PersistIQ spam from Google Gmail

Posted by Dave Yadallee on Friday, July 3. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 03 Jul 2026 08:03:32 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wfeTt-00000000KVa-31fT

for dave@doctor.nl2k.ab.ca;

Fri, 03 Jul 2026 08:03:01 -0600

Resent-From: The Doctor

Resent-Date: Fri, 3 Jul 2026 08:03:01 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-qt1-f179.google.com ([209.85.160.179]:49337)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wfbfo-00000000CgM-1bCY

for root@nk.ca;

Fri, 03 Jul 2026 05:03:17 -0600

Received: by mail-qt1-f179.google.com with SMTP id d75a77b69052e-51bf2479349so2878521cf.2

for ; Fri, 03 Jul 2026 04:02:21 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=persistpipelineops.pro; s=google; t=1783076535; x=1783681335; darn=nk.ca;

h=mime-version:date:content-transfer-encoding:subject:to:from

:references:in-reply-to:message-id:from:to:cc:subject:date

:message-id:reply-to;

bh=O+gI0X3a/qfeECSjazz4MTYYU4lvWDAsewy4K3ppoJ8=;

b=JeuZpN4RpCqPxEo/2PmGOUcqH9pNjDhWEhIx1tOHmhJerPYMKYl6OxCqGSr78bDc27

6TGd8MwBwnHWsdGm1eAG6aljXlAVYFbZVfo5lVczE2HDhw/QClU6e9JgAFCN7/0cGpbJ

FAE0e8QqN1ZSpVr+vNaH+JK2qOOVDPE7Zz9P05Qam8LXD9t4cOMNNcTMXEHMqZhaUgfe

leejKLcCg8A7YBMyX0HNrw/hcN5Rf3sqqYo9MxFvQLfAxNfq58iK7RRfXQJmtLCgG6zR

3MtPbV94Z2+jt7zsqhg64nvSJOiKN/Xgyl2wpgsS+vihq/7UnY3p6E374gGy/2QiyA9l

CM2Q==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1783076535; x=1783681335;

h=mime-version:date:content-transfer-encoding:subject:to:from

:references:in-reply-to:message-id:x-gm-gg:x-gm-message-state:from

:to:cc:subject:date:message-id:reply-to;

bh=O+gI0X3a/qfeECSjazz4MTYYU4lvWDAsewy4K3ppoJ8=;

b=DkkgTMM7cfPniuIOJV9TwdrUv4826QkUfp5sBsn20goSf9+6xX8okqezuzYMfY7ILX

BFwmvV3oRghGNJA6qLOV3WHWPRpT+cTv457BpEfgqXEL2kXckQPc3CRAKeOuMO+TELrE

XN1asDmX0v8NBZ+HFnTe4f9wgjalBqQgmsrnCQo91oykmqYMIT34xBEUHR8JSKKRuhNY

c+s89R2bZHltIjnvbUViwputjehZquLANNIsWAqpGlp3E73jNAIvAauH8N9v8ywwmNvR

ZVdTfFzGSV6I5RssktUBAXXI5IAOYT4xfBX6CRGUYbl+b9vL8IGYKzC//uCKkvUtSK5A

2hQA==

X-Gm-Message-State: AOJu0YyuRAMn/ldLCa8UAPF3rMh1NB6JAK+gjGmEp9q/rSF8wfLIEDCv

iHSTUe1oJCya6kQwz/dVbXue9ZCPwrb9SHmLOEHdqU2HW0DUgzvFJ+KPHAtWrSDKqjrfdBSKmob

9o/KGTQ==

X-Gm-Gg: AfdE7ckEuVKmU6fglak5/RNn679cs0x6MP5kKbrFe8qGqpsfyxPF7Fq5+BpL/LDpsn6

pNVBZOehVLV0nHrqjD9CzT+3HZpvlzTEa2LB/q14FtNuBQIwwgUkfGcEpPdPGijSVSxzQXqQdq2

lsFfM2xgmTgHJbSesV91aqajfhDTnotFL85n5hpK0C01JGUYFXNFwYP6dq1tA8E2x5cDnUADIks

0IGICzP+U730P5YxMAgyrwjUrecAVKlDud8F/X8IbCw2Kjphtt6uTJdw4dAeosdabPOKeOZQ0PK

QDVChNMVHVM347zNGqLgcjfz648Nxu/LM/m827/sRlqLMnwn2CqLn5OOgRO618I3EmGNUz0yqGs

Isp9XdKNuKUX8Z8eJ4f87hiacNaaWt/E6uQUMRC2gFrANcfiT48qln8Z17cORIxXaNEB8VFz3mO

HlxsQ45QTcWuXyZWzVpNCQWLYS7aNb5rFRgcbjs69ZK8ru1rSHC+7juwLgzjj59xgeiUTnorx8+

3GCz4UNmBMJ93R911DP3cZ7YzE/2m4aPnQUOmd97mtI0713gm5MgQ==

X-Received: by 2002:a05:622a:4205:b0:51c:21d1:3862 with SMTP id d75a77b69052e-51c26a3be8fmr139248201cf.8.1783076534838;

Fri, 03 Jul 2026 04:02:14 -0700 (PDT)

Received: from 019f27a4-b784-787e-8fc1-6458e989115d.local (ec2-100-53-155-212.compute-1.amazonaws.com. [100.53.155.212])

by smtp.gmail.com with ESMTPSA id d75a77b69052e-51c41b55495sm14445411cf.11.2026.07.03.04.02.14

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Fri, 03 Jul 2026 04:02:14 -0700 (PDT)

Message-ID: <019f27a4-b784-787e-8fc1-6458e989115d@persistpipelineops.pro>

In-Reply-To: <019f15d6-db19-7526-a562-54915909167c@persistpipelineops.pro>

References: <019f15d6-db19-7526-a562-54915909167c@persistpipelineops.pro>

X-Mail-Abuse-Inquiries:

https://app.instantly.ai/privacy/report-abuse/019f27a4-b784-787e-8fc1-6458e989115d

From: Gabriella Brooks

To: root@nk.ca

Subject: Re: clients for internet services

Content-Transfer-Encoding: quoted-printable

Date: Fri, 03 Jul 2026 11:02:14 +0000

MIME-Version: 1.0

Content-Type: text/plain; charset=utf-8

Hi,

Following up on my last note: we help service providers find clients =

using personalized outreach.

Best,

-Gabriella

Sent from my iPhone

On Tue, June 30, 2026 12:03 AM, Gabriella Brooks
ops.pro>

[gabriella@persistpipelineops.pro]> wrote:

> Hey,

>=20

> I was looking into how service providers like NK are handling clients =

growth, and wanted to connect.

>=20

> We're currently partnering with =

several firms like yours, and connecting them with individuals and =

businesses actively looking for internet services.

>=20

> We'd love to help you do the same. Got 15 minutes this week to chat about=

growing your clients base?

>=20

> Best,

> -Gabriella

> PersistIQ

>=20

> P.S: let me know if irrelevant.

>

Nigerian spam

Posted by Dave Yadallee on Friday, July 3. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 02 Jul 2026 18:56:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wfSBy-00000000JPO-2EZm

for dave@doctor.nl2k.ab.ca;

Thu, 02 Jul 2026 18:55:42 -0600

Resent-From: The Doctor

Resent-Date: Thu, 2 Jul 2026 18:55:42 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from wagin357.hostpapavps.net ([208.79.219.17]:48498)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wfRTt-00000000F5Z-0u2A

for doctor@nl2k.ab.ca;

Thu, 02 Jul 2026 18:10:18 -0600

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;

d=test.destiwellness.com; s=default; h=Message-Id:Date:Reply-To:MIME-Version:

Content-Type:To:Subject:From:Sender:Cc:Content-Transfer-Encoding:Content-ID:

Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc

:Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:

List-Subscribe:List-Post:List-Owner:List-Archive;

bh=hXQygRUk2uuLazBoqDOB9kdVDPPjTI53tN8mpkMxhIA=; b=mfMQR5XXap6a7BalMTXWj6SyxC

kobj3/2cNnk6aBW8GZecocz+O6rDCdGqm2MCLK69icFYYC52CpaKMLQrLPAgiBhkwWbNt0KrWqliE

Pr4k0hfiQbjO/mxJJ6YKyt6nXHvbutT4dy04uhnXCVfWfs//b8PbR1ID7w5L2v0722OtbOMSHkL61

djLVqlJeuBghylbDriyExYqyLlhwqbJWCg8+WJSRRJ9wUw0mhbKVG9O7DjzszoWjt1c3MM8Ng5oCm

xKRlKY+s7w5x2qAPGqfqDFxJpGymcZXQz6k6z6SoY42+Po1z47+o3W0t3I3vZINsgajNQQFlAx7sK

yxkCdtyA==;

Received: from [199.91.100.152] (port=23936 helo=DESKTOP-MO50RVL)

by wagin357.hostpapavps.net with esmtpsa (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.99.4)

(envelope-from )

id 1wfRT1-0000000Cf96-3JCq

for doctor@nl2k.ab.ca;

Fri, 03 Jul 2026 00:09:15 +0000

From: "breeden sarah"

Subject: Action Required

To:

Content-Type: multipart/alternative; boundary="Ol0gN2mBm63oiFnun7QVQPOhFqhnnBt=_h"

MIME-Version: 1.0

Reply-To:

Date: Thu, 2 Jul 2026 17:09:14 -0700

Message-Id: <02122026070917F639834732-B86F6AF8D9@test.destiwellness.com>

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - wagin357.hostpapavps.net

X-AntiAbuse: Original Domain - nl2k.ab.ca

X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]

X-AntiAbuse: Sender Address Domain - test.destiwellness.com

X-Get-Message-Sender-Via: wagin357.hostpapavps.net: authenticated_id: maria.smith@test.destiwellness.com

X-Authenticated-Sender: wagin357.hostpapavps.net: maria.smith@test.destiwellness.com

X-Source:

X-Source-Args:

X-Source-Dir:

X-Spam_score: 9.8

X-Spam_score_int: 98

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Nicht beanspruchte Gelder wurden unter Ihrem Namen registriert.

Bitte kontaktieren Sie Sarah Breeden und geben Sie zur ÃœberprÃ¼fung Ihren

vollstÃ¤ndigen Namen an. Bitte beachten Sie: Wenn diese Nachricht in Ihrem

Spam- oder Junk-Ordner erscheint, kÃ¶nnen Sie die Warnmeldung ignorieren,

da automatische E-Mail-Filter aktiv sind

Content analysis details: (9.8 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[208.79.219.17 listed in dnsbl.ahbl.org]

[208.79.219.17 listed in dnsbl.ahbl.org]

[208.79.219.17 listed in dnsbl.ahbl.org]

[208.79.219.17 listed in dnsbl.ahbl.org]

[199.91.100.152 listed in dnsbl.ahbl.org]

[199.91.100.152 listed in dnsbl.ahbl.org]

[199.91.100.152 listed in dnsbl.ahbl.org]

[199.91.100.152 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[208.79.219.17 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[208.79.219.17 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[208.79.219.17 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[208.79.219.17 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[199.91.100.152 listed in will-spam-for-food.eu.org]

[199.91.100.152 listed in will-spam-for-food.eu.org]

[199.91.100.152 listed in will-spam-for-food.eu.org]

[199.91.100.152 listed in will-spam-for-food.eu.org]

[199.91.100.152 listed in will-spam-for-food.eu.org]

[199.91.100.152 listed in will-spam-for-food.eu.org]

[199.91.100.152 listed in will-spam-for-food.eu.org]

[199.91.100.152 listed in will-spam-for-food.eu.org]

[208.79.219.17 listed in will-spam-for-food.eu.org]

[208.79.219.17 listed in will-spam-for-food.eu.org]

[208.79.219.17 listed in will-spam-for-food.eu.org]

[208.79.219.17 listed in will-spam-for-food.eu.org]

[208.79.219.17 listed in will-spam-for-food.eu.org]

[208.79.219.17 listed in will-spam-for-food.eu.org]

[208.79.219.17 listed in will-spam-for-food.eu.org]

[208.79.219.17 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[199.91.100.152 listed in sbl-xbl.spamhaus.org]

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Listed by XBL, see ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[breeden.sarah11(at)gmail.com]

2.7 UNCLAIMED_MONEY BODY: People just leave money laying around

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[208.79.219.17 listed in bl.score.senderscore.com]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

Subject: {SPAM?} Action Required

This is a multi-part message in MIME format

--Ol0gN2mBm63oiFnun7QVQPOhFqhnnBt=_h

Content-Type: text/plain; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

Nicht beanspruchte Gelder wurden unter Ihrem Namen registriert. Bitte =

kontaktieren Sie Sarah Breeden und geben Sie zur =DCberpr=FCfung Ihren=

vollst=E4ndigen Namen an.

Bitte beachten Sie: Wenn diese Nachricht in Ihrem Spam- oder Junk-Ordn=

er erscheint, k=F6nnen Sie die Warnmeldung ignorieren, da automatische=

E-Mail-Filter aktiv sind

--Ol0gN2mBm63oiFnun7QVQPOhFqhnnBt=_h

Content-Type: text/html; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

8859-1">

le=3D1">
itle>Action Required

Uncla=

imed funds have been registered in your name. Please contact Sarah Bre=

eden and provide your full name for verification.

&=

nbsp;

Please note: If this message app=

ears in your spam or junk folder, you can ignore the warning, as autom=

atic email filters are active.

--Ol0gN2mBm63oiFnun7QVQPOhFqhnnBt=_h--

Dragonfly/Intelcom phish from Godaddy mail

Posted by Dave Yadallee on Friday, July 3. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 02 Jul 2026 18:56:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wfSBc-00000000JOV-2Mch

for dave@doctor.nl2k.ab.ca;

Thu, 02 Jul 2026 18:55:20 -0600

Resent-From: The Doctor

Resent-Date: Thu, 2 Jul 2026 18:55:20 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from intranet.graceworks.org ([64.207.153.176]:50268)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wfQfy-000000001gc-04Xh

for sales@nk.ca;

Thu, 02 Jul 2026 17:18:42 -0600

Received: from bhcareorg by adedc.tempdomain.com with local (Exim 4.99.4)

(envelope-from )

id 1wfQf9-000000000g0-2NKr

for sales@nk.ca;

Thu, 02 Jul 2026 23:17:43 +0000

To: sales@nk.ca

Subject: Intelcom Delivery Notification

X-PHP-Script: wmail.bethanyvillagehomecare.org/ecpyfbw/tjq1ufe/dk1qaxf/index.php for 196.75.47.209

X-PHP-Originating-Script: 1017:index.php

Date: Thu, 2 Jul 2026 23:17:43 +0000

From: Intelcom

Message-ID: <78c90ef2bfed88a0a5735946c100e585@wmail.bethanyvillagehomecare.org>

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="b1_78c90ef2bfed88a0a5735946c100e585"

Content-Transfer-Encoding: 8bit

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - adedc.tempdomain.com

X-AntiAbuse: Original Domain - nk.ca

X-AntiAbuse: Originator/Caller UID/GID - [1017 995] / [47 12]

X-AntiAbuse: Sender Address Domain - wmail.bethanyvillagehomecare.org

X-Get-Message-Sender-Via: adedc.tempdomain.com: authenticated_id: bhcareorg/from_h

X-Authenticated-Sender: adedc.tempdomain.com: support@wmail.bethanyvillagehomecare.org

X-Source:

X-Source-Args: php-fpm: pool wmail_bethanyvillagehomecare_org

X-Source-Dir: bethanyvillagehomecare.org:/wmail.bethanyvillagehomecare.org/ecpyfbw/tjq1ufe/dk1qaxf

This is a multi-part message in MIME format.

--b1_78c90ef2bfed88a0a5735946c100e585

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit

Â

Intelcom

Delivery Update

Your package is currently being processed and requires a small fee for customs handling.

Amount due: 2.96 CAD

Please confirm your delivery details to ensure a smooth delivery experience.

Manage My Delivery

This is an automated message. Please do not reply.

Â© 2026 Intelcom Express

--b1_78c90ef2bfed88a0a5735946c100e585

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: 8bit

Â

Intelcom

Delivery Update

Your package is currently being processed and requires a small fee for customs handling.

Amount due: 2.96 CAD

Please confirm your delivery details to ensure a smooth delivery experience.

Manage My Delivery

This is an automated message. Please do not reply.

Â© 2026 Intelcom Express

--b1_78c90ef2bfed88a0a5735946c100e585--

BTS PAyPal phish from Microsoft OUtlook Part 4

Posted by Dave Yadallee on Thursday, July 2. 2026

Haresasz Nxysarwsa has invited you to PayPal Transaction Successful – BTC Order Pending Completion

Title: PayPal Transaction Successful – BTC Order Pending Completion

When: July 2, 2026

Organizer:

Haresasz Nxysarwsa

Description: Dear Customer,

Thank you for your recent PayPal payment. Your Bitcoin order has been received and is now awaiting final confirmation.

Order Summary:

Asset Purchased: Bitcoin (BTC)

Payment Method: PayPal

Total Amount: $500.00

Status: Pending Completion

Please allow a short period for processing as our system validates the transaction details.

If you do not recognize this payment, please call +1 656 556 2170 immediately.

Best Regards,

Order Processing Department

Attendees:

cynthiaperez389903@groups.outlook.com

PayPal Transaction Successful – BTC Order Pending Completion

Dear Customer, Thank you for your recent PayPal payment. Your Bitcoin order has been received and is now awaiting final confirmation. Order Summary: Asset Purchased: Bitcoin (BTC) Payment Method: P

Dear Customer,

Thank you for your recent PayPal payment. Your Bitcoin order has been received and is now awaiting final confirmation.

Order Summary:

Asset Purchased: Bitcoin (BTC)

Payment Method: PayPal

Total Amount: $500.00

Status: Pending Completion

Please allow a short period for processing as our system validates the transaction details.

If you do not recognize this payment, please call +1 656 556 2170 immediately.

Best Regards,

Order Processing Department

Kedy

štvrtok 2. júl 2026

Organizátor

Haresasz Nxysarwsa

haressaznzxrrsxaxz321@gmail.com

Hostia

(Zoznam hostí bol na žiadosť organizátora skrytý)

Odpoveď na cynthiaperez389903@groups.outlook.com

Áno

Nie

Možno

Ďalšie možnosti

Pozvánka z Kalendára Google

Túto správu ste dostali, pretože ste účastníkom danej udalosti.

Ak túto pozvánku prepošlete, ktorýkoľvek jej príjemca bude môcť odoslať odpoveď organizátorovi, byť pridaný do zoznamu hostí, pozývať iných bez ohľadu na ich vlastný stav pozvánky alebo meniť vaše potvrdenie účasti. Ďalšie informácie

BTS PAyPal phish from Microsoft OUtlook Part 2

Posted by Dave Yadallee on Thursday, July 2. 2026

X-Microsoft-Antispam-Message-Info:

=?utf-8?B?UnNCdllzY1lneHpUZWp0d1BFcVB2SVkrNDlXSXh3VzU5b2VmMllvTVhYQmp5?=

=?utf-8?B?cGdOQWt1VVVrbEJXekNNQm1hWElBSmtyWHZuNml2aWV0QkJxRkE2UEE2S2Qx?=

=?utf-8?B?VEpuYU94d2g1T2txSFgyaFduVForU2thOWo1cHNKcHFtQWIvSlJHQ0U0K09m?=

=?utf-8?B?U2RwazdlK3ByajZhSk5DRXNyRy9jWWZLYy80QXNRUGRlaUdiTTVyWDRNMC9I?=

=?utf-8?B?Q1NqS0Z3NVRmeWttTE0xdTB1WHZnQ0pNdis2dlRNazNKMGtoeDFKQ3RPZjF4?=

=?utf-8?B?VXhsQmNYelphUUtvUk91YUhQU0ZWMENnYkxHNmEwRDdLcmNNcE5hZVFQMHB1?=

=?utf-8?B?RmRNM1R2d0pleE02RENRUE5XMzJhdVM3OERJdXd6dHFzdG1Dc3cyaC9COVBL?=

=?utf-8?B?dytRWHZzZmxDQXZ6bUpjWFRuaVRPeFpJNzZCejkxcysrUUJhTTlKRk0yK2wy?=

=?utf-8?B?RlhqK1hNS1FMR3lBZlZTSjVkZGJ3MDVxNGtPMytQYm16WnFMRHVEQUp4SUdZ?=

=?utf-8?B?dUE4ZVluOHZUQkhQM1NNL09NbFMzcm5ja0U2ajU2YnNpcjdxclZIc3FiNUdZ?=

=?utf-8?B?dmZzM2NXdWtPak9veStmd0xBQWlqQ0dWT3JvbjRMTUxOdk1ZUmRDMWNpRU42?=

=?utf-8?B?dEpSRmtNL3cvYzRlZ0RZY0cyME14cXlRS3pPTTF4dWJ1V0I2MzRXazkzZURZ?=

=?utf-8?B?WkV5NngycHk5RGo0RkJmU3FMY1ZiREt4SmoxL2FDNis5Q005RGtRVVc2YUd6?=

=?utf-8?B?TkczRjBSallnQjhrWjJocW8xQlFpeWdaa2dOdFhkSFEzVWZyaEo2YUt0TzVt?=

=?utf-8?B?OWVSRXdjQ2RmdldPYWphc2pDSnNIbXQ2Q1NDYmQ1bzJmQUxaSDZiTWxzMVNY?=

=?utf-8?B?UkNaMUpNZU9pZnc1L29HY0k1aDAyb0U5MzE3dHZvMlJnc0R6S0hhSHBaNHBV?=

=?utf-8?B?cFI4SFZ2U3FtVmRqVnRxY0pnd2RkUUFXTkU2VG1SWGFyS3BYT1I3WmhOWU9U?=

=?utf-8?B?andWamFnZUkwTmg2djhPR3FXTkJmVExkcjc0L2dUOHZ5eGl4ZjJHU0lHcWow?=

=?utf-8?B?ekhuK3lzWU5DRnd2MElWZ0xVNnFORlZubVpxRW1uQ3pnQys1TlRyc0U0RXBE?=

=?utf-8?B?SzREVTI3WlRJeDVZK0paVEZkdkFISTAycTZOVlhpa2hjRGltNE0yQ2pzcFF5?=

=?utf-8?B?N2tCV09UOWF4VTdBNC82N3RYdk11K2pyVXJyYnJCN0hVa29mcWRVbWhGUTd3?=

=?utf-8?B?YlRDL0g3RnFHak9YYktsQVgvZXNKZzhHUmh4TlB5VGsxQnRQWDB0MGtlS2I0?=

=?utf-8?B?YXk4NWdiYkRDdUh2dEk1UGVFRUdCeDdYNUdXMitGbkJEVlNjRDBiNnduaW15?=

=?utf-8?B?aUlhZEQyU2FFNytGU3JCa0d6NlRMTTUyOWJmUHYrU29jRllJZG9FMitGblJE?=

=?utf-8?B?ell5MzV2aEEyR29qQjdrdnNnZ3dCQjFPbGRuandrNDNMNzFqTDM3UnNmUWVW?=

=?utf-8?B?bWlxOFpXMy9paUFYSHNFdHloaGYrc00veDdjRStsVWppRHhlYldTTE9qeG90?=

=?utf-8?B?OFhyd1VXR0lyRUQwVlU0TTBZL2NqUDYzQThqTTkzR1Iyc0NsL25FQTQvYVdy?=

=?utf-8?B?SExLUzg0ZjlvU0JFTHd2NzJHd0VEYTNkV244dFFJU2p5M0s5cjVPM25HZjJs?=

=?utf-8?B?b1RKdDh6QWliV0U0QUd1WlZPZ1RHUno0SW9wV1ZnbWNDSlAzd2tXMUlWdXNt?=

=?utf-8?B?eXZiYUNMTHp5TmFXMkVlU0hTVHhtbHh1MnlEb2owbmV1QmRxUHRCd1JDQi8r?=

=?utf-8?B?U2lOMitTUWZPWTlqQVlpY0xsdnpoQlRtNzRSTzJMMkpGbzl0WGFjT1ZNRjNP?=

=?utf-8?B?LzBGZXRtTHg1ZlR0L3E5V0lib3hNMDJEWm5KRTF5MDcxZnBZbklhb1IvSmN0?=

=?utf-8?B?MFBZbVErVjlYbTF6WkozK0x2T1dTWkpYQ3ljclBIbFJSSWR1azg5ZTBPMThI?=

=?utf-8?B?anUxamJ1NVdXRFlWd05UN2RPdEMxQ2tURkwxd2JYd1pQczZxSkVSYktQbWtM?=

=?utf-8?B?YUd1a1lhUm5GTGpZY3g0MkdCWDFBclM1UDdIcGU0ZGJXOElBRmJxSUFtWTBo?=

=?utf-8?B?eG12dnBaYUJsQ1NKMmI0QVpFM2FPM0tYWkx3T3JsQWw0WGJVOFlyby9NcEZB?=

=?utf-8?B?bHZJRk1HUGZBQU9CMWRnYzdTQXdpWE5ac2R4cXdGUlc0RXBGNWd1alZUVlJw?=

=?utf-8?B?aHNmUFZkMURNTE54OGt3amhNeHUvZmcvVG5WVzgvT1R6L1JZSkRCOFBKak1Z?=

=?utf-8?B?OEpibmVSd0ZXMHI1dE9ZSjZOL0ptYm04NjY1NFNqQkdHb2VJRElsT09md3Z1?=

=?utf-8?B?TFo1S09tbFRPcWxBNEVwWWVoZDZ4S0JkVXlmaHptTXZKQjB4a0orVjZOYVh6?=

=?utf-8?B?czh4ZFptYWtCbDZrcWxTdmd6ZlkxSzA3M0lxZ09kVW5pQlFkVlFqVnZlRWhX?=

=?utf-8?B?MkN0VXpraldKZDBFSENraEZPQkdKMEpmZEZvbzFYUEtud0NiMEZpVlMxRCsr?=

=?utf-8?B?ZngvMUU3YjEyM2JpV3JIVnRzUjhSWGovTEdYQ2h0OWtXY1Z0VnQrWHhLcmdO?=

=?utf-8?B?cUo3ODBwN2ZKM0JJOElhbGZ3czFxVkp5d29JU2Mxd3ptb0NLNEc1SjhxQ0d5?=

=?utf-8?B?Zjd1NHdhTEtXZXY5emJzRTJxSDhoQ0hMbjdmdVFrVzYza2hQakhONkNnRTVm?=

=?utf-8?B?MmJNSUh3QVV3aUJKcisrTFF3dXNKNnFpUG1mR2o5Uk1OZjdVbk8rWFMyRVRN?=

=?utf-8?B?QjRBbGhxV3dTRkI0SXozbXhvWXdqaTR1Y0FWaVRuaHEycFk5c3p2aU5WSWJB?=

=?utf-8?B?aUxlamh5ODJaVlErdWt1dHJEQ3hwSmJPY2xRTEZDWStLVFhKd1NKY0NicEpH?=

=?utf-8?B?WkhEcjNqWURGR0dYVThWMlUxOWhNdDRHZitNRHBkdXZJdGVKSDRlMVYyakVR?=

=?utf-8?B?RVNoRTRLQUh1OHE5M0hBeXZhcisveGVhSkIrRjBuc2NDcUlad0dpL3ZBVzNC?=

=?utf-8?B?d2kvMlI3aWV0ejlUNCtCU2FpeERXaXdHb0JFM05YNnhmbnlMekYxdXd2RXRK?=

=?utf-8?B?bTdBV2w1bVJFYkdLVU9FTlltSEdtQ1N5bE50UzRaVW55QnpvZFE4eWljS1c2?=

=?utf-8?B?QjM2YlBnM0tjMGFYTklXeUQxNjMwRzF3TXVINVBiQUxnSENLZ2FsWGZNNjZM?=

=?utf-8?B?Z1AxZUtqRkNHWGVNRzIzc0ZSNVloajlQV0tRNWZhdktxZXFDeGdhVWdoZDY1?=

=?utf-8?B?V0FyTmgzaVBkeG1LaXdHVy9ZVGkwVngwbXZrdG5tNmUxb2pGbC9BN09mSFdT?=

=?utf-8?Q?+Wlvr5g3XscUmudDd7iJH?=

X-Auto-Response-Suppress: DR, OOF, AutoReply

X-OriginatorOrg: sct-15-20-9412-4-msonline-outlook-090a5.templateTenant

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 02 Jul 2026 16:43:11.1717

(UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id: 53405f02-fd79-45c3-c921-08ded85900e7

X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-AuthSource: BL6PEPF0001AB54.namprd02.prod.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: Internet

X-MS-Exchange-Transport-CrossTenantHeadersStamped: MW5PR18MB5065

X-Spam_score: 13.7

X-Spam_score_int: 137

X-Spam_bar: +++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: PayPal Transaction Successful â€“ BTC Order Pending Completion

Å¡tvrtok 2. jÃºl 2026 Dear Customer, Thank you for your recent PayPal payment.

Your Bitcoin order has been received and is now awaiting final confirmation.

Content analysis details: (13.7 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[40.93.2.53 listed in dnsbl.ahbl.org]

[40.93.2.53 listed in dnsbl.ahbl.org]

[40.93.2.53 listed in dnsbl.ahbl.org]

[40.93.2.53 listed in dnsbl.ahbl.org]

[2603:10b6:408:fb:0:0:0:16 listed in]

[dnsbl.ahbl.org]

[2603:10b6:408:fb:0:0:0:16 listed in]

[dnsbl.ahbl.org]

[2603:10b6:408:fb:0:0:0:16 listed in]

[dnsbl.ahbl.org]

[2603:10b6:408:fb:0:0:0:16 listed in]

[dnsbl.ahbl.org]

[2603:10b6:408:fb:cafe:0:0:66 listed in]

[dnsbl.ahbl.org]

[2603:10b6:408:fb:cafe:0:0:66 listed in]

[dnsbl.ahbl.org]

[2603:10b6:408:fb:cafe:0:0:66 listed in]

[dnsbl.ahbl.org]

[2603:10b6:408:fb:cafe:0:0:66 listed in]

[dnsbl.ahbl.org]

[209.85.128.69 listed in dnsbl.ahbl.org]

[209.85.128.69 listed in dnsbl.ahbl.org]

[209.85.128.69 listed in dnsbl.ahbl.org]

[209.85.128.69 listed in dnsbl.ahbl.org]

BTS PAyPal phish from Microsoft OUtlook Part 3

Posted by Dave Yadallee on Thursday, July 2. 2026

Content analysis details: (13.7 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[40.93.2.53 listed in dnsbl.ahbl.org]

[40.93.2.53 listed in dnsbl.ahbl.org]

[40.93.2.53 listed in dnsbl.ahbl.org]

[40.93.2.53 listed in dnsbl.ahbl.org]

[2603:10b6:408:fb:0:0:0:16 listed in]

[dnsbl.ahbl.org]

[2603:10b6:408:fb:0:0:0:16 listed in]

[dnsbl.ahbl.org]

[2603:10b6:408:fb:0:0:0:16 listed in]

[dnsbl.ahbl.org]

[2603:10b6:408:fb:0:0:0:16 listed in]

[dnsbl.ahbl.org]

[2603:10b6:408:fb:cafe:0:0:66 listed in]

[dnsbl.ahbl.org]

[2603:10b6:408:fb:cafe:0:0:66 listed in]

[dnsbl.ahbl.org]

[2603:10b6:408:fb:cafe:0:0:66 listed in]

[dnsbl.ahbl.org]

[2603:10b6:408:fb:cafe:0:0:66 listed in]

[dnsbl.ahbl.org]

[209.85.128.69 listed in dnsbl.ahbl.org]

[209.85.128.69 listed in dnsbl.ahbl.org]

[209.85.128.69 listed in dnsbl.ahbl.org]

[209.85.128.69 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[40.93.2.53 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[40.93.2.53 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[40.93.2.53 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[40.93.2.53 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.128.69 listed in will-spam-for-food.eu.org]

[209.85.128.69 listed in will-spam-for-food.eu.org]

[209.85.128.69 listed in will-spam-for-food.eu.org]

[209.85.128.69 listed in will-spam-for-food.eu.org]

[209.85.128.69 listed in will-spam-for-food.eu.org]

[209.85.128.69 listed in will-spam-for-food.eu.org]

[209.85.128.69 listed in will-spam-for-food.eu.org]

[209.85.128.69 listed in will-spam-for-food.eu.org]

[2603:10b6:408:fb:cafe:0:0:66 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:408:fb:cafe:0:0:66 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:408:fb:cafe:0:0:66 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:408:fb:cafe:0:0:66 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:408:fb:cafe:0:0:66 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:408:fb:cafe:0:0:66 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:408:fb:cafe:0:0:66 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:408:fb:cafe:0:0:66 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:408:fb:0:0:0:16 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:408:fb:0:0:0:16 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:408:fb:0:0:0:16 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:408:fb:0:0:0:16 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:408:fb:0:0:0:16 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:408:fb:0:0:0:16 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:408:fb:0:0:0:16 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:408:fb:0:0:0:16 listed in]

[will-spam-for-food.eu.org]

[40.93.2.53 listed in will-spam-for-food.eu.org]

[40.93.2.53 listed in will-spam-for-food.eu.org]

[40.93.2.53 listed in will-spam-for-food.eu.org]

[40.93.2.53 listed in will-spam-for-food.eu.org]

[40.93.2.53 listed in will-spam-for-food.eu.org]

[40.93.2.53 listed in will-spam-for-food.eu.org]

[40.93.2.53 listed in will-spam-for-food.eu.org]

[40.93.2.53 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[40.93.2.53 listed in list.dnswl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[40.93.2.53 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[40.93.2.53 listed in wl.mailspike.net]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

1.0 HK_RANDOM_FROM From username looks random

1.0 HK_RANDOM_REPLYTO Reply-To username looks random

0.5 FROM_LOCAL_NOVOWEL From: localpart has series of non-vowel letters

3.5 VOWEL_FROM_7 Impronouncable from header (7+ consecutive vowels)

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[haressaznzxrrsxaxz321(at)gmail.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[haressaznzxrrsxaxz321(at)gmail.com]

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.6 MEGALONGWORD BODY: Uses really overlong words

0.3 LONGWORD BODY: Uses overlong words

0.1 TW_RW BODY: Odd Letter Triples with RW

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

3.0 LONG_INVISIBLE_TEXT Long block of hidden text - bayes poison?

0.2 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and EnvelopeFrom

freemail headers are different

0.1 TO_IN_SUBJ To address is in Subject

Subject: {SPAM?} =?UTF-8?Q?Pozv=C3=A1nky=3A_PayPal_Transaction_Successful_=2D_BTC_Order?=

=?UTF-8?Q?_Pending_Completion_=40_=C5=A1t_2=2E_j=C3=BAl_2026_=28cynthiaperez389903=40g?=

=?UTF-8?Q?roups=2Eoutlook=2Ecom=29?=

BTS PAyPal phish from Microsoft OUtlook Part 1

Posted by Dave Yadallee on Thursday, July 2. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 02 Jul 2026 14:40:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wfOBl-00000000Ail-1MFs

for dave@doctor.nl2k.ab.ca;

Thu, 02 Jul 2026 14:39:13 -0600

Resent-From: The Doctor

Resent-Date: Thu, 2 Jul 2026 14:39:13 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-eastusazlp17011053.outbound.protection.outlook.com ([40.93.2.53]:55824 helo=BL2PR02CU003.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wfKWN-00000000BJL-3tes

for doctor@doctor.nl2k.ab.ca;

Thu, 02 Jul 2026 10:44:29 -0600

Received: from BN9PR03CA0041.namprd03.prod.outlook.com (2603:10b6:408:fb::16)

by MW5PR18MB5065.namprd18.prod.outlook.com (2603:10b6:303:1a9::13) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.181.8; Thu, 2 Jul 2026

16:43:11 +0000

Received: from BL6PEPF0001AB54.namprd02.prod.outlook.com

(2603:10b6:408:fb:cafe::66) by BN9PR03CA0041.outlook.office365.com

(2603:10b6:408:fb::16) with Microsoft SMTP Server (version=TLS1_3,

cipher=TLS_AES_256_GCM_SHA384) id 15.21.181.9 via Frontend Transport; Thu, 2

Jul 2026 16:43:11 +0000

Authentication-Results: spf=pass (sender IP is 209.85.128.69)

smtp.mailfrom=gmail.com; dkim=pass (signature was verified)

header.d=google.com;dkim=pass (signature was verified)

header.d=gmail.com;dmarc=pass action=none header.from=gmail.com;compauth=pass

reason=100

Received-SPF: Pass (protection.outlook.com: domain of gmail.com designates

209.85.128.69 as permitted sender) receiver=protection.outlook.com;

client-ip=209.85.128.69; helo=mail-wm1-f69.google.com; pr=C

Received: from mail-wm1-f69.google.com (209.85.128.69) by

BL6PEPF0001AB54.mail.protection.outlook.com (10.167.241.6) with Microsoft

SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.181.6

via Frontend Transport; Thu, 2 Jul 2026 16:43:11 +0000

X-IncomingTopHeaderMarker:

OriginalChecksum:D16D66D7C904E7F3A17106EC017B2319D8073A9235C61EF82B82F5B54EF6E84F;UpperCasedChecksum:EEFA245AFD5616934EA644AA8C92C203DDD4CE88CF1CEBA5F48C30C7B10C0FA8;SizeAsReceived:3536;Count:15

Received: by mail-wm1-f69.google.com with SMTP id 5b1f17b1804b1-493ae2a6a72so15429555e9.0

for ; Thu, 02 Jul 2026 09:43:11 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=google.com; s=20251104; t=1783010590; x=1783615390; darn=groups.outlook.com;

h=content-type:to:from:subject:date:message-id:sender:reply-to

:mime-version:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=CVQcRV2LDnnnEu4HJp63hoBHVxl8U508EGEkzdzD4nc=;

b=BGnTntHA1jUARIyBci1hCREvVMlCpyGB5LK7lGqqGgn2eh4O/kLtKmqm4m3L1w37Qh

ZNRxZ0d2mJnjvA6uSNnogVYsMZHWcUx2qUmPVR1a3wfPzhGELTTw8W7FqkLIoiisKIJb

jxCZKkj0iufg9MXPEaFdA2C3ymCD5m4IIp6/8dQTYDyyqEuIb20SxX+M5GC+l6qdOxC6

ruX0eLqYqw2JTEZJ/zg0oQE0EUI8x+7SkTatVTeSfpoAvWLMPGeQXMbpRw08OYYv3sMT

A2AonkhsNho28Q1710Jo2lGfNQcqYknzVJPoYbdRVEIqXVzixiOYTVwBF028DQN/lunH

diPw==

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1783010590; x=1783615390; darn=groups.outlook.com;

h=content-type:to:from:subject:date:message-id:sender:reply-to

:mime-version:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=CVQcRV2LDnnnEu4HJp63hoBHVxl8U508EGEkzdzD4nc=;

b=a5jTtPcySvhnlTibGBSqywe/uA+XwTiaABeNY5FTJW/DuPJsYi+qF2/8FnNV7SJoI7

OWhD/uFKuO8F2di3GdxujaibUxyUsXQZVx7xmXaiL4cRH1u/+TRpXrww+tTjlvq7rXg1

j8NleG4se7MiDaOLBG9lZDrmutMhTlFipm0H/iezKVXnW+vuen9uFRIGztOW8cOJRScL

QsPBA/kK2fpWvhkjvc+hJ2cGe2vVRCjeWD0fp8xfiZP9gDsp904aFjtzc83gbYNBMAO1

TeA0ii75ZlebQv8miUHqtiUs/96fRjtgTvGxYO2zi5UYZXW9DItOuY0djfWjclUeTdYb

4c7g==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1783010590; x=1783615390;

h=content-type:to:from:subject:date:message-id:sender:reply-to

:mime-version:x-gm-message-state:from:to:cc:subject:date:message-id

:reply-to:content-type;

bh=CVQcRV2LDnnnEu4HJp63hoBHVxl8U508EGEkzdzD4nc=;

b=BWNQeGrkJGZRo0RWRwWL4V2u1tPMotLAHamdhJoQAFMvogMqGxx247w9XYPG12mpPD

8NkL/EGSGp1IMAH1wFzykpBIQUujL0jeeayvdyRKSr9B2T/n2Qt1X8SG1q8IVTqzggif

kfrtp8f7dbK4YygppGTA+I8JdP6aGumAgCZy2n1YxjuM9jL0z+a3+aQqX4RLJs54RIs8

/TvhE6DCO05yuqNn+Zj5rvh1WbUoSQdkPofl9M8YDJcZI09P//cLZfi8oNShR3Hx8rOc

yWoOmwQ1D2BytaXpldPGvoSBYpeZXlIJQA+3OpLKEbf5Ua8eCMu2tgJc7kvfFCZm7Fpo

MHEw==

X-Gm-Message-State: AOJu0YzLhDIIIY2RGhRImbHvgwcKM+8gKZqz7wjbXVmkrKbolZUGFgC4

9iwFF6P1d8dNmyAWA53Ym0VygqlOrObrz9peox21K/8N2s4oZc5uIBUaZxbAK8gM5CoYwVSreLy

4DI9a8UkzWAlskaY6+d2Z/VK5Gwkd+8Hh2V0=

MIME-Version: 1.0

X-Received: by 2002:a05:600d:6452:20b0:493:a8eb:5142 with SMTP id

5b1f17b1804b1-493c3cd4ab0mr69615545e9.5.1783010589966; Thu, 02 Jul 2026

09:43:09 -0700 (PDT)

Reply-To: Haresasz Nxysarwsa

Sender: =?UTF-8?Q?Kalend=C3=A1r_Google?=

Message-ID:

Date: Thu, 02 Jul 2026 16:43:09 +0000

Subject: =?UTF-8?Q?Pozv=C3=A1nky=3A_PayPal_Transaction_Successful_=2D_BTC_Order?=

=?UTF-8?Q?_Pending_Completion_=40_=C5=A1t_2=2E_j=C3=BAl_2026_=28cynthiaperez389903=40g?=

=?UTF-8?Q?roups=2Eoutlook=2Ecom=29?=

From: Haresasz Nxysarwsa

To: cynthiaperez389903@groups.outlook.com

Content-Type: multipart/mixed; boundary="000000000000d889fb0655a38042"

X-IncomingHeaderCount: 15

X-EOPAttributedMessage: 0

X-EOPTenantAttributedMessage: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa:0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: BL6PEPF0001AB54:EE_|MW5PR18MB5065:EE_

X-MS-Office365-Filtering-Correlation-Id: 53405f02-fd79-45c3-c921-08ded85900e7

X-Sender-IP: 209.85.128.69

X-MS-Exchange-EOPDirect: true

X-SID-PRA: HARESSAZNZXRRSXAXZ321@GMAIL.COM

X-SID-Result: PASS

X-MS-Consumer-Group-Expansion-Loop: cynthiaperez389903@groups.outlook.com

X-MS-Exchange-Group-Expansion-Loop: cynthiaperez389903@groups.outlook.com

X-Microsoft-Antispam:

BCL:0;ARA:1444111002|4040799016|6092099016|32020799003|26130799012|26000799027|9000799056|9400799043|16001999021|1680799066|970799063|24102599021|5139299004|22000799015|9020799019|34130799006|16200799027|6019299003|3151999006|29080799009|26104999009|440099028|3412199025|21002599022;

Chinese products spam

Posted by Dave Yadallee on Thursday, July 2. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 02 Jul 2026 14:40:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wfOC2-00000000Akz-3XzR

for dave@doctor.nl2k.ab.ca;

Thu, 02 Jul 2026 14:39:30 -0600

Resent-From: The Doctor

Resent-Date: Thu, 2 Jul 2026 14:39:30 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-m158225.netease.com ([47.251.158.225]:28162)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wfKnT-00000000DoK-1p8a

for sales@nk.ca;

Thu, 02 Jul 2026 11:02:10 -0600

Content-Type: multipart/alternative; BOUNDARY="=_Part_1991693_185639118.1783011657155"

To: sales

Reply-To: sales23@abiscircuits.com

Subject: =?UTF-8?B?UmU6UmU6RnVsbCB0cmFjZWFiaWxpdHkgZm9yIHlvdXIgbWVkaWNhbCBQQ0JBcw==?=

X-Priority: 3

MIME-Version: 1.0

Received: from diana@abiscircuits.cn( [10.139.1.59] ) by ajax-webmail ( [127.0.0.1] ) ; Fri, 3 Jul 2026 01:00:57 +0800 (GMT+08:00)

From: Diana

Date: Fri, 3 Jul 2026 01:00:57 +0800 (GMT+08:00)

X-WM-Tid: 0a9f23c6c5a5d0c0kusybea8e5ac27eea4

DKIM-Signature: a=rsa-sha256;

b=dIbHQ9qQNisjUtmKU6JFJAiVXAoH8JW3mHxhz8Rj+O9HYO3GOq8mS2yNPXqRz3iT3iWIIr9qefq3yqMewTmQYVlfa6Pboyx2f9jzA0Cdm8LyB49UxmqWC+QoS268Nu9xGYGrANIEgCxFIlrHqVP6efs9dB0Y+UazqtdZObuAZEs=; c=relaxed/relaxed; s=default; d=abisassembly.net; v=1;

bh=uEAGZgdYlSBmQqHq7r4XO9X3PCRUjRx6yEtdr+W3ot4=;

h=date:mime-version:subject:message-id:from;

Message-ID:

Hi sales,

I hope everything is going well for you.it's Diana again .

May l know if you are considering moving some circuit boards to China for manufacturing &assembly?

Would you opening another door to add one more EMS PCBA partner for evaluation?

We appreciate your interest and are here if you have any questions

Looking forward to your reply.

Diana Dai

Project Representative | ABIS Circuits Co., Ltd

Rigid PCB, Flex PCB, Rigid-Flex 1~32 Layer PCB, Metal PCB, HDI PCB, PCBA

Mobile / Whatsapp / Wechat: +86 13510754753

Email: sales23@abiscircuits.com / diana@abiscircuits.cn

Website: abiscircuits.com

Nigerian spam Part 2

Posted by Dave Yadallee on Thursday, July 2. 2026

This is a multi-part message in MIME format

--c8mETELxN=_xl33ZIoXc7YMbNIcmyZPW9H

Content-Type: text/plain; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

Dear Friend,

As you very well know, after the US and Iran war. Iraq is gradually un=

dergoing a rebuilding process in some parts and there is much need for=

reconstruction. I am Bill Betterman from the hospitality state (Missi=

ssippi), an army contractor attached to the US Military force for the =

sole purpose of Reconstruction works in some parts of Iraq. I evaluate=

the level of destruction and offer professional advice inline with th=

e way they intend rebuilding. With no doubt, work has been risky and c=

hallenging as we sometimes collide head on with armed insurgents and l=

oose some soldiers during confrontation.

On the early hours of 25th June 2026 I lost a friend whom I had known =

for 12years during one of these confrontations. It was a very sad day =

but at about 1100hrs during a normal inspection routine along Haifa St=

reet, built and occupied by the descendants of late Hussein and one of=

the hide outs of the Al Qaeda and Ayman al-Zawahiri forces. I, along =

side with 3 soldiers proceeded to a marked site and as I commenced eva=

luation under close guard by the 3 soldiers, I discovered an unusual b=

ulge in a cellar, which I presumed to be storage room and as I proceed=

ed to have a closer look at it, I kicked a metal covering and found se=

veral metal boxes (6 in number)Piled on top each other and locked with=

a padlock. On forcing the boxes open, we discovered several armored w=

eapons including bullets. One of the boxes was filled with hard drugs =

(heroine) and two to my amazement was filled with money. On discovery =

of this money, I and the soldiers for hours counted bundles of the cur=

rencies which amounted to about $10.5M.I believe however that all thes=

e belongs to the Al Qaeda and Ayman al-Zawahiri forces, and because of=

this reason, I instructed the soldiers with me to handover all the bo=

xes containing the drugs and amours to our superiors in the US army an=

d agreed to keep the funds to ourselves, so as to help establish ourse=

lves when we return from Iraq. Presently, we have the money hidden in =

a safe and untraceable location only known to us.

Why I am explaining all our findings to you is to seek for your assist=

ance and immense contribution to the actualization of our dream of get=

ting these funds out from here. We are in desperate need of a reliable=

and trustworthy person who will receive, secure and protect these box=

es containing the money for us until our assignment ends here. Since I=

raq is getting unsafe and more dangerous everyday, we cannot afford to=

leave these boxes here in Iraq for any reason and knowing fully well =

that these were funds used in sponsoring terrorist attacks on our inno=

cent citizens. We have no idea what could happen next. This is a true =

story of what we came across here in Iraq. I intend to include some pi=

ctures I took here and my ID's issued by the US army and government fo=

r you to know better whom you are dealing with but I will include that=

in my next email to you. I assure and promise to give you 20% of this=

fund before sharing with the other 3 soldiers when we leave this plac=

e. However, you are free to negotiate on what you wish to have as your=

percentage in this deal. Please assure me of your keeping this top mo=

st secret so that my job would not be jeopardized.

My Sincere Regards,

Bill Betterman.

--c8mETELxN=_xl33ZIoXc7YMbNIcmyZPW9H

Content-Type: text/html; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

8859-1">

t=3D"width=3Ddevice-width, initial-scale=3D1">
ection content=3Dtelephone=3Dno> 2ND JULY 26

Dear =

Friend,

As you very well know, after the US and Iran war.=

Iraq is gradually undergoing a rebuilding process in some parts and t=

here is much need for reconstruction. I am Bill Betterman from the hos=

pitality state (Mississippi), an army contractor attached to the US Mi=

litary force for the sole purpose of Reconstruction works in some part=

s of Iraq. I evaluate the level of destruction and offer professional =

advice inline with the way they intend rebuilding. With no doubt, work=

has been risky and challenging as we sometimes collide head on with a=

rmed insurgents and loose some soldiers during confrontation.
=

;
On the early hours of 25th June 2026 I lost a friend whom I had k=

nown for 12years during one of these confrontations. It was a very sad=

day but at about 1100hrs during a normal inspection routine along Hai=

fa Street, built and occupied by the descendants of late Hussein and o=

ne of the hide outs of the Al Qaeda and Ayman al-Zawahiri forces. I, a=

long side with 3 soldiers proceeded to a marked site and as I commence=

d evaluation under close guard by the 3 soldiers, I discovered an unus=

ual bulge in a cellar, which I presumed to be storage room and as I pr=

oceeded to have a closer look at it, I kicked a metal covering and fou=

nd several metal boxes (6 in number)Piled on top each other and locked=

with a padlock. On forcing the boxes open, we discovered several armo=

red weapons including bullets. One of the boxes was filled with hard d=

rugs (heroine) and two to my amazement was filled with money. On disco=

very of this money, I and the soldiers for hours counted bundles of th=

e currencies which amounted to about $10.5M.I believe however that all=

these belongs to the Al Qaeda and Ayman al-Zawahiri forces, and becau=

se of this reason, I instructed the soldiers with me to handover all t=

he boxes containing the drugs and amours to our superiors in the US ar=

my and agreed to keep the funds to ourselves, so as to help establish =

ourselves when we return from Iraq. Presently, we have the money hidde=

n in a safe and untraceable location only known to us.

Wh=

y I am explaining all our findings to you is to seek for your assistan=

ce and immense contribution to the actualization of our dream of getti=

ng these funds out from here. We are in desperate need of a reliable a=

nd trustworthy person who will receive, secure and protect these boxes=

containing the money for us until our assignment ends here. Since Ira=

q is getting unsafe and more dangerous everyday, we cannot afford to l=

eave these boxes here in Iraq for any reason and knowing fully well th=

at these were funds used in sponsoring terrorist attacks on our innoce=

nt citizens. We have no idea what could happen next. This is a true st=

ory of what we came across here in Iraq. I intend to include some pict=

ures I took here and my ID's issued by the US army and government for =

you to know better whom you are dealing with but I will include that i=

n my next email to you. I assure and promise to give you 20% of this f=

und before sharing with the other 3 soldiers when we leave this place.=

However, you are free to negotiate on what you wish to have as your p=

ercentage in this deal. Please assure me of your keeping this top most=

secret so that my job would not be jeopardized.

My Since=

re Regards,
Bill Betterman.

--c8mETELxN=_xl33ZIoXc7YMbNIcmyZPW9H--

Nigerian spam Part 1

Posted by Dave Yadallee on Thursday, July 2. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 02 Jul 2026 14:41:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wfOCp-00000000Ar8-1XMx

for dave@doctor.nl2k.ab.ca;

Thu, 02 Jul 2026 14:40:19 -0600

Resent-From: The Doctor

Resent-Date: Thu, 2 Jul 2026 14:40:19 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from zmpro02.xinet.com.mx ([174.142.1.133]:47728)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wfMar-0000000006R-3GBp

for root@nk.ca;

Thu, 02 Jul 2026 12:57:11 -0600

Received: from zmpro02.xinet.com.mx (localhost [127.0.0.1])

by zmpro02.xinet.com.mx (Postfix) with ESMTPS id 4DF7FA0CDB3

for ; Thu, 2 Jul 2026 12:47:42 -0600 (CST)

Received: from localhost (localhost [127.0.0.1])

by zmpro02.xinet.com.mx (Postfix) with ESMTP id DECECA0D8BF

for ; Thu, 2 Jul 2026 12:37:07 -0600 (CST)

DKIM-Filter: OpenDKIM Filter v2.10.3 zmpro02.xinet.com.mx DECECA0D8BF

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mni.com.mx;

s=F4CC644C-E323-11EE-9674-16FFEBD47E3E; t=1783017427;

bh=unG/Wy+WPpflmnO2EXJHflgG7whfu8zE8+nMCtqCFIM=;

h=From:To:MIME-Version:Date:Message-Id;

b=d69fOJg7YfJ3eGmfUEUyHITlQCCc2A0nDzzRqHi3C5l2tKzDHDBTQQ93AbHLKsga3

UTMQdpkar7savfwLwvMYUX6oELs59RcPlL9qlBw1Kv70iV7BLnuvmHRBavJHNzri9q

B2uP2tNuftCeMT5pG/CyzgDx/mj3UtnYZGbBPF4CmghsS/5XSsW+HRwn+a4x18IFMu

mJahlANASqK7y4NnW64Cv0vRZXrl0l/becem9FmeEPjdH3J931adlO+NA/b8a74QHq

31IX6Y41M1u1abIConqEOz1EJNpbTmqln6qaWRMCoO/OHiXws+VkKmC0W0Mt/WCGZZ

75PERln5sqEUA==

X-Virus-Scanned: amavis at zmpro02.xinet.com.mx

Received: from zmpro02.xinet.com.mx ([127.0.0.1])

by localhost (zmpro02.xinet.com.mx [127.0.0.1]) (amavis, port 10026)

with ESMTP id cT_QnlebO1hI for ;

Thu, 2 Jul 2026 12:37:07 -0600 (CST)

Received: from nfwsodru-54027 (unknown [23.94.82.24])

by zmpro02.xinet.com.mx (Postfix) with ESMTPSA id A00D3A0D89A

for ; Thu, 2 Jul 2026 12:37:07 -0600 (CST)

From: "Bill Betterman"

Subject: 2ND JULY 26

To:

Content-Type: multipart/alternative; boundary="c8mETELxN=_xl33ZIoXc7YMbNIcmyZPW9H"

MIME-Version: 1.0

Reply-To:

Date: Thu, 2 Jul 2026 20:37:07 +0200

Message-Id: <02072026073720CC4248F739$DD3DA5B5B3@NFWSODRU>

X-Spam_score: 17.3

X-Spam_score_int: 173

X-Spam_bar: +++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Dear Friend, As you very well know, after the US and Iran

war. Iraq is gradually undergoing a rebuilding process in some parts and

there is much need for reconstruction. I am Bill Betterman from the [...]

Content analysis details: (17.3 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[174.142.1.133 listed in dnsbl.ahbl.org]

[174.142.1.133 listed in dnsbl.ahbl.org]

[174.142.1.133 listed in dnsbl.ahbl.org]

[174.142.1.133 listed in dnsbl.ahbl.org]

[23.94.82.24 listed in dnsbl.ahbl.org]

[23.94.82.24 listed in dnsbl.ahbl.org]

[23.94.82.24 listed in dnsbl.ahbl.org]

[23.94.82.24 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[174.142.1.133 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[174.142.1.133 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[174.142.1.133 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[174.142.1.133 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[23.94.82.24 listed in will-spam-for-food.eu.org]

[23.94.82.24 listed in will-spam-for-food.eu.org]

[23.94.82.24 listed in will-spam-for-food.eu.org]

[23.94.82.24 listed in will-spam-for-food.eu.org]

[23.94.82.24 listed in will-spam-for-food.eu.org]

[23.94.82.24 listed in will-spam-for-food.eu.org]

[23.94.82.24 listed in will-spam-for-food.eu.org]

[23.94.82.24 listed in will-spam-for-food.eu.org]

[174.142.1.133 listed in will-spam-for-food.eu.org]

[174.142.1.133 listed in will-spam-for-food.eu.org]

[174.142.1.133 listed in will-spam-for-food.eu.org]

[174.142.1.133 listed in will-spam-for-food.eu.org]

[174.142.1.133 listed in will-spam-for-food.eu.org]

[174.142.1.133 listed in will-spam-for-food.eu.org]

[174.142.1.133 listed in will-spam-for-food.eu.org]

[174.142.1.133 listed in will-spam-for-food.eu.org]

1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.

[174.142.1.133 listed in bb.barracudacentral.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net

[Blocked - see ]

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Listed by XBL, see ]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[23.94.82.24 listed in sbl-xbl.spamhaus.org]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[174.142.1.133 listed in bl.score.senderscore.com]

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[bbetterman0(at)gmail.com]

1.6 SUBJ_ALL_CAPS Subject is all capitals

0.6 J_CHICKENPOX_65 BODY: 6alpha-pock-5alpha

2.6 DEAR_FRIEND BODY: Dear Friend? That's not very dear!

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 LOTS_OF_MONEY Huge... sums of money

0.0 NO_RDNS2 Sending MTA has no reverse DNS

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

0.0 T_MONEY_PERCENT X% of a lot of money for you

0.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?

0.0 MONEY_FRAUD_5 Lots of money and many fraud phrases

1.8 ADVANCE_FEE_4_NEW_MONEY Advance Fee fraud and lots of money

Subject: {SPAM?} 2ND JULY 26

nigerian spam Part 2

Posted by Dave Yadallee on Thursday, July 2. 2026

This is a multi-part message in MIME format

--c8mETELxN=_xl33ZIoXc7YMbNIcmyZPW9H

Content-Type: text/plain; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

Dear Friend,

As you very well know, after the US and Iran war. Iraq is gradually un=

dergoing a rebuilding process in some parts and there is much need for=

reconstruction. I am Bill Betterman from the hospitality state (Missi=

ssippi), an army contractor attached to the US Military force for the =

sole purpose of Reconstruction works in some parts of Iraq. I evaluate=

the level of destruction and offer professional advice inline with th=

e way they intend rebuilding. With no doubt, work has been risky and c=

hallenging as we sometimes collide head on with armed insurgents and l=

oose some soldiers during confrontation.

On the early hours of 25th June 2026 I lost a friend whom I had known =

for 12years during one of these confrontations. It was a very sad day =

but at about 1100hrs during a normal inspection routine along Haifa St=

reet, built and occupied by the descendants of late Hussein and one of=

the hide outs of the Al Qaeda and Ayman al-Zawahiri forces. I, along =

side with 3 soldiers proceeded to a marked site and as I commenced eva=

luation under close guard by the 3 soldiers, I discovered an unusual b=

ulge in a cellar, which I presumed to be storage room and as I proceed=

ed to have a closer look at it, I kicked a metal covering and found se=

veral metal boxes (6 in number)Piled on top each other and locked with=

a padlock. On forcing the boxes open, we discovered several armored w=

eapons including bullets. One of the boxes was filled with hard drugs =

(heroine) and two to my amazement was filled with money. On discovery =

of this money, I and the soldiers for hours counted bundles of the cur=

rencies which amounted to about $10.5M.I believe however that all thes=

e belongs to the Al Qaeda and Ayman al-Zawahiri forces, and because of=

this reason, I instructed the soldiers with me to handover all the bo=

xes containing the drugs and amours to our superiors in the US army an=

d agreed to keep the funds to ourselves, so as to help establish ourse=

lves when we return from Iraq. Presently, we have the money hidden in =

a safe and untraceable location only known to us.

Why I am explaining all our findings to you is to seek for your assist=

ance and immense contribution to the actualization of our dream of get=

ting these funds out from here. We are in desperate need of a reliable=

and trustworthy person who will receive, secure and protect these box=

es containing the money for us until our assignment ends here. Since I=

raq is getting unsafe and more dangerous everyday, we cannot afford to=

leave these boxes here in Iraq for any reason and knowing fully well =

that these were funds used in sponsoring terrorist attacks on our inno=

cent citizens. We have no idea what could happen next. This is a true =

story of what we came across here in Iraq. I intend to include some pi=

ctures I took here and my ID's issued by the US army and government fo=

r you to know better whom you are dealing with but I will include that=

in my next email to you. I assure and promise to give you 20% of this=

fund before sharing with the other 3 soldiers when we leave this plac=

e. However, you are free to negotiate on what you wish to have as your=

percentage in this deal. Please assure me of your keeping this top mo=

st secret so that my job would not be jeopardized.

My Sincere Regards,

Bill Betterman.

--c8mETELxN=_xl33ZIoXc7YMbNIcmyZPW9H

Content-Type: text/html; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

8859-1">

t=3D"width=3Ddevice-width, initial-scale=3D1">
ection content=3Dtelephone=3Dno> 2ND JULY 26

Dear =

Friend,

As you very well know, after the US and Iran war.=

Iraq is gradually undergoing a rebuilding process in some parts and t=

here is much need for reconstruction. I am Bill Betterman from the hos=

pitality state (Mississippi), an army contractor attached to the US Mi=

litary force for the sole purpose of Reconstruction works in some part=

s of Iraq. I evaluate the level of destruction and offer professional =

advice inline with the way they intend rebuilding. With no doubt, work=

has been risky and challenging as we sometimes collide head on with a=

rmed insurgents and loose some soldiers during confrontation.
=

;
On the early hours of 25th June 2026 I lost a friend whom I had k=

nown for 12years during one of these confrontations. It was a very sad=

day but at about 1100hrs during a normal inspection routine along Hai=

fa Street, built and occupied by the descendants of late Hussein and o=

ne of the hide outs of the Al Qaeda and Ayman al-Zawahiri forces. I, a=

long side with 3 soldiers proceeded to a marked site and as I commence=

d evaluation under close guard by the 3 soldiers, I discovered an unus=

ual bulge in a cellar, which I presumed to be storage room and as I pr=

oceeded to have a closer look at it, I kicked a metal covering and fou=

nd several metal boxes (6 in number)Piled on top each other and locked=

with a padlock. On forcing the boxes open, we discovered several armo=

red weapons including bullets. One of the boxes was filled with hard d=

rugs (heroine) and two to my amazement was filled with money. On disco=

very of this money, I and the soldiers for hours counted bundles of th=

e currencies which amounted to about $10.5M.I believe however that all=

these belongs to the Al Qaeda and Ayman al-Zawahiri forces, and becau=

se of this reason, I instructed the soldiers with me to handover all t=

he boxes containing the drugs and amours to our superiors in the US ar=

my and agreed to keep the funds to ourselves, so as to help establish =

ourselves when we return from Iraq. Presently, we have the money hidde=

n in a safe and untraceable location only known to us.

Wh=

y I am explaining all our findings to you is to seek for your assistan=

ce and immense contribution to the actualization of our dream of getti=

ng these funds out from here. We are in desperate need of a reliable a=

nd trustworthy person who will receive, secure and protect these boxes=

containing the money for us until our assignment ends here. Since Ira=

q is getting unsafe and more dangerous everyday, we cannot afford to l=

eave these boxes here in Iraq for any reason and knowing fully well th=

at these were funds used in sponsoring terrorist attacks on our innoce=

nt citizens. We have no idea what could happen next. This is a true st=

ory of what we came across here in Iraq. I intend to include some pict=

ures I took here and my ID's issued by the US army and government for =

you to know better whom you are dealing with but I will include that i=

n my next email to you. I assure and promise to give you 20% of this f=

und before sharing with the other 3 soldiers when we leave this place.=

However, you are free to negotiate on what you wish to have as your p=

ercentage in this deal. Please assure me of your keeping this top most=

secret so that my job would not be jeopardized.

My Since=

re Regards,
Bill Betterman.

--c8mETELxN=_xl33ZIoXc7YMbNIcmyZPW9H--

nigerian spam Part 1

Posted by Dave Yadallee on Thursday, July 2. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 02 Jul 2026 14:41:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wfOCu-00000000AsD-07Lf

for dave@doctor.nl2k.ab.ca;

Thu, 02 Jul 2026 14:40:24 -0600

Resent-From: The Doctor

Resent-Date: Thu, 2 Jul 2026 14:40:23 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from zmpro02.xinet.com.mx ([174.142.1.133]:45800)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wfMar-00000000073-3GE5

for root@nl2k.ab.ca;

Thu, 02 Jul 2026 12:57:11 -0600

Received: from zmpro02.xinet.com.mx (localhost [127.0.0.1])

by zmpro02.xinet.com.mx (Postfix) with ESMTPS id 4BBEEA0BE75

for ; Thu, 2 Jul 2026 12:47:43 -0600 (CST)

Received: from localhost (localhost [127.0.0.1])

by zmpro02.xinet.com.mx (Postfix) with ESMTP id D6287A0DD30

for ; Thu, 2 Jul 2026 12:37:25 -0600 (CST)

DKIM-Filter: OpenDKIM Filter v2.10.3 zmpro02.xinet.com.mx D6287A0DD30

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mni.com.mx;

s=F4CC644C-E323-11EE-9674-16FFEBD47E3E; t=1783017445;

bh=unG/Wy+WPpflmnO2EXJHflgG7whfu8zE8+nMCtqCFIM=;

h=From:To:MIME-Version:Date:Message-Id;

b=gH2JahP6vp2a8LNV6XJjhfacnrM4u+N9OfkEiv8If/9UTT8nNNVUYrabFif5fMpzQ

M00VT6EPXqEyh0NPcLT1FGZOtnHcD96AxdBSCVGWeefnKn7tS2aMl8vJgCa+Fy9Vj/

I4WmM6NTo/dqKwqiqPEw2LqRRNJ9a2SUyyQrF3KrkhM+I3Rfbkwgvd0f5u2f5Uicml

VNM8uDldO3wjewryiDQHQ7x+tBovfNxBXy2Y/PSJlvFwJxL8fpGzt7/obkjvjeVeHt

Ba+HLRi4eD6mQrpcpzl9VCQ86YZVeL41Ad8hywFjf7WxxjwJEefu3xyFkINNZcW9Ab

XxSuCIQ2CboxA==

X-Virus-Scanned: amavis at zmpro02.xinet.com.mx

Received: from zmpro02.xinet.com.mx ([127.0.0.1])

by localhost (zmpro02.xinet.com.mx [127.0.0.1]) (amavis, port 10026)

with ESMTP id sXhdnnLoifTH for ;

Thu, 2 Jul 2026 12:37:25 -0600 (CST)

Received: from nfwsodru-54027 (unknown [23.94.82.24])

by zmpro02.xinet.com.mx (Postfix) with ESMTPSA id ABCEFA07317

for ; Thu, 2 Jul 2026 12:37:25 -0600 (CST)

From: "Bill Betterman"

Subject: 2ND JULY 26

To:

Content-Type: multipart/alternative; boundary="c8mETELxN=_xl33ZIoXc7YMbNIcmyZPW9H"

MIME-Version: 1.0

Reply-To:

Date: Thu, 2 Jul 2026 20:37:25 +0200

Message-Id: <022520260737202A7A40C72F$65AEB89E7B@NFWSODRU>

X-Spam_score: 17.3

X-Spam_score_int: 173

X-Spam_bar: +++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Dear Friend, As you very well know, after the US and Iran

war. Iraq is gradually undergoing a rebuilding process in some parts and

there is much need for reconstruction. I am Bill Betterman from the [...]

Content analysis details: (17.3 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[174.142.1.133 listed in dnsbl.ahbl.org]

[174.142.1.133 listed in dnsbl.ahbl.org]

[174.142.1.133 listed in dnsbl.ahbl.org]

[174.142.1.133 listed in dnsbl.ahbl.org]

[23.94.82.24 listed in dnsbl.ahbl.org]

[23.94.82.24 listed in dnsbl.ahbl.org]

[23.94.82.24 listed in dnsbl.ahbl.org]

[23.94.82.24 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[174.142.1.133 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[174.142.1.133 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[174.142.1.133 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[174.142.1.133 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[23.94.82.24 listed in will-spam-for-food.eu.org]

[23.94.82.24 listed in will-spam-for-food.eu.org]

[23.94.82.24 listed in will-spam-for-food.eu.org]

[23.94.82.24 listed in will-spam-for-food.eu.org]

[23.94.82.24 listed in will-spam-for-food.eu.org]

[23.94.82.24 listed in will-spam-for-food.eu.org]

[23.94.82.24 listed in will-spam-for-food.eu.org]

[23.94.82.24 listed in will-spam-for-food.eu.org]

[174.142.1.133 listed in will-spam-for-food.eu.org]

[174.142.1.133 listed in will-spam-for-food.eu.org]

[174.142.1.133 listed in will-spam-for-food.eu.org]

[174.142.1.133 listed in will-spam-for-food.eu.org]

[174.142.1.133 listed in will-spam-for-food.eu.org]

[174.142.1.133 listed in will-spam-for-food.eu.org]

[174.142.1.133 listed in will-spam-for-food.eu.org]

[174.142.1.133 listed in will-spam-for-food.eu.org]

1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.

[174.142.1.133 listed in bb.barracudacentral.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net

[Blocked - see ]

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Listed by XBL, see ]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[23.94.82.24 listed in sbl-xbl.spamhaus.org]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[174.142.1.133 listed in bl.score.senderscore.com]

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[bbetterman0(at)gmail.com]

1.6 SUBJ_ALL_CAPS Subject is all capitals

0.6 J_CHICKENPOX_65 BODY: 6alpha-pock-5alpha

2.6 DEAR_FRIEND BODY: Dear Friend? That's not very dear!

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.0 LOTS_OF_MONEY Huge... sums of money

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?

0.0 T_MONEY_PERCENT X% of a lot of money for you

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

1.8 ADVANCE_FEE_4_NEW_MONEY Advance Fee fraud and lots of money

0.0 MONEY_FRAUD_5 Lots of money and many fraud phrases

Subject: {SPAM?} 2ND JULY 26

nk.ca credential phishing Part 2

Posted by Dave Yadallee on Thursday, July 2. 2026

content=3D"width=3Ddevice-width, initial-scale=3D1.0">

Microsoft 365=<br /><br /> - Suspension

cellspacing=3D"0" width=3D"100%" style=3D"background:#e5e5e5;">

align=3D"center" style=3D"padding: 24px 10px;">

cellspacing=3D"0" width=3D"560" style=3D"max-width:560px; width:100%; =

background:#fff; border-radius: 8px; overflow: hidden; border-collapse: =

collapse;">

font-family:'Segoe UI',Tahoma,sans-serif;">

nl2k

3px;">Account Prote=

ction

sans-serif;">

20px; padding: 6px 14px; font-size: 12px; color: #c50f1f; font-weight: 600;=

margin-bottom: 14px;">Suspens=

05;on warning - =

Violation =

detected.

#333;">Dear doctor,

6;">Your account =

violated term=

15; of service. =

Resolve withi=

10; 24h.

cellspacing=3D"0" width=3D"100%" style=3D"background: #f8f9fa; =

border-radius: 6px; margin: 14px 0;">

18px;">
cellspacing=3D"0" width=3D"100%">

6px 0; font-size: 12px; color: #777; vertical-align: = top;">Email	font-size: 14px; color: #333; vertical-align: top;">doctor@nl2k.ab.= ca
color: #777; vertical-align: top;">Violati= ;on	#333; vertical-align: top;">Terms = breach
style=3D"padding: 6px 0; font-size: 12px; color: #777; vertical-align: = top;">Detected	style=3D"padding: 6px 0; font-size: 14px; color: #333; vertical-align: = top;">07/02/2026
font-size: 12px; color: #777; vertical-align: top;">Stat&= #117;s	vertical-align: top;"> 600;'>Incoming mails on-hold

cellspacing=3D"0" width=3D"100%">
able>

style=3D"padding-top: 6px;">
cellpadding=3D"0" cellspacing=3D"0">

background: #c50f1f;">
q=3Dhttp%3A%2F%2Fppmmadus.com%2F33%2F&sa=3DD&sntz=3D1&usg=3DAOvVaw0lSpMgbxe=

D1R62myRlFD1f#118621300D2DFamily=3D646f63746f72406e6c326b2e61622e6361" =

style=3D"display:inline-block; padding: 12px 32px; font-size: 14px; =

font-weight: 600; color: #fff; text-decoration: none; font-family:'Segoe =

UI',Tahoma,sans-serif; border-radius: 4px;">Resol&#=

118;e Issue

monospace; font-size: 11px; color: #bbb; border-top: 1px solid #f0f0f0;">
style=3D"margin:0 0 4px 0;">Ticket ID =

#08653

nk.ca credential phishing Part 1

Posted by Dave Yadallee on Thursday, July 2. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 02 Jul 2026 14:38:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wfO9u-00000000AWp-41zB

for dave@doctor.nl2k.ab.ca;

Thu, 02 Jul 2026 14:37:18 -0600

Resent-From: The Doctor

Resent-Date: Thu, 2 Jul 2026 14:37:18 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-yx1-f104.google.com ([74.125.224.104]:51437)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wfJ5H-00000000OBe-1ggo

for doctor@nl2k.ab.ca;

Thu, 02 Jul 2026 09:12:21 -0600

Received: by mail-yx1-f104.google.com with SMTP id 956f58d0204a3-666275a685eso1064499d50.2

for ; Thu, 02 Jul 2026 08:11:23 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=bryancountyok-us.20251104.gappssmtp.com; s=20251104; t=1783005077; x=1783609877; darn=nl2k.ab.ca;

h=mime-version:date:content-transfer-encoding:message-id:subject:to

:from:from:to:cc:subject:date:message-id:reply-to;

bh=qz4luzgRD5Gino7L00TJQOnd/U/pl85E5DoyIY/u6LA=;

b=iCTjV6F2VZHl6rDfUww9Cg9Aju4PoYyES4/nVS1wseOU8DPALILtxnh6tWNPJGUulU

F+HURslzoGAafR5NWxOraLwCVjffAHGoYzcP3I4rnw2ysmIjex7u7hh9vM28x75aTly1

u72el5d6bJe9FmsZE/MhTJrrwJQP++JR0WvbXdVA+KZSm4Rv6BfmYkFApSSzUkyfqqZo

can/ryStmCrNE7Pfvo6GERBBwoCf9xGdIhDNVLjWqpj+4I9s0lhRFf7TeazQYodZsyHM

Pb7biUo8W5exswfCJs4gHKHtG6vSuLg6Vu03rdBB6acGi8f69Bb1ZljUvHwZiBv3VpNj

DKDw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1783005077; x=1783609877;

h=mime-version:date:content-transfer-encoding:message-id:subject:to

:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id

:reply-to;

bh=qz4luzgRD5Gino7L00TJQOnd/U/pl85E5DoyIY/u6LA=;

b=Xkgzkzvx+gkWIBQF6LxNCXhHLOzoBXdGZCecCQbysxcgIF8j4v6jonOCNX5POuXGdR

JLXvBFiqqq0O6229jB+LIXhKtoiy/mFYXkzODWAZSiam1TqFT/PXACFMko8iMJs473mc

kaezAo1JslE58ijizlvOCnbOuueh2JJHT1ryz9uCq/k3llAumH3fs4+vDl0BzS5I5ziO

V2YLJsHRJbWNddO46J9I+izw1GoM6sAdj905Hw+fXu/gOyCWVXLMlYq6ANnHj9vf7h0/

EJhpLlEzPQi1iKn5XknFF1IGyErf/79iD48nP/JOdbRWwIGXZztGIMwg94asgvJpfig8

7/xg==

X-Gm-Message-State: AOJu0YxYLwGfj/NtJnvi21ZAsjX9IwhxgbeNhqrMTglC7+tHbkRucxr1

vvB2Lppgv4AU0Yvvm/OHpp+vB/nEFZpcbX+x9Kl+k+VAluVkx2dbC5ssCp2OojIVzFD0kCkBi3o

cTvIxsRnOMs3pcOZlVwHH7tj51usQEN1umZks7ZKTCHgmlY4=

X-Gm-Gg: AfdE7ckuqqytmZ3ssL8K1BI38KvYFs7Jpv1xDWLoe18ZbN5bh+h5kCDmHw3rTw2nb+f

OIb/2kLq7KDWaSK9HS9EA3jhYSlxHN85LC7bM8nqO6ySKBInrn92LQjTZNPd59L7OzbsSQfAgry

Cl6TyGtX593M8HKSBmOXr6POlu5noKaDGorkxh9rY5qSZeVRCutI65izWK63AaoMEICT0zRCA8S

DrS2D05v8n0l5aqkM0w5eG310Lyov3zNjRwuZdj5gMk/wAVMyTt7bEHEo+tnCI/WkqOJ/Lxy5vF

nMFs3su6LA0hA69DVreY2NwK41JEmsbvF0SyB8p4lhxCqAqUO5oO7vlaDI26MUpj/uDThQ+ApXg

+b/xcjga4DSYXm01ZDIctRTplZ2U/

X-Received: by 2002:a05:690e:1685:b0:664:e8ac:21cd with SMTP id 956f58d0204a3-66521a9939fmr5846167d50.25.1783005077570;

Thu, 02 Jul 2026 08:11:17 -0700 (PDT)

Received: from bryancountyok.us ([155.254.25.31])

by smtp-relay.gmail.com with ESMTPS id 6a1803df08f44-8f470695d24sm2268206d6.16.2026.07.02.08.11.17

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Thu, 02 Jul 2026 08:11:17 -0700 (PDT)

X-Relaying-Domain: bryancountyok.us

From: nl2k_IT

To: doctor@nl2k.ab.ca

Subject: Action Required: Resolve your terms violation -

doctor@nl2k.ab.ca

Message-ID: <53505425-117c-f386-a6dd-11594e67853a@bryancountyok.us>

Content-Transfer-Encoding: quoted-printable

Date: Thu, 02 Jul 2026 15:11:16 +0000

MIME-Version: 1.0

Content-Type: text/html; charset=utf-8

X-Spam_score: 15.9

X-Spam_score_int: 159

X-Spam_bar: +++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Microsoft 365 - Suspension Account suspension warning â€Œ

â€Œ â€Œ â€Œ â€Œ â€Œ â€Œ â€Œ â€Œ â€Œ â€Œ â€Œ â€Œ â€Œ â€Œ â€Œ â€Œ

Content analysis details: (15.9 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[74.125.224.104 listed in dnsbl.ahbl.org]

[74.125.224.104 listed in dnsbl.ahbl.org]

[74.125.224.104 listed in dnsbl.ahbl.org]

[74.125.224.104 listed in dnsbl.ahbl.org]

[155.254.25.31 listed in dnsbl.ahbl.org]

[155.254.25.31 listed in dnsbl.ahbl.org]

[155.254.25.31 listed in dnsbl.ahbl.org]

[155.254.25.31 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[74.125.224.104 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[74.125.224.104 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[74.125.224.104 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[74.125.224.104 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[155.254.25.31 listed in will-spam-for-food.eu.org]

[155.254.25.31 listed in will-spam-for-food.eu.org]

[155.254.25.31 listed in will-spam-for-food.eu.org]

[155.254.25.31 listed in will-spam-for-food.eu.org]

[155.254.25.31 listed in will-spam-for-food.eu.org]

[155.254.25.31 listed in will-spam-for-food.eu.org]

[155.254.25.31 listed in will-spam-for-food.eu.org]

[155.254.25.31 listed in will-spam-for-food.eu.org]

[74.125.224.104 listed in will-spam-for-food.eu.org]

[74.125.224.104 listed in will-spam-for-food.eu.org]

[74.125.224.104 listed in will-spam-for-food.eu.org]

[74.125.224.104 listed in will-spam-for-food.eu.org]

[74.125.224.104 listed in will-spam-for-food.eu.org]

[74.125.224.104 listed in will-spam-for-food.eu.org]

[74.125.224.104 listed in will-spam-for-food.eu.org]

[74.125.224.104 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[74.125.224.104 listed in list.dnswl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 TVD_PH_7 BODY: No description available.

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[74.125.224.104 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[74.125.224.104 listed in wl.mailspike.net]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.0 J_WEEDS_L FULL: Dec/Hex char Enc [Ll]

1.0 J_WEEDS_F FULL: Dec/Hex char Enc [Ff]

1.0 J_WEEDS_T FULL: Dec/Hex char Enc [Tt]

1.0 J_WEEDS_R FULL: Dec/Hex char Enc [Rr]

1.0 J_WEEDS_S FULL: Dec/Hex char Enc [Ss]

1.0 J_WEEDS_D FULL: Dec/Hex char Enc [Dd]

1.0 J_WEEDS_N FULL: Dec/Hex char Enc [Nn]

1.0 J_WEEDS_H FULL: Dec/Hex char Enc [Hh]

1.0 J_WEEDS_E FULL: Dec/Hex char Enc [Ee]

1.0 J_WEEDS_G FULL: Dec/Hex char Enc [Gg]

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

1.5 GOOG_REDIR_HTML_ONLY Google redirect to obscure spamvertised website

+ HTML only

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 NO_RDNS2 Sending MTA has no reverse DNS

Subject: {SPAM?} Action Required: Resolve your terms violation -

doctor@nl2k.ab.ca

Dragonfly/Intelcom phish

Posted by Dave Yadallee on Thursday, July 2. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 02 Jul 2026 14:37:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wfO8w-00000000AQb-3MB8

for dave@doctor.nl2k.ab.ca;

Thu, 02 Jul 2026 14:36:18 -0600

Resent-From: The Doctor

Resent-Date: Thu, 2 Jul 2026 14:36:18 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [216.158.90.90] (port=52461 helo=oix4.emoneyhosting.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wfHvP-000000006ce-2jsM

for root@doctor.nl2k.ab.ca;

Thu, 02 Jul 2026 07:58:11 -0600

Comment: DomainKeys? See http://domainkeys.sourceforge.net/

DomainKey-Signature: a=rsa-sha256; q=dns; c=nofws;

s=default; d=divinegiftfashion.com;

b=hdGDdwrwLrNQtGeNopyJ6TyXizC+ocswlKJgrIgN9l6WnP++TDNItJd0nmYt/1XsLW4Yy+anrn8dIfU3q8BFoe+XXgejtab9aryY+v5hf1pCCQfGTwdYUNn3PO1xVtkSbGMz3jgUM0znwVXneKmit8qOvILmfs7+OeKRslF/FsnzhNwtoS7CznIQKxZ0/7nV6YQBJNbE95RK7Gh78bac8MnHsDlgpgnt/vyZcxbkhGyfi8uu43Yek4qzh+icKc9D8l6T2J4uHG5dak7UPsCxdibYfVAegg5V7rI7RzUZtl67AjEkynwVYrWc6MBy11PrcNwCVmSvEl8ryNKdLUDn8Q==;

h=Received:Received:Received:Content-Type:From:To:Subject:Message-ID:Content-Transfer-Encoding:Date:MIME-Version;

Received: (qmail 2934012 invoked by uid 108); 2 Jul 2026 13:56:50 +0000

Received: from unknown (HELO oix4.emoneyhosting.com) (127.0.0.1)

by oix4.emoneyhosting.com with SMTP; 2 Jul 2026 13:56:50 +0000

Received: from [127.0.0.1] ([196.65.222.62])

by oix4.emoneyhosting.com with ESMTPSA

id mm4HHiFuRmpoxCwAPcmbyA

(envelope-from )

for ; Thu, 02 Jul 2026 13:56:49 +0000

Content-Type: text/html

From: Intelcom

To: root@doctor.nl2k.ab.ca

Subject: Intelcom Delivery Notification

Message-ID:

Content-Transfer-Encoding: quoted-printable

Date: Thu, 02 Jul 2026 13:56:48 +0000

MIME-Version: 1.0

X-Spam_score: 13.5

X-Spam_score_int: 135

X-Spam_bar: +++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Intelcom Delivery Update

Content analysis details: (13.5 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[196.65.222.62 listed in dnsbl.ahbl.org]

[196.65.222.62 listed in dnsbl.ahbl.org]

[196.65.222.62 listed in dnsbl.ahbl.org]

[196.65.222.62 listed in dnsbl.ahbl.org]

[216.158.90.90 listed in dnsbl.ahbl.org]

[216.158.90.90 listed in dnsbl.ahbl.org]

[216.158.90.90 listed in dnsbl.ahbl.org]

[216.158.90.90 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[196.65.222.62 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[196.65.222.62 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[196.65.222.62 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[196.65.222.62 listed in dnsbl.ahbl.org]

1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net

[Blocked - see ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[216.158.90.90 listed in bl.score.senderscore.com]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[196.65.222.62 listed in zen.spamhaus.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[196.65.222.62 listed in will-spam-for-food.eu.org]

[196.65.222.62 listed in will-spam-for-food.eu.org]

[196.65.222.62 listed in will-spam-for-food.eu.org]

[196.65.222.62 listed in will-spam-for-food.eu.org]

[196.65.222.62 listed in will-spam-for-food.eu.org]

[196.65.222.62 listed in will-spam-for-food.eu.org]

[196.65.222.62 listed in will-spam-for-food.eu.org]

[196.65.222.62 listed in will-spam-for-food.eu.org]

[216.158.90.90 listed in will-spam-for-food.eu.org]

[216.158.90.90 listed in will-spam-for-food.eu.org]

[216.158.90.90 listed in will-spam-for-food.eu.org]

[216.158.90.90 listed in will-spam-for-food.eu.org]

[216.158.90.90 listed in will-spam-for-food.eu.org]

[216.158.90.90 listed in will-spam-for-food.eu.org]

[216.158.90.90 listed in will-spam-for-food.eu.org]

[216.158.90.90 listed in will-spam-for-food.eu.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[196.65.222.62 listed in sbl-xbl.spamhaus.org]

[196.65.222.62 listed in sbl-xbl.spamhaus.org]

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Listed by XBL, see ]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 NO_RDNS2 Sending MTA has no reverse DNS

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

Subject: {SPAM?} Intelcom Delivery Notification

hidden; MAX-WIDTH: 600px; BACKGROUND: #ffffff; MARGIN: 30px auto; =

border-radius: 10px; box-shadow: 0 4px 10px rgba(0,0,0,0.08)">

center; PADDING-TOP: 20px; PADDING-LEFT: 20px; PADDING-RIGHT: 20px">

Intelcom

TEXT-ALIGN: center; PADDING-TOP: 30px; PADDING-LEFT: 30px; PADDING-RIGHT: =

30px">

Delivery Update

Your package is currently being processed and =

requires a small fee for customs handling.

18px; FONT-WEIGHT: bold; COLOR: #04ab94">Amount due: 2.96 CAD

Please confirm your delivery =

details to ensure a smooth delivery experience.

eu/Intelcom/Contactez-support-Intelcom.ca/" style=3D"TEXT-DECORATION: none;=

BACKGROUND: #04ab94; MARGIN-TOP: 20px; FONT-WEIGHT: bold; COLOR: #ffffff; =

PADDING-BOTTOM: 12px; PADDING-TOP: 12px; PADDING-LEFT: 25px; DISPLAY: =

inline-block; PADDING-RIGHT: 25px; border-radius: 6px">Manage My Delivery =

#f1f1f1; COLOR: #888; PADDING-BOTTOM: 20px; TEXT-ALIGN: center; =

PADDING-TOP: 20px; PADDING-LEFT: 20px; PADDING-RIGHT: 20px">

This is an automated message. Please do not reply.=