLfhkAB5VCz6uOaFt53fm66tyOMVgrJcykXWoLsu32uCh67b9GSeyYnxjhlZFI/y8+uN5iEKaAxdbGs7A==

Received: from TYZPR04MB7177.apcprd04.prod.outlook.com (2603:1096:400:458::5)

by SI6PR04MB7927.apcprd04.prod.outlook.com (2603:1096:4:24b::12) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9654.13; Wed, 25 Feb

2026 18:25:47 +0000

Received: from TYZPR04MB7177.apcprd04.prod.outlook.com

([fe80::a5e7:6830:ceaa:f776]) by TYZPR04MB7177.apcprd04.prod.outlook.com

([fe80::a5e7:6830:ceaa:f776%4]) with mapi id 15.20.9632.017; Wed, 25 Feb 2026

18:25:47 +0000

From: Ravi Sharma

Subject: Re-Design & Development!!

Thread-Topic: Re-Design & Development!!

Thread-Index: AQHcpoQpaSbwbaVbGUW45GZ3r4H7ug==

Date: Wed, 25 Feb 2026 18:25:47 +0000

Message-ID:



Accept-Language: en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

msip_labels:

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: TYZPR04MB7177:EE_|SI6PR04MB7927:EE_

x-ms-office365-filtering-correlation-id: 576618e3-fc3a-4b57-4d9c-08de749b4be8

x-microsoft-antispam:

BCL:0;ARA:14566002|19110799012|8062599012|8060799015|20031999003|39105399006|12121999013|461199028|31061999003|15030799006|15080799012|56899033|40105399003|51015399003|3412199025|440099028|102099032;

x-microsoft-antispam-message-info:

=?Windows-1252?Q?4J7GD5mJ8hmJnCRkyawmAROlnjQS83dqLFb0MrLAgiTDaaW1qCw6SgV2?=

=?Windows-1252?Q?5EQcK8DHYttJP2bpDWgyOk/wad9CwwofjwPKNOx8ZToTkwqHOavchDHW?=

=?Windows-1252?Q?roDcq54j7gxde5W4h7bDJVUPL4s7iw1XzVhJY08PXBKCou7IGof7h0Z7?=

=?Windows-1252?Q?6Y4yGb2nOrjRzWlu15ksK81P6I6eB7TsiJAC9o50tPFMtRRkjo/uz0XT?=

=?Windows-1252?Q?MWpPVqq2C8+pXw+bUeOqQCY1nCf4cFdYbwiEzNXj/i739F1t+OUIFrRQ?=

=?Windows-1252?Q?O3HF9GgHJmOgN3SYARcthFE8myA+wjx9JvQ9raoMCgN6fliJitfC/0cv?=

=?Windows-1252?Q?0O4q5qbikNU2hGm7ll70LjgDqspuj9MC84gRq+mGGa2yo3vNraDbb8O2?=

=?Windows-1252?Q?x1dtL3Nw5OEkwK1fCaQ6NATojGG+y7aDdqRmEGnvAaT5YHzgcbDEeDOT?=

=?Windows-1252?Q?Y2bqkI8eCEcaPLF7J7eMs9QaBC8YDsTotqoaHnPuAk7Ql9CFa/45+3Gn?=

=?Windows-1252?Q?o8ctaH6UUqi4N1NLXK8vfKrYfRM7+6SQyHpqP0VpKhwNnrt07lgtr2df?=

=?Windows-1252?Q?nGUYeHs0SxDqtjJl9FgmWEBiD+vHIekQToJiPu+NyG0fwKWeIn9nTuVq?=

=?Windows-1252?Q?N9iRlzlnV5wWzmp7L+dB5JtSSAcYPZOj+T8uZwXLUswUU48DnRB6SaPu?=

=?Windows-1252?Q?zeGsxE2YQfDKPcyGZLP8XmC5EobSv94Ow0g50le2le8f/JkMyu7tD8px?=

=?Windows-1252?Q?GNewm6Pr0g0Ax9d6gH7+HCg6kjiIRXVXlOASdi5ZnmxqNDW3uf4hGUxM?=

=?Windows-1252?Q?6OHzMthbDzQyFEfXD1y5m0AZ5F1jZOgUtBt0l0TDfGkuKPkjwy376TWb?=

=?Windows-1252?Q?nIq+IIOC3WWmqzfti8mmKUF1/W8yIJmcr+N0cuyGwG9syASLndrzYlHa?=

=?Windows-1252?Q?3iPDCKOtMn93t/ZZN/8F+12r1zuqlUgvN91banveJDCzr+vIxtwl9l9X?=

=?Windows-1252?Q?HXy5yJSwbqQ97HVyWIxumhbK0riNMpSneyPhemc+tIUBhHoat7/jBk50?=

=?Windows-1252?Q?rb3rIWobwwcvpoPG+V0ha/FjvQCQpcmZAy2FtfULCRM62UvjXDYZ6kIo?=

=?Windows-1252?Q?RQc=3D?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?Windows-1252?Q?5/XrrJpUgH7AbJYLvPnGp0okCu/8v+VqvnAExVNHyXHHmbZxnGYHqNDf?=

=?Windows-1252?Q?6G7Rqh9QHy5vQ3SE8HzuDENq6wiwNEtJK9lbIua/DLe3UKw5UmFjiuWT?=

=?Windows-1252?Q?yEZ2LEfTthdrj3bbcJ4eD/AfaK2CB+YSmBi5hLdcaluV2XhSO8Raga9e?=

=?Windows-1252?Q?SylbL15YgorUb48ZmD/rIHo6PKZnQyxkRBbxK5foSYGL7BUEzK+Rqkfa?=

=?Windows-1252?Q?CRKNfOp9M/N1E6jcx4LqncE2yoC8Sw5raln5U59w49j1Srzqhi0qGoJl?=

=?Windows-1252?Q?rm0wOv8VeaWJK2KeX9t7ToeKhcQmSuW1kCUhlCTp3mwAFdyqgFUWR+N6?=

=?Windows-1252?Q?r59gD1JQiful8zakCSaqDm7GKmJl5sCxiC0CbecBLfb9lgajgXdelq7k?=

=?Windows-1252?Q?wxlaFQmx2CR76v/JG6Jhj1fPSyy9a5Zxc77IS2cBb422lrIk7g9oyRXR?=

=?Windows-1252?Q?kwKbrV6dtqShdhUC3Y0PHzG9qDRWO3wGJPzamdIXHM9EiTX+DRgqxtV/?=

=?Windows-1252?Q?RGV6t/6D/WtAovgcx2X1Cwk9txcWcXBIhRru3nRHZ9GalASEMFZboDv+?=

=?Windows-1252?Q?kgbGfSoji7Fkk0hPcZCrNwY9kbTQFPvbrKvZuaHBOVde9xY4sO31Wwx9?=

=?Windows-1252?Q?k+SdGxoYRMpXYWphaJKim1ssmS5BO+LQX4zV2u33M6r6O3bgeDkExhAH?=

=?Windows-1252?Q?q+dhlEbSrIWPCX/IEWi0cSC2uE/tvODfNPj+DwayQ4jjWicttywoI6A1?=

=?Windows-1252?Q?wYYfTLXDB0rOrCoMTa47qUV10Dj72ZJUIGHcNjXTxiGV5qeJBni5QbfO?=

=?Windows-1252?Q?XdWTruSn8BrDPqt9mB/HCFXkp0Dy4ceur3QhE6OlRCjcbiizTLLSkLyQ?=

=?Windows-1252?Q?zrBqX7eaOq6JBKlFyybXX3pHLGxsHCBJVVYcWNOapwDAqBSVNkyAmZ/r?=

=?Windows-1252?Q?Ne4BC3pYtCmFuHf3KQ4IF6al/KtrTGOZxDX3OerHETKps2c6ubTzLsOX?=

=?Windows-1252?Q?U5v1dhETsU5WvWy5y5TrEE9dHGF/a7/b6w3wNr+lCNOYbOguoHaK4jpi?=

=?Windows-1252?Q?M0Hx0NDMKChDDQ17s1/gqQvxZ0hboLcBX6T0cagbA5Plz0Th7h8T8Ukv?=

=?Windows-1252?Q?TZ3n9t0Xx4AEr+WUV0Gjs9zmhFD3hwazPQu60+z3fJuozfaVW+PENcf4?=

=?Windows-1252?Q?Fsan7wddfrDbBqZTfkDsTIUdKPHtKl/f41BYM9kv3yN0NFAYt/ruVJ8g?=

=?Windows-1252?Q?4/rWFpz0du1T3hYTxQqtJfRFT9b1+pdfYwaxvpss5ZcasYky51We1m0w?=

=?Windows-1252?Q?0kq4Y4bgDE35AJUCZGN598uTuLG8rUzjdkPaHBBbHvlqQry8anjCoZ85?=

=?Windows-1252?Q?0mD0BHZ+QSN4dHjNRLW2AxY0wH8p0uzWCI/BPHG3qJbXgPg9FfU3sNrC?=

=?Windows-1252?Q?TqtwlY3xL7GpFQ4Ut2iltJKabyNW9SecbWM9CZxDd/gYzlm1TweeG3wo?=

=?Windows-1252?Q?YWGj4W79?=

Content-Type: multipart/alternative;

boundary="_000_TYZPR04MB71779E694389C305EDB7E9F7BC75ATYZPR04MB7177apcp_"

MIME-Version: 1.0

X-OriginatorOrg: outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: TYZPR04MB7177.apcprd04.prod.outlook.com

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: 576618e3-fc3a-4b57-4d9c-08de749b4be8

X-MS-Exchange-CrossTenant-originalarrivaltime: 25 Feb 2026 18:25:47.5308

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: SI6PR04MB7927

X-Spam_score: 7.7

X-Spam_score_int: 77

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear, Hope you are doing well. We are an Indian based Website

Design & Development Company with PHP Development that offers services at

a modest rate.

Paypal phish from Microsoft Outlook Part 2

Posted by Dave Yadallee on
Content analysis details: (8.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[2603:10b6:806:34d:0:0:0:12 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:34d:0:0:0:12 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:34d:0:0:0:12 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:34d:0:0:0:12 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:34d:0:0:0:12 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:34d:0:0:0:12 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:34d:0:0:0:12 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:34d:0:0:0:12 listed in]

[will-spam-for-food.eu.org]

[40.93.23.1 listed in will-spam-for-food.eu.org]

[40.93.23.1 listed in will-spam-for-food.eu.org]

[40.93.23.1 listed in will-spam-for-food.eu.org]

[40.93.23.1 listed in will-spam-for-food.eu.org]

[40.93.23.1 listed in will-spam-for-food.eu.org]

[40.93.23.1 listed in will-spam-for-food.eu.org]

[40.93.23.1 listed in will-spam-for-food.eu.org]

[40.93.23.1 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[40.93.23.1 listed in dnsbl.ahbl.org]

[40.93.23.1 listed in dnsbl.ahbl.org]

[40.93.23.1 listed in dnsbl.ahbl.org]

[40.93.23.1 listed in dnsbl.ahbl.org]

[2603:10b6:806:34d:0:0:0:12 listed in]

[dnsbl.ahbl.org]

[2603:10b6:806:34d:0:0:0:12 listed in]

[dnsbl.ahbl.org]

[2603:10b6:806:34d:0:0:0:12 listed in]

[dnsbl.ahbl.org]

[2603:10b6:806:34d:0:0:0:12 listed in]

[dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[40.93.23.1 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[40.93.23.1 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[40.93.23.1 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[40.93.23.1 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[40.93.23.1 listed in list.dnswl.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[40.93.23.1 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 AXB_X_FF_SEZ_S Forefront sez this is spam

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

1.5 TVD_PH_BODY_ACCOUNTS_PRE The body matches phrases such as "accounts

suspended", "account credited", "account

verification"

1.2 TVD_PH_SUBJ_META1 Email has a Phishy looking subject line

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} Payment from Pay Pal LLC for USD 789.96 has been confirmed. If you

believe this to be inaccurate, contact 18102930409. account email

verification code






w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">













<br /><br /> =09<br /><br /> Payment from Pay Pal LLC for USD 789.96 has been confirmed. If you beli=<br /><br /> eve this to be inaccurate, contact 18102930409. account email verification =<br /><br /> code<br /><br /> <br /><br />










dir=3D"ltr" lang=3D"en">













=20


der=3D"0" dir=3D"ltr" lang=3D"en" style=3D"border-left:1px solid #e3e3e3;bo=

rder-right: 1px solid #e3e3e3;">














:1px solid #e3e3e3;">
border-bottom:1px solid #e3e3e3;"> 
:1px solid #e3e3e3; border-bottom:1px solid #e3e3e3;padding:12px 0;">


Light; font-size:18pt; color:#ffffff; font-weight:normal;">

=20


"#FFFFFF">Verify your email address
;border-bottom: 1px solid #e3e3e3;"> 


Paypal phish from Microsoft Outlook Part 3

Posted by Dave Yadallee on



der=3D"0" dir=3D"ltr" lang=3D"en">

















=20























 
n=3D"2" style=3D"border-bottom:1px solid #e3e3e3; padding:10px 0 20px;"> =09


"0" >








line-height:13pt; color:#000;">


"0" border=3D"0" width=3D"100%" style=3D"" dir=3D"ltr" lang=3D"en">









=20


x; color:#333;">

Tha=

nks for verifying your MatthewPerez1@Dallas217.onmicrosoft.com account!
an>







x; color:#333; font-weight: bold">

You=

r code is: 413730












Segoe UI', Tahoma, sans-serif; font-size:14px; color:#333;">

Sincerely,




Segoe UI', Tahoma, sans-serif; font-size:14px; font-style:italic; color:#33=

3;">

Payment from Pay Pal LL=

C for USD 789.96 has been confirmed. If you believe this to be inaccurate, =

contact 18102930409.






     

tom:1px solid #e3e3e3;">
e3;"> 
top" colspan=3D"6" style=3D"border-bottom:1px solid #e3e3e3; padding:20px 0=

;">


ing=3D"0" border=3D"0" width=3D"585">












g=3D"0" border=3D"0" dir=3D"ltr" lang=3D"en" style=3D"margin-right:30px;">










:'Segoe UI', Tahoma, sans-serif; margin:0px 0px 0px 5px; color:#666; font-s=

ize:10px;">


Info">

Microsoft Corpo=

ration

|

One Microsoft W=

ay Redmond, WA 98052-6399







This message was se=

nt from an unmonitored email address. Please do not reply to this message.


AndLegalLinks" style=3D"color:#0072c6;">






s://privacy.microsoft.com/en-US/privacystatement" id=3D"PrivacyLinkAnchor">

Privacy



|


ps://www.microsoft.com/en-US/servicesagreement/" id=3D"LegalLinkAnchor">

Legal





=20





passwordreset.microsoftonline.com/images/1_MSLogo.png" />







e3;"> 
tom:1px solid #e3e3e3;">







OBKBIJASBKEY5YA76F3UNWPNV4S7LS2VS3M6I3CVHJSUX6UKPODDVZQNUCFHO2T7ULCSZ43K2KV=

OQ7HBNQVOWUGUSP24IH73YLYJLIOYRA5TMXA4TGKMJ4GKD2LGTALXYVOSMWSJ7GEK5PUPJY&i=3D=

AIAADMHHNWTRCRVV56AYVCRRSGQ7R7JQB7NHB7PA2J26WOCIJHBA43PAZXBZVW64JQWCLFFDY6I=

OHW32XIYOG3FQEUFPTNSMKZTI32HYYNJ7V5RISIQHNZYZPKFXEGL3MEE6RHMSUIV5LWLCMQSRLC=

Y2B6R46AFI3WZHRCVSJOHLNZVQZVB7SIESDU67BSTXVFAS2HGFFBI34YOMSSAYZAOJQBOYIGVYA=

KERVU37SHUAMB4INCVHW2YNDIOZAEVOC2RIZ7YZD3EPZHOJHYS5SJRZZJZ5Y2I' width=3D'1'=

height=3D'1' tabindex=3D'-1' aria-hidden=3D'true' alt=3D'' />

=

Paypal phish from Microsoft Outlook Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 25 Feb 2026 12:19:03 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vvKP7-00000000Plh-2uWk

for dave@doctor.nl2k.ab.ca;

Wed, 25 Feb 2026 12:18:37 -0700

Resent-From: The Doctor

Resent-Date: Wed, 25 Feb 2026 12:18:37 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-westus3azacs10201001.outbound.protection.outlook.com ([40.93.23.1]:12316 helo=PH0PR06CU001.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vvJID-00000000JWl-1hC0

for doctor@doctor.nl2k.ab.ca;

Wed, 25 Feb 2026 11:07:36 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=PccDXoOC5s67GjPs/nRCWBtemEUboxhF1oAoW78xeOMmnJad31yQeR+Mo6MGM9PoPnJCXO+wqwz06+Zgn9lug8If8EdEN/4WXe2mC4Ryx6bpQWLhw47JA9L5nZsusCoIfaGQVei27PiGnzPweVUVjuq7JldzcVCbMEhyXPdb0x0S1saztJYO2amRU7+/vSY4tnGMm0QB6hvIJgsffamo1S69BpyCbtFSmbwSN/XgOlQWGZNNHlM/DkNsZvhD1/wT42KhpILHUCfSu+5Ygw9aZx1pDdYEVc+ZFPDE72yHnA0lZK2DoSFmGXWrWvWExmH3ABCgKOmUzVEjHZV96LaD2w==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=WeRnAI+RtU64gK0yjsBMGQNR0j8xH47PCKyCgoRc3xM=;

b=Z11wCossixobIOc+MFvK0VNi7EO3cHnZDIRBIgS5KxFLaBDrJAhQ9ddSIo9c3b9XClgljSWIDqEYZ+nd5nvqWn2owXbS6QUzpk50LD4vWSUwhSFdYJqWs/wu1OzewLDD/WyMeBX5Ltb0aW50wl9wiICTSqMKnK9ISTI3Z2vDEYOsIXQvD+kcA4tMg3mhC3CoH4BdqBSVshtjCyRXZ0jIkuDaWubbPD9yz+vk2lBOXviN5ioxbrkrUDkC4tl8xmyQp1/azX9YTP6sBa79xHStMcYztFmlbHCOoDlMbnWrTCFCM3fIncV7flxaJbB7nixPW4+5Dd/RKM+1ieYLK6jaZQ==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

Received: from substrate.office.com (2603:10b6:806:34d::12) by

SN7PR10MB7003.namprd10.prod.outlook.com with HTTP via

MW4PR04CA0270.NAMPRD04.PROD.OUTLOOK.COM; Wed, 25 Feb 2026 18:06:29 +0000

DKIM-Signature: v=1; a=rsa-sha256; d=microsoftonline.com; s=s1024;

c=relaxed/relaxed; t=1772042788; h=from:to:cc:subject:date:messageid;

bh=WeRnAI+RtU64gK0yjsBMGQNR0j8xH47PCKyCgoRc3xM=;

b=kY3RXOQ++w4mjFLqb/fh02PZfolctgQVksvCFaKbonkUi9vt0QuHzn93sg/zGV1z7gH6ICFY8Pp

3jh572c1OW6dqNMkteQCVMbLP3JC8zQqAOddSG1HTPDtZcWXyL1FfdksIRi38zcjcBlaBfFCCPWsm

fwQXDpNFTOhx9Hi5Fns=

From: msonlineservicesteam@microsoftonline.com

To: doctor@doctor.nl2k.ab.ca

Subject: Payment from Pay Pal LLC for USD 789.96 has been confirmed. If you

believe this to be inaccurate, contact 18102930409. account email

verification code

Date: Wed, 25 Feb 2026 18:06:28 +0000

Message-ID: <[078613e4ae8d4fffa98c702115f4d125-JFZGS42DN5WW25LONFRWC5DJN5XFA3DBORTG64TNFVIHE33EFVGVOMKQPREUCTKTKNIFE7CTKNIFERLNMFUWY7CFPBXVG3LUOA======@microsoft.com]>

X-MS-Iris-MetaData: =?utf-8?q?{=22Type=22=3Anull=2C=22Fields=22=3A{=22InstanceID=22=3A=22078613e4-ae8d-4fff-a98c-?=

=?utf-8?q?702115f4d125=22=2C=22ActivityID=22=3A=22ddb5e152-b509-4e91-9019-fd4911bf0?=

=?utf-8?q?a25=22}}?=

MIME-Version: 1.0

X-TsbHttpDeliveryResponseType: Success

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: quoted-printable

X-MS-PublicTrafficType: Email

client-request-id: 078613e4-ae8d-4fff-a98c-702115f4d125

request-id: 078613e4-ae8d-4fff-a98c-702115f4d125

X-MS-TrafficTypeDiagnostic: SN7PR10MB7003:EE_ICP

X-MS-Exchange-SenderADCheck: 0

X-MS-Exchange-AntiSpam-Relay: 0

X-Microsoft-Antispam:

BCL:0;ARA:13230040|376014|69100299015|7149299003|7049299003|61400799027|3109299003|3613699012|8096899003|4076899003|54012099003|14102899009;

X-Microsoft-Antispam-Message-Info:

=?utf-8?B?c3hxcUNXTDV2YU5pU2YvVUxwcGMwcEdCUExBUFB0cUU5RTEwejJDUGliV1B1?=

=?utf-8?B?bEkvWWI4SVkrZ2s4K3YvbHk4N2hLRHRJaWxKMU5qQnFrR0kvN3hIVC9yMFZs?=

=?utf-8?B?Z3RSeFNHejZOUDFhQUZRSG54ZDYwZS9Bd1hweWJSZ2FmZnlRTGlveFBkS0pO?=

=?utf-8?B?bmhkK1NJL2JhQkVpWVYrdVRxWURIRFVwWVA3ZFJTSjloRUZSV3hqeURucmlW?=

=?utf-8?B?SmhpaG5TbjE5dWNYN0x6SitkR3Zkc3R4MEhqQmhpM2gzUjFWQTR1d1BEUkgx?=

=?utf-8?B?dEd5UDdPekNRY2hrYjBkOUQwMStpWmZXaFFQbEk0WlVEMW5xUTgyNzl2RXJy?=

=?utf-8?B?cGtCeGdKNXdRZTJZRUlzVmRwOXpEbnZId3IyR1hHVHdENC9wV1ExMlRPNU1y?=

=?utf-8?B?aEhBWWZMQWRzUFFqYyt1T1RQQUJnMU4vOGFJQmdBd3RZdndCYW01bHlUWWdU?=

=?utf-8?B?WjFYOHNqTUdXblFaSFBTQ3pLRmUxdlNvTUFMQlA2MHllbElzczZubGM0c2FB?=

=?utf-8?B?VVl1L1RvNVpWUTF2ODI3NER4TTBXd3pjVlhtcWZLNTdSSzF2VDZ3RXNMenYr?=

=?utf-8?B?Y0tqR00yTnMwUk1LS0JKcGxtNEM5S2hKbWJ4alhrVm1RRmVkKy9EOGJGZmxj?=

=?utf-8?B?SU16eXMxT05LcFJRNEt6a0hxOVM2QlZIeHlUYStKcEt1bDRmZnRRcUNxTko2?=

=?utf-8?B?VURObkQvejJPV2djWk01Q3hPYjBoZUVzcE5JQTRpR1oxaS9Ha1BxUFhOWllL?=

=?utf-8?B?ZndocUlaOHJNemtEc2tnczZWME93Ny84MFdEeng0eERqTytxYmYvT1ZXdXZN?=

=?utf-8?B?SUd1V0d2MEsyVzluMWJQYkdYeXNYZ0s0OXo2djdSbXMvZ3ZlRTdDbEV0YzB1?=

=?utf-8?B?MnM5d1ZyemlYREkxRkc3dVBWZTlxR09EcjQzRlM3ZzBsUFdBaWFtSXErSS9z?=

=?utf-8?B?dUpieUdyV1ZTa3lPMmtES1RHV3hpRlNCUldvcVo2bWNvMk0vRXorRmZab3lq?=

=?utf-8?B?WmFXcVA5dXZCSk5SOURZVi9ZNGs1cEhsb280eG12azhVTVk2YXlqZSt1WUFv?=

=?utf-8?B?d1J1RjZ3Tzl3ZU1QdlJDb0REMUI0ZVhRendrMlhTYzQ3NXFGN0dhSXpSY1BT?=

=?utf-8?B?R1dWYXA5cTNVNDRwcm5wNGhMa2g3T0ExQllWNldPbGsxWFFWNEE4b1F2VHNl?=

=?utf-8?B?Ykc3aW5MN2YvR3hXNFJLOFNZMWQvK0F1VDRjdlRZS3pNcnhOZ083dXpGelhU?=

=?utf-8?B?L296UVpHU2pYQTdVaWhKVisxZ2ErMUxwemJTU05BYWRqTlZ2UmREeVkvUVk3?=

=?utf-8?B?Y2gwTll6V3RQTXdrRExmUk9CblltQlJUd1ZWZmJRRUdjU2VRWGdUTmw3ck1D?=

=?utf-8?B?d3FTeGFqaWxFSVM3UnJqaHdpdFFLNjd5ajRrUEM3RzFVTEd1V2srSHdYaVZw?=

=?utf-8?B?MGNMMVJDUldrMDVBSGd1RmFnYTZYTEQvMm9sK29IZndQVnUxWFR5bGd5VkIz?=

=?utf-8?B?QXNuekVJSjBlQlU3LzdGa2pPZ1c5ZTl6aWtBMVhiM090RTdaM2tCVTArdjE1?=

=?utf-8?B?NXFETWdsbU9PUWdRM295b2cxU2xUQnJzdkJVYmZONlZJK1d4YjZ3akVOZzJi?=

=?utf-8?B?WWdOeC9XT29pK2Z6TEJRYm9yanEvQkFHZFlXL1MyQTZOZUN5R1NIUGN5YUpV?=

=?utf-8?B?WExpR2J3TzlnWWR4Z0xVVnY1dnhXK2pvSFcxcHBVeW9uRWdDMkV3Y3BibTZD?=

=?utf-8?B?WFBlRGhZZ0JZS0ZSTTg3Wk1ydmhwMFh0VlNiN1hkSStSdkFIZlRhcjUwVXNs?=

=?utf-8?B?a1ZYalBGYnJzUUxPT2tWWmd4R2VSOC9jVVpTWFFHaGF4cmhYMlJ3U0h1dk1k?=

=?utf-8?B?Vm9JQkg1dUVFVmlJeHcvWXkvSnZEZHBiZXZScGNtakUxU1RiTE1BUjlxUWxM?=

=?utf-8?B?RXdibFp0dFNsNkZ2RG10cmtMbmczV1A1UWZlYkNFVVpnam55YnRNdlQvb3o3?=

=?utf-8?B?L2ZaMFU1ZmRXNExuVXcrY1h5eXRkdFh2b0V3bFR5TXl5Sk9xWUZzUis2RnZF?=

=?utf-8?B?cmtMaU41UjF3TG9QMnZwZWtLRWJLb2NOcW9uNUtxbGpqcVkrWXRWUW1UWmJp?=

=?utf-8?Q?Y7ps=3D?=

X-Forefront-Antispam-Report:

CIP:255.255.255.255;CTRY:;LANG:en;SCL:7;SRV:;IPV:NLI;SFV:SPM;H:;PTR:;CAT:OSPM;SFS:(13230040)(376014)(69100299015)(7149299003)(7049299003)(61400799027)(3109299003)(3613699012)(8096899003)(4076899003)(54012099003)(14102899009);DIR:OUT;SFP:1020;

X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1

X-MS-Exchange-AntiSpam-MessageData-0:

=?utf-8?B?K0JNMlRDaUh6YU5heXVZME9RSzZZc1FZVy9zZ1hKb1ZhVHhwRUk5YVJEeVh0?=

=?utf-8?B?QVFzTnBPTUdCYm9QcEdVMTdIS3NhTzVYM2FKUUxJMHo4Zit2NFNHSHQxVk9o?=

=?utf-8?B?YTR1Y3VPSVlFWHdYUDlHYjUvK3JsbEFScmpIZE40Nlh4WHRCRlMwdzNkenVB?=

=?utf-8?B?d3ptY05TUDAyYnR6eFhZTDFKNzhLOUpEakp0dnVXSHh0UWdkZ2drTkR2bXhQ?=

=?utf-8?B?YTdRc0JBOWtJdmZNcG1oalhDNk9rSVBFNHFtR0FoZ0MwY1JpN21BdjRQTkZu?=

=?utf-8?B?S2dsNFpOUStybzVIdXRiWnk5cjUzT2pkR05PSWRERExYRWVUYzV3L3VQdk9m?=

=?utf-8?B?em9qTGdWallQU0ZpcnZMc2QxbHJlZVZqRVpKZTdiM2grVjdVV1J5L2pEZFVv?=

=?utf-8?B?TWdwc1RZckNPaWJRN1M0Ym11S3gvMnBRdUs3M2tDS3FCalQ2K0xtalZuVEly?=

=?utf-8?B?WFoydnFWeGthanRiRVFlNFVWQjNLZ1BaRkpWb2VwZXlmTXYxQ1RZMjJHWTk2?=

=?utf-8?B?a0VwVENhR3dPWHUybXEvNDNlQ1VrbitUSnF6U095RjV0K2N5RHdYU3NqS016?=

=?utf-8?B?b3RYOVg4TWt3Y3JEMjYyYnhsdFM5K2JrU3hjS04yVjR4QUhyazlGaWlTdnFv?=

=?utf-8?B?akRzUnFBMlVGaW5pS1htZkE0RTdsNjFoeDdXcXo0NTE2elRmRXNpUy8zQ3Fu?=

=?utf-8?B?TFcvbk5XUWw2RjRJbnZNT0dvbE5sd0hNNlMyZUYxcitvcXNGR2hEem9QOTV5?=

=?utf-8?B?QzNuRnRXU1QxeHBoTTN4YTJpWGM1QldnVGNHckUzUWlnWUVUcExkd09LUjFH?=

=?utf-8?B?M0d0OEd5UUZWdGxoVm1yU0l6dXQ1dVFKc0N5aWYzQllXVjVSWkwrYTFrbzZF?=

=?utf-8?B?SS9jWHZhQnh6ZS9jRlFpa2ZvWnNwR3FjYkt4KzZmVVBHTHpyVmxpbVpwS2J5?=

=?utf-8?B?WExlNmcwU3gxdytDc1JIZllrMHZidFpacTFNbHNNM2I5MjB4WEhrMzZlUkVQ?=

=?utf-8?B?YTFHV0ZlZmN0SXdQM2xobnZYbjZQZzlKeng4OWdJa3BVclJhbzF0Nml0SHlI?=

=?utf-8?B?T2ZuZXQxaEE2QXhPNURnZ1E3WUZJRVY3ZHVrYVJkMVFyN0tyS1pRdjlNVFN0?=

=?utf-8?B?Wkx6M2xDSzFSdEkzUmpEUWduaVJVOGRkYldZazMwRzU4VXB1cERYWmFwRGcy?=

=?utf-8?B?NGt4enpYa0Nhcmc1MzFZNDF1ZnZNSlZ0eW9vaXZzcTV4K2NoKzQ0cURVL1Y0?=

=?utf-8?B?SVNobkh1ZzlzVkQ3VERuekl1S2pFTzVoNjFsR2toY29uMGNVOFI1NzZ1SWxL?=

=?utf-8?Q?OuqauZugerF3M=3D?=

X-OriginatorOrg: ideasprod09.onmicrosoft.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: HttpSubmission-SN7PR10MB7003

X-MS-Exchange-CrossTenant-Id: 719f7151-364e-4e2e-83a8-f361c51431d7

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 25 Feb 2026 18:06:28.9721 (UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id:

88ad4618-892f-4b14-78b7-08de74989975

X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN7PR10MB7003

X-Spam_score: 8.9

X-Spam_score_int: 89

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Payment from Pay Pal LLC for USD 789.96 has been confirmed.

If you believe this to be inaccurate, contact 18102930409. account email

verification code Verify your email address Thanks for verifying your

MatthewPerez1@Dallas217.onmicrosoft.com account!