Bitcoin Paypal Phish from Microsoft Outlook Part 2

X-Microsoft-Antispam-Message-Info:

=?utf-8?B?blJLY3JUajhwcHhqbGMxSEZzb2JNZ01SNnpTL05maHJ4WVRXbTBXVmFJeEdz?=

=?utf-8?B?TEppU21ORExReko3S3VhVllTYXYzM2x4ZUNsTkRZUGtEaEZqOVBqWmVjTzI0?=

=?utf-8?B?RWRGSnhnMURiMGY3Zm9ORG03NWF1OWFrNzFITCtwVTc0K2d5aXhab2xmOC9z?=

=?utf-8?B?ZDVkWEZaQXo5MHE4RitPWTFNKzAzdEpUUEVaOWdJbExyREdwSmZGbmVrRUlR?=

=?utf-8?B?SGpWZlBvVFZKbTlGYmx1VGZlbnRueHFOK1FaMVV2YWdkQndONlFBYkJ6Tk1o?=

=?utf-8?B?U0ROcXdBRGh5MEhzdlViL00rNG4ybWVnbUdYQzh2MHlBcTB2eXdZRGtRWC9x?=

=?utf-8?B?WjVvT2srdXFkWXlEUGQ4NEM0S1dmU1k0WU9zMHZjRENLWi9hT1UyeEVkSFVx?=

=?utf-8?B?M29lSFBtd2lzbUppL1F2SnhXTUsrQXhjTGpVOTllSFhCSkQwVDVHbkx4UVk0?=

=?utf-8?B?YXJtblZISllWdGFRci9melZVbTN3cDNLZks1WDdZYnE5YVFpZzljdlZ5N3V1?=

=?utf-8?B?b0txUkNLRTlicWhBYUJSWTZhRWp5S2l4ekthbEk4aGZWSW5pd1VPVXdNVUtm?=

=?utf-8?B?LzhrZjFYR3VmQnl6anJzdFFwY0lzNktIUUNMWWEyR3NOd1oweit1RWEyNHFR?=

=?utf-8?B?NnVpN3RCYTFEdGNpNGhJcEdLVXlQcFZCZ2UyeUt5R251SXp6QWZQVlJNUEFR?=

=?utf-8?B?WnkwWThteWpkRkFKVEZHZytyRjBZVGE2dngwSzRJU0hDSmhWNVluYVdOWDBz?=

=?utf-8?B?K0QwaVpPRXpsaWRvd0w0WmlCd2ZVV2M1ZWdoN2tkSm5pRHhCd25pTWhaeVBv?=

=?utf-8?B?TkZWZ2o2ZUNCNXl1SHBzazRaTk9IS21Deml5aDNQMlQ3eXdCM2ZzdnpzWm9E?=

=?utf-8?B?c2tseUw5NUgraFcwcmp3bG11b2FWVnZQNVpPREtnVXJ6SmMzTVNENDBNZWMr?=

=?utf-8?B?bERma2w0MFdxWXF2M1pLamxnSFZkM2dteUdJQTg0TGZhVGJDRGMxUmp3aEpC?=

=?utf-8?B?NWFkSVYyMXdnZ21aTTlTRmV2RnhlbTkwWnpQY1BYYU95ZHV1bjJ3alBUT3dT?=

=?utf-8?B?RE9VdG9vcUhkQlY0RmRjekJTZER1R2l0TGNLYW9jcEwvUVBzWXlKTm9FbklG?=

=?utf-8?B?Ty9RVU5EajUyeHJEK1VycHdCMmhhWWJ5VjBJbnpyUHNiME9Pakdxa2FGN1ZQ?=

=?utf-8?B?ZWZublNMZ3JkdklKNFdrWW1VRzNmNjRkL3ljcDQvb3F2VURvaUNuNWM2SS9P?=

=?utf-8?B?U09FTTFGTWxTOTZGY0lZbUdYdzBBSnd1cS9uOW1ONm03ODc1Z1lUZkUyUHpl?=

=?utf-8?B?K1NIdkthNWFTTlhqZWtCQXo0cXNzenNuL2VRWitTSkhnREY3QkJxWFNtZ1FI?=

=?utf-8?B?bGtPMHRwOEM2R2dZempqSGcwcG9xblI4cEpFanZTcWZTTHFQMTNnV2V1NnlW?=

=?utf-8?B?RHQwVFRXQisrNWsvc3JENzBOQi9IdDZBMGZxYk1ydm96bUFiMkVxcHl2NnpL?=

=?utf-8?B?NnZZZ3BGMEZCeUlkZW9DblFFcndrcWhCMzRsWnM1RzAzL0w3bmN0eGNLRmhS?=

=?utf-8?B?QktnaENMY1NTUUpzVVlKbWNXemdsUHZwZEtFSUFhQTJVYnZXK1pRNUgzVmtJ?=

=?utf-8?B?YlQrdEFnZzZEdnBsakpFVnZaUks0SEtoK1VrN1dvd0xKMXBQR0tZR1NKU3RU?=

=?utf-8?B?R0Vsc3hxbUsreDBkR2k4amgzaUVGTC94ZFFXcFlrN2ZLK0RJU2FqN09rdG1Z?=

=?utf-8?B?dHlQNEpFL0tleXpyWmhMOWV4KzdOV0hMK25SS0JYVElrTjdUblNPSTlBcVpM?=

=?utf-8?B?cW8vWW54VHlPSk82UGx3ZUpGYksyUUlzUlRKbG02cTUzS2NBem01cnNIZDJ3?=

=?utf-8?B?USt3NnJwaXhhOXpRWkNkaXozLzhZU0RBUzIrbHNIYjI2b3FNTGwxcGEyL2Ny?=

=?utf-8?B?L2MvK2M1eVdsR01ZYzNFemxLc1pFL29oWExkeUo2MlNWUG9GNDFJeWF6czNO?=

=?utf-8?B?OXFKajRIOWpoNjV4TmJ2L0kySFpwaTZrZzYwVGtyeGJJeUs1eE85QUVXNDBH?=

=?utf-8?B?dmZ3MnZ2ZlJ6TUpOYXIweC92S0dXL0pZd1BHeWcxOVIvaGZMYkpNSU1LYlFB?=

=?utf-8?B?d3ZZYWtqQkt2VlBXNUFQS0FDVkNWOU5uMllOcXkwL3MySiszeVk5UWlOYmJV?=

=?utf-8?B?bTV6c2JqREhSaVRMVy9BamlKeFRUZ3VoNkN2dXlsT3REdTJqemNEV21KMTFS?=

=?utf-8?B?TmN1NG92ZUdSTkxDdlEybDNONWp3b0d6TlRCZHVEWmthNU5NbzVad2hDcGFI?=

=?utf-8?B?dVRoc2JORVhKRXpHUlBJeFBMSnp2NXF1NUQwRERiaE50MEg2TVlVbFVObmJy?=

=?utf-8?B?STdHTHFTUnc0amV4TGkxTzJadHdCblhIUVlpREtVNHdEdmZ6dGxneStCd1hF?=

=?utf-8?B?b0ZYOElYMHQ1M0tJY0tNVTFnalN1dERxdlUzMTZwTWtwb2QyM2hUNnM5MXRI?=

=?utf-8?B?aXpUZUk5MnFBK2M2clh4dHhKODQzcDdLS0RSWGpiS0tvZ3FDK1c5R3Nkc3Z1?=

=?utf-8?B?TlNjR2xndHRhRXVmNDRZekt6RGtBaUlyQ0t0cHNpbW9QdzY4UndsQjhpckpy?=

=?utf-8?B?ZTQ4SExtV3g3UktJVUpLSGdqQnJHa3NhOUgzdVZJNU41RHNYNndVNkJzNDVa?=

=?utf-8?B?d09yTWJwbTEwWXI4cmdYMHJpRGhPRkd2Y1Z1TlNKSTkyb2FOTnBtTlg3cTdH?=

=?utf-8?B?VGtPYjcwT2E0a2JHbVdFMU81SEY1MVIzMHhSZ2tlYkN0cGc5eFEwZmdRczJ6?=

=?utf-8?B?QlN1a2pROGN2UFVkVzAySzFtMkRLbEJPVW9ZaTZaVFdpRHpIU0hFU1RXdW1N?=

=?utf-8?B?MGtxQ05naDdlNkVPcmVJQnhxT3pBUDlhcUt2MlB2c3RoMXdLZmxFQW43RWo4?=

=?utf-8?B?TDMwSEl1Rm1RWG5WUWFScVFPcCtTQWtHaFh6SFFncW9GOUFBVHlVQTZFQ1hS?=

=?utf-8?B?QmJOSFJKRUJFSHk0T0V0OUtnaGdJQTFrcG13YmlCWWprV3ZJUS94eWNRMW5G?=

=?utf-8?B?Rm5IaGFmRGNHTEgvTFREV3NLc210dlZITkkvMmNjU3FuV2dqMHMyZmRPVW85?=

=?utf-8?B?dklvWGdlcVZYNTZtYW1uVG9xdzJ4d09nZWhoZ3FLS2NiRTdGQ0pvVzc1aTJU?=

=?utf-8?B?VHFPL3NtVkhDM3hBaHBOMVcwRkRGRmdnOWhlTm82b1p0ZkhVdmJyTnpUTjJB?=

=?utf-8?Q?/+3ckOnPD5y2k9uLvXeuDtIiY19giPcSkMq+7FOqcqu9Z72?=

X-Auto-Response-Suppress: DR, OOF, AutoReply

X-OriginatorOrg: sct-15-20-9412-4-msonline-outlook-090a5.templateTenant

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 26 Jun 2026 14:34:19.8468

(UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id: c4af5ba4-748c-4f3f-5587-08ded3900231

X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-AuthSource: BL6PEPF00022574.namprd02.prod.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: Internet

X-MS-Exchange-Transport-CrossTenantHeadersStamped: MN2PR18MB3624

X-Spam_score: 13.7

X-Spam_score_int: 137

X-Spam_bar: +++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Transaction Alert – Bitcoin Purchase Request Received piatok

26. jún 2026 Dear Customer, Your PayPal payment for Bitcoin has been received

and securely logged in our system.



Content analysis details: (13.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.221.69 listed in will-spam-for-food.eu.org]

[209.85.221.69 listed in will-spam-for-food.eu.org]

[209.85.221.69 listed in will-spam-for-food.eu.org]

[209.85.221.69 listed in will-spam-for-food.eu.org]

[209.85.221.69 listed in will-spam-for-food.eu.org]

[209.85.221.69 listed in will-spam-for-food.eu.org]

[209.85.221.69 listed in will-spam-for-food.eu.org]

[209.85.221.69 listed in will-spam-for-food.eu.org]

[2603:10b6:208:559:cafe:0:0:98 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:559:cafe:0:0:98 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:559:cafe:0:0:98 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:559:cafe:0:0:98 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:559:cafe:0:0:98 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:559:cafe:0:0:98 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:559:cafe:0:0:98 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:559:cafe:0:0:98 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:559:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:559:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:559:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:559:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:559:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:559:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:559:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:559:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[40.93.12.21 listed in will-spam-for-food.eu.org]

[40.93.12.21 listed in will-spam-for-food.eu.org]

[40.93.12.21 listed in will-spam-for-food.eu.org]

[40.93.12.21 listed in will-spam-for-food.eu.org]

[40.93.12.21 listed in will-spam-for-food.eu.org]

[40.93.12.21 listed in will-spam-for-food.eu.org]

[40.93.12.21 listed in will-spam-for-food.eu.org]

[40.93.12.21 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[40.93.12.21 listed in dnsbl.ahbl.org]

[40.93.12.21 listed in dnsbl.ahbl.org]

[40.93.12.21 listed in dnsbl.ahbl.org]

[40.93.12.21 listed in dnsbl.ahbl.org]

[209.85.221.69 listed in dnsbl.ahbl.org]

[209.85.221.69 listed in dnsbl.ahbl.org]

[209.85.221.69 listed in dnsbl.ahbl.org]

[209.85.221.69 listed in dnsbl.ahbl.org]

[2603:10b6:208:559:cafe:0:0:98 listed in]

[dnsbl.ahbl.org]

[2603:10b6:208:559:cafe:0:0:98 listed in]

[dnsbl.ahbl.org]

[2603:10b6:208:559:cafe:0:0:98 listed in]

[dnsbl.ahbl.org]

[2603:10b6:208:559:cafe:0:0:98 listed in]

[dnsbl.ahbl.org]

[2603:10b6:208:559:0:0:0:7 listed in]

[dnsbl.ahbl.org]

[2603:10b6:208:559:0:0:0:7 listed in]

[dnsbl.ahbl.org]

[2603:10b6:208:559:0:0:0:7 listed in]

[dnsbl.ahbl.org]

[2603:10b6:208:559:0:0:0:7 listed in]

[dnsbl.ahbl.org]

Bitcoin Paypal Phish from Microsoft Outlook Part 3



0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[40.93.12.21 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[40.93.12.21 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[40.93.12.21 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[40.93.12.21 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[40.93.12.21 listed in list.dnswl.org]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[40.93.12.21 listed in bl.score.senderscore.com]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

1.0 HK_RANDOM_FROM From username looks random

3.5 VOWEL_FROM_7 Impronouncable from header (7+ consecutive vowels)

0.5 FROM_LOCAL_NOVOWEL From: localpart has series of non-vowel letters

1.0 HK_RANDOM_REPLYTO Reply-To username looks random

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[40.93.12.21 listed in wl.mailspike.net]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[haressaznzxrrsxaxz321(at)gmail.com]

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[haressaznzxrrsxaxz321(at)gmail.com]

0.1 TW_RW BODY: Odd Letter Triples with RW

0.3 LONGWORD BODY: Uses overlong words

0.6 MEGALONGWORD BODY: Uses really overlong words

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.2 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and EnvelopeFrom

freemail headers are different

0.1 TO_IN_SUBJ To address is in Subject

3.0 LONG_INVISIBLE_TEXT Long block of hidden text - bayes poison?

Subject: {SPAM?} =?UTF-8?Q?Pozv=C3=A1nky=3A_Transaction_Alert_=2D_Bitcoin_Purchase_Requ?=

=?UTF-8?Q?est_Received_=40_pi_26=2E_j=C3=BAn_2026_=28cynthiaperez389903=40groups=2Eo?=

=?UTF-8?Q?utlook=2Ecom=29?=





Haresasz Nxysarwsa has invited you to Transaction Alert – Bitcoin Purchase Request Received

Title: Transaction Alert – Bitcoin Purchase Request Received

When: June 26, 2026

Organizer:

Haresasz Nxysarwsa

Description: Dear Customer,



Your PayPal payment for Bitcoin has been received and securely logged in our system.



Transaction Summary:



Purchase Type: Bitcoin (BTC)

Payment Method: PayPal

Amount Charged: $350.00

Status: Under Review



Our verification team is currently processing your order. Once approved, the transaction will be finalized automatically.



If this activity was not authorized by you, please call +1 656 556 2170 immediately.



Best Regards,

Accounts & Billing Team

Attendees:



cynthiaperez389903@groups.outlook.com



Transaction Alert – Bitcoin Purchase Request Received

Dear Customer, Your PayPal payment for Bitcoin has been received and securely logged in our system. Transaction Summary: Purchase Type: Bitcoin (BTC) Payment Method: PayPal Amount Charged: $350.00



Dear Customer,



Your PayPal payment for Bitcoin has been received and securely logged in our system.



Transaction Summary:



Purchase Type: Bitcoin (BTC)

Payment Method: PayPal

Amount Charged: $350.00

Status: Under Review



Our verification team is currently processing your order. Once approved, the transaction will be finalized automatically.



If this activity was not authorized by you, please call +1 656 556 2170 immediately.



Best Regards,

Accounts & Billing Team

Kedy

piatok 26. jún 2026

Organizátor

Haresasz Nxysarwsa

haressaznzxrrsxaxz321@gmail.com

Hostia

(Zoznam hostí bol na žiadosť organizátora skrytý)

Odpoveď na cynthiaperez389903@groups.outlook.com

Áno



Nie



Možno

Ďalšie možnosti



Pozvánka z Kalendára Google



Túto správu ste dostali, pretože ste účastníkom danej udalosti.



Ak túto pozvánku prepošlete, ktorýkoľvek jej príjemca bude môcť odoslať odpoveď organizátorovi, byť pridaný do zoznamu hostí, pozývať iných bez ohľadu na ich vlastný stav pozvánky alebo meniť vaše potvrdenie účasti. Ďalšie informácie

Bitcoin Paypal Phish from Microsoft Outlook Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 26 Jun 2026 08:41:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wd7jO-00000000IpV-1wNV

for dave@doctor.nl2k.ab.ca;

Fri, 26 Jun 2026 08:40:34 -0600

Resent-From: The Doctor

Resent-Date: Fri, 26 Jun 2026 08:40:34 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-eastus2azlp17010021.outbound.protection.outlook.com ([40.93.12.21]:3032 helo=BN1PR04CU002.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wd7eJ-00000000IIk-22JQ

for doctor@doctor.nl2k.ab.ca;

Fri, 26 Jun 2026 08:35:31 -0600

Received: from IA4P221CA0003.NAMP221.PROD.OUTLOOK.COM (2603:10b6:208:559::7)

by MN2PR18MB3624.namprd18.prod.outlook.com (2603:10b6:208:261::15) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.159.13; Fri, 26 Jun

2026 14:34:19 +0000

Received: from BL6PEPF00022574.namprd02.prod.outlook.com

(2603:10b6:208:559:cafe::98) by IA4P221CA0003.outlook.office365.com

(2603:10b6:208:559::7) with Microsoft SMTP Server (version=TLS1_3,

cipher=TLS_AES_256_GCM_SHA384) id 15.21.159.18 via Frontend Transport; Fri,

26 Jun 2026 14:34:19 +0000

Authentication-Results: spf=pass (sender IP is 209.85.221.69)

smtp.mailfrom=gmail.com; dkim=pass (signature was verified)

header.d=google.com;dkim=pass (signature was verified)

header.d=gmail.com;dmarc=pass action=none header.from=gmail.com;compauth=pass

reason=100

Received-SPF: Pass (protection.outlook.com: domain of gmail.com designates

209.85.221.69 as permitted sender) receiver=protection.outlook.com;

client-ip=209.85.221.69; helo=mail-wr1-f69.google.com; pr=C

Received: from mail-wr1-f69.google.com (209.85.221.69) by

BL6PEPF00022574.mail.protection.outlook.com (10.167.249.42) with Microsoft

SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.181.6

via Frontend Transport; Fri, 26 Jun 2026 14:34:19 +0000

X-IncomingTopHeaderMarker:

OriginalChecksum:8D67B1ABF46552157F7D6DF35C77A2BE6F1F87F82056D82C8F79D91BE30802A2;UpperCasedChecksum:BD99FA299667F1FAB877984D68397F438C0D72FAFCD72085412FCFB23FA174E5;SizeAsReceived:3412;Count:15

Received: by mail-wr1-f69.google.com with SMTP id ffacd0b85a97d-46fb9079a04so143056f8f.3

for ; Fri, 26 Jun 2026 07:34:19 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=google.com; s=20251104; t=1782484459; x=1783089259; darn=groups.outlook.com;

h=to:from:subject:date:message-id:sender:reply-to:mime-version:from

:to:cc:subject:date:message-id:reply-to;

bh=OeJ0LC1uduzQGr5J558V/KA4q5cOOhLWN/npaCIdtGY=;

b=bDGheJgefh6vtTt+3uTeOKWOkARXvpi8EJEPF12je+LPLzaRBhJ2jHB+/NUNcSr6pq

0EhIrK50d9MQt2eQrOTzcqPtdZYmihFKHraV+WYE656yUFjOQaGCb84pbmEoB2g8lH8u

N1tH10GHk3Ff07RiBEGr1qHwupw+iM/Q2gdnZLlt6fzVSSdJxMEpRnH3iMLVdv4tXZIZ

L+Nc9U5kJO/6OnEXdQsZT7WPNhjltRMEYkUIFuLqYkJCW2QkZ1QSejBapnF9Ou5N2eAy

rNDWJmOqsN/UT3tmNZFJfWZgyf/bJrJVQhR8H54gvlRUg/Tj/j1aH76ODTQTZoB0M7RN

0u6A==

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1782484459; x=1783089259; darn=groups.outlook.com;

h=to:from:subject:date:message-id:sender:reply-to:mime-version:from

:to:cc:subject:date:message-id:reply-to;

bh=OeJ0LC1uduzQGr5J558V/KA4q5cOOhLWN/npaCIdtGY=;

b=NEOI8fq/Z9AioexNA4WDxjLBAlZJ4/hdBA4G0pNaUDOu2LQOSWXOrqhT78w9yzHoBx

dyTdaaEvB07TFHiWHBXxWf3D8EiMvsS05wSii3Wp6y2T0vxmVNOsA9HF+DGS8nvurJFg

2UQ/JiVU/hfw9o0E3t5jVxnQIlM+Jldu5wiyz3GDkaqiMit8NgyHfQabN4wf40q2KEq4

9UrvYB7o2bM6GDQplqZKaYQzWLNFQxz6fAd2j55t62i7ZldnAICJkQumXTpVZ2Rsn21X

Zv4WTeSyqyqPQ3Wiil3QdrVLM6XMv8mINZzH7hDOvjgrSVQCyxH8vR7MAn6HgvYT05UJ

pGiA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1782484459; x=1783089259;

h=to:from:subject:date:message-id:sender:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=OeJ0LC1uduzQGr5J558V/KA4q5cOOhLWN/npaCIdtGY=;

b=leuFCNhqx4eh+303zvS5/zphUe21Bx8xRKK/6v1WjobFV7OBk1tseLUN2Nz+qfMwqv

zO9ggiJvjSmD0TcJYR+P57eAPovl1W3sqWO6bGimZeNacOXeCNJfITVNypbHjZQvrsI1

L9mHFfUPJSaJMqLpiPK58OO2cw2inI1tUwg1B/y1rer/cITN3lfEO3blHozR+JbhlT8C

bkrLcNjfWGCim+iEu4npEpuTbAjUMoqn06YTi2FPTtWxna/Dhd4BdJuIkUjumqNJVdvx

unc+SjN6tynNkDbRawT3My9thKuMuuySOdjFB+HUxC6Bl+0Z4W7gGIq9/VQ2Vo4CWuIB

YHlw==

X-Gm-Message-State: AOJu0YyptClsB6lWNqwQe4j6UNKrFeF3PimLW5DnEILTBuyS3vB/mmO0

wE0y7YrKLradofVQRYt1PekOZ6n3ECFTd0yXRLcyKC4OacEEpSOWN/J80/2g3lj7ZbSNKFK7ajq

JCXQxFsmjJps6z9p8+KF/IwIg8LXpa3BcS7o=

MIME-Version: 1.0

X-Received: by 2002:a05:600c:41c1:b0:492:324d:e93f with SMTP id

5b1f17b1804b1-4926fcac16cmr12536625e9.36.1782484458696; Fri, 26 Jun 2026

07:34:18 -0700 (PDT)

Reply-To: Haresasz Nxysarwsa

Sender: =?UTF-8?Q?Kalend=C3=A1r_Google?=

Message-ID:

Date: Fri, 26 Jun 2026 14:34:18 +0000

Subject: =?UTF-8?Q?Pozv=C3=A1nky=3A_Transaction_Alert_=2D_Bitcoin_Purchase_Requ?=

=?UTF-8?Q?est_Received_=40_pi_26=2E_j=C3=BAn_2026_=28cynthiaperez389903=40groups=2Eo?=

=?UTF-8?Q?utlook=2Ecom=29?=

From: Haresasz Nxysarwsa

To: cynthiaperez389903@groups.outlook.com

Content-Type: multipart/mixed; boundary="000000000000fa79c40655290045"

X-IncomingHeaderCount: 15

X-EOPAttributedMessage: 0

X-EOPTenantAttributedMessage: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa:0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: BL6PEPF00022574:EE_|MN2PR18MB3624:EE_

X-MS-Office365-Filtering-Correlation-Id: c4af5ba4-748c-4f3f-5587-08ded3900231

X-MS-Exchange-EOPDirect: true

X-Sender-IP: 209.85.221.69

X-SID-PRA: HARESSAZNZXRRSXAXZ321@GMAIL.COM

X-SID-Result: PASS

X-MS-Consumer-Group-Expansion-Loop: cynthiaperez389903@groups.outlook.com

X-MS-Exchange-Group-Expansion-Loop: cynthiaperez389903@groups.outlook.com

X-Microsoft-Antispam:

BCL:0;ARA:1444111002|29080799009|34130799006|32020799003|6149299003|5139299004|3151999006|5149299006|16200799027|4040799016|9000799056|24102599021|1680799066|970799063|9400799043|26000799027|26130799012|9020799019|22000799015|6092099016|1041999012|1602099012|18021999003|30041999003|2145499017|1360799030|1370799030|1380799030|3412199025|4302099013|440099028|26104999009;

Bitcoin Paypal Phish from Microsoft Outlook Part 3



0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[40.93.12.21 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[40.93.12.21 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[40.93.12.21 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[40.93.12.21 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[40.93.12.21 listed in list.dnswl.org]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[40.93.12.21 listed in bl.score.senderscore.com]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

1.0 HK_RANDOM_FROM From username looks random

3.5 VOWEL_FROM_7 Impronouncable from header (7+ consecutive vowels)

0.5 FROM_LOCAL_NOVOWEL From: localpart has series of non-vowel letters

1.0 HK_RANDOM_REPLYTO Reply-To username looks random

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[40.93.12.21 listed in wl.mailspike.net]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[haressaznzxrrsxaxz321(at)gmail.com]

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[haressaznzxrrsxaxz321(at)gmail.com]

0.1 TW_RW BODY: Odd Letter Triples with RW

0.3 LONGWORD BODY: Uses overlong words

0.6 MEGALONGWORD BODY: Uses really overlong words

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.2 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and EnvelopeFrom

freemail headers are different

0.1 TO_IN_SUBJ To address is in Subject

3.0 LONG_INVISIBLE_TEXT Long block of hidden text - bayes poison?

Subject: {SPAM?} =?UTF-8?Q?Pozv=C3=A1nky=3A_Transaction_Alert_=2D_Bitcoin_Purchase_Requ?=

=?UTF-8?Q?est_Received_=40_pi_26=2E_j=C3=BAn_2026_=28cynthiaperez389903=40groups=2Eo?=

=?UTF-8?Q?utlook=2Ecom=29?=





Haresasz Nxysarwsa has invited you to Transaction Alert – Bitcoin Purchase Request Received

Title: Transaction Alert – Bitcoin Purchase Request Received

When: June 26, 2026

Organizer:

Haresasz Nxysarwsa

Description: Dear Customer,



Your PayPal payment for Bitcoin has been received and securely logged in our system.



Transaction Summary:



Purchase Type: Bitcoin (BTC)

Payment Method: PayPal

Amount Charged: $350.00

Status: Under Review



Our verification team is currently processing your order. Once approved, the transaction will be finalized automatically.



If this activity was not authorized by you, please call +1 656 556 2170 immediately.



Best Regards,

Accounts & Billing Team

Attendees:



cynthiaperez389903@groups.outlook.com



Transaction Alert – Bitcoin Purchase Request Received

Dear Customer, Your PayPal payment for Bitcoin has been received and securely logged in our system. Transaction Summary: Purchase Type: Bitcoin (BTC) Payment Method: PayPal Amount Charged: $350.00



Dear Customer,



Your PayPal payment for Bitcoin has been received and securely logged in our system.



Transaction Summary:



Purchase Type: Bitcoin (BTC)

Payment Method: PayPal

Amount Charged: $350.00

Status: Under Review



Our verification team is currently processing your order. Once approved, the transaction will be finalized automatically.



If this activity was not authorized by you, please call +1 656 556 2170 immediately.



Best Regards,

Accounts & Billing Team

Kedy

piatok 26. jún 2026

Organizátor

Haresasz Nxysarwsa

haressaznzxrrsxaxz321@gmail.com

Hostia

(Zoznam hostí bol na žiadosť organizátora skrytý)

Odpoveď na cynthiaperez389903@groups.outlook.com

Áno



Nie



Možno

Ďalšie možnosti



Pozvánka z Kalendára Google



Túto správu ste dostali, pretože ste účastníkom danej udalosti.



Ak túto pozvánku prepošlete, ktorýkoľvek jej príjemca bude môcť odoslať odpoveď organizátorovi, byť pridaný do zoznamu hostí, pozývať iných bez ohľadu na ich vlastný stav pozvánky alebo meniť vaše potvrdenie účasti. Ďalšie informácie

Bitcoin Paypal Phish from Microsoft Outlook Part 2

X-Microsoft-Antispam-Message-Info:

=?utf-8?B?blJLY3JUajhwcHhqbGMxSEZzb2JNZ01SNnpTL05maHJ4WVRXbTBXVmFJeEdz?=

=?utf-8?B?TEppU21ORExReko3S3VhVllTYXYzM2x4ZUNsTkRZUGtEaEZqOVBqWmVjTzI0?=

=?utf-8?B?RWRGSnhnMURiMGY3Zm9ORG03NWF1OWFrNzFITCtwVTc0K2d5aXhab2xmOC9z?=

=?utf-8?B?ZDVkWEZaQXo5MHE4RitPWTFNKzAzdEpUUEVaOWdJbExyREdwSmZGbmVrRUlR?=

=?utf-8?B?SGpWZlBvVFZKbTlGYmx1VGZlbnRueHFOK1FaMVV2YWdkQndONlFBYkJ6Tk1o?=

=?utf-8?B?U0ROcXdBRGh5MEhzdlViL00rNG4ybWVnbUdYQzh2MHlBcTB2eXdZRGtRWC9x?=

=?utf-8?B?WjVvT2srdXFkWXlEUGQ4NEM0S1dmU1k0WU9zMHZjRENLWi9hT1UyeEVkSFVx?=

=?utf-8?B?M29lSFBtd2lzbUppL1F2SnhXTUsrQXhjTGpVOTllSFhCSkQwVDVHbkx4UVk0?=

=?utf-8?B?YXJtblZISllWdGFRci9melZVbTN3cDNLZks1WDdZYnE5YVFpZzljdlZ5N3V1?=

=?utf-8?B?b0txUkNLRTlicWhBYUJSWTZhRWp5S2l4ekthbEk4aGZWSW5pd1VPVXdNVUtm?=

=?utf-8?B?LzhrZjFYR3VmQnl6anJzdFFwY0lzNktIUUNMWWEyR3NOd1oweit1RWEyNHFR?=

=?utf-8?B?NnVpN3RCYTFEdGNpNGhJcEdLVXlQcFZCZ2UyeUt5R251SXp6QWZQVlJNUEFR?=

=?utf-8?B?WnkwWThteWpkRkFKVEZHZytyRjBZVGE2dngwSzRJU0hDSmhWNVluYVdOWDBz?=

=?utf-8?B?K0QwaVpPRXpsaWRvd0w0WmlCd2ZVV2M1ZWdoN2tkSm5pRHhCd25pTWhaeVBv?=

=?utf-8?B?TkZWZ2o2ZUNCNXl1SHBzazRaTk9IS21Deml5aDNQMlQ3eXdCM2ZzdnpzWm9E?=

=?utf-8?B?c2tseUw5NUgraFcwcmp3bG11b2FWVnZQNVpPREtnVXJ6SmMzTVNENDBNZWMr?=

=?utf-8?B?bERma2w0MFdxWXF2M1pLamxnSFZkM2dteUdJQTg0TGZhVGJDRGMxUmp3aEpC?=

=?utf-8?B?NWFkSVYyMXdnZ21aTTlTRmV2RnhlbTkwWnpQY1BYYU95ZHV1bjJ3alBUT3dT?=

=?utf-8?B?RE9VdG9vcUhkQlY0RmRjekJTZER1R2l0TGNLYW9jcEwvUVBzWXlKTm9FbklG?=

=?utf-8?B?Ty9RVU5EajUyeHJEK1VycHdCMmhhWWJ5VjBJbnpyUHNiME9Pakdxa2FGN1ZQ?=

=?utf-8?B?ZWZublNMZ3JkdklKNFdrWW1VRzNmNjRkL3ljcDQvb3F2VURvaUNuNWM2SS9P?=

=?utf-8?B?U09FTTFGTWxTOTZGY0lZbUdYdzBBSnd1cS9uOW1ONm03ODc1Z1lUZkUyUHpl?=

=?utf-8?B?K1NIdkthNWFTTlhqZWtCQXo0cXNzenNuL2VRWitTSkhnREY3QkJxWFNtZ1FI?=

=?utf-8?B?bGtPMHRwOEM2R2dZempqSGcwcG9xblI4cEpFanZTcWZTTHFQMTNnV2V1NnlW?=

=?utf-8?B?RHQwVFRXQisrNWsvc3JENzBOQi9IdDZBMGZxYk1ydm96bUFiMkVxcHl2NnpL?=

=?utf-8?B?NnZZZ3BGMEZCeUlkZW9DblFFcndrcWhCMzRsWnM1RzAzL0w3bmN0eGNLRmhS?=

=?utf-8?B?QktnaENMY1NTUUpzVVlKbWNXemdsUHZwZEtFSUFhQTJVYnZXK1pRNUgzVmtJ?=

=?utf-8?B?YlQrdEFnZzZEdnBsakpFVnZaUks0SEtoK1VrN1dvd0xKMXBQR0tZR1NKU3RU?=

=?utf-8?B?R0Vsc3hxbUsreDBkR2k4amgzaUVGTC94ZFFXcFlrN2ZLK0RJU2FqN09rdG1Z?=

=?utf-8?B?dHlQNEpFL0tleXpyWmhMOWV4KzdOV0hMK25SS0JYVElrTjdUblNPSTlBcVpM?=

=?utf-8?B?cW8vWW54VHlPSk82UGx3ZUpGYksyUUlzUlRKbG02cTUzS2NBem01cnNIZDJ3?=

=?utf-8?B?USt3NnJwaXhhOXpRWkNkaXozLzhZU0RBUzIrbHNIYjI2b3FNTGwxcGEyL2Ny?=

=?utf-8?B?L2MvK2M1eVdsR01ZYzNFemxLc1pFL29oWExkeUo2MlNWUG9GNDFJeWF6czNO?=

=?utf-8?B?OXFKajRIOWpoNjV4TmJ2L0kySFpwaTZrZzYwVGtyeGJJeUs1eE85QUVXNDBH?=

=?utf-8?B?dmZ3MnZ2ZlJ6TUpOYXIweC92S0dXL0pZd1BHeWcxOVIvaGZMYkpNSU1LYlFB?=

=?utf-8?B?d3ZZYWtqQkt2VlBXNUFQS0FDVkNWOU5uMllOcXkwL3MySiszeVk5UWlOYmJV?=

=?utf-8?B?bTV6c2JqREhSaVRMVy9BamlKeFRUZ3VoNkN2dXlsT3REdTJqemNEV21KMTFS?=

=?utf-8?B?TmN1NG92ZUdSTkxDdlEybDNONWp3b0d6TlRCZHVEWmthNU5NbzVad2hDcGFI?=

=?utf-8?B?dVRoc2JORVhKRXpHUlBJeFBMSnp2NXF1NUQwRERiaE50MEg2TVlVbFVObmJy?=

=?utf-8?B?STdHTHFTUnc0amV4TGkxTzJadHdCblhIUVlpREtVNHdEdmZ6dGxneStCd1hF?=

=?utf-8?B?b0ZYOElYMHQ1M0tJY0tNVTFnalN1dERxdlUzMTZwTWtwb2QyM2hUNnM5MXRI?=

=?utf-8?B?aXpUZUk5MnFBK2M2clh4dHhKODQzcDdLS0RSWGpiS0tvZ3FDK1c5R3Nkc3Z1?=

=?utf-8?B?TlNjR2xndHRhRXVmNDRZekt6RGtBaUlyQ0t0cHNpbW9QdzY4UndsQjhpckpy?=

=?utf-8?B?ZTQ4SExtV3g3UktJVUpLSGdqQnJHa3NhOUgzdVZJNU41RHNYNndVNkJzNDVa?=

=?utf-8?B?d09yTWJwbTEwWXI4cmdYMHJpRGhPRkd2Y1Z1TlNKSTkyb2FOTnBtTlg3cTdH?=

=?utf-8?B?VGtPYjcwT2E0a2JHbVdFMU81SEY1MVIzMHhSZ2tlYkN0cGc5eFEwZmdRczJ6?=

=?utf-8?B?QlN1a2pROGN2UFVkVzAySzFtMkRLbEJPVW9ZaTZaVFdpRHpIU0hFU1RXdW1N?=

=?utf-8?B?MGtxQ05naDdlNkVPcmVJQnhxT3pBUDlhcUt2MlB2c3RoMXdLZmxFQW43RWo4?=

=?utf-8?B?TDMwSEl1Rm1RWG5WUWFScVFPcCtTQWtHaFh6SFFncW9GOUFBVHlVQTZFQ1hS?=

=?utf-8?B?QmJOSFJKRUJFSHk0T0V0OUtnaGdJQTFrcG13YmlCWWprV3ZJUS94eWNRMW5G?=

=?utf-8?B?Rm5IaGFmRGNHTEgvTFREV3NLc210dlZITkkvMmNjU3FuV2dqMHMyZmRPVW85?=

=?utf-8?B?dklvWGdlcVZYNTZtYW1uVG9xdzJ4d09nZWhoZ3FLS2NiRTdGQ0pvVzc1aTJU?=

=?utf-8?B?VHFPL3NtVkhDM3hBaHBOMVcwRkRGRmdnOWhlTm82b1p0ZkhVdmJyTnpUTjJB?=

=?utf-8?Q?/+3ckOnPD5y2k9uLvXeuDtIiY19giPcSkMq+7FOqcqu9Z72?=

X-Auto-Response-Suppress: DR, OOF, AutoReply

X-OriginatorOrg: sct-15-20-9412-4-msonline-outlook-090a5.templateTenant

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 26 Jun 2026 14:34:19.8468

(UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id: c4af5ba4-748c-4f3f-5587-08ded3900231

X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-AuthSource: BL6PEPF00022574.namprd02.prod.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: Internet

X-MS-Exchange-Transport-CrossTenantHeadersStamped: MN2PR18MB3624

X-Spam_score: 13.7

X-Spam_score_int: 137

X-Spam_bar: +++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Transaction Alert – Bitcoin Purchase Request Received piatok

26. jún 2026 Dear Customer, Your PayPal payment for Bitcoin has been received

and securely logged in our system.



Content analysis details: (13.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.221.69 listed in will-spam-for-food.eu.org]

[209.85.221.69 listed in will-spam-for-food.eu.org]

[209.85.221.69 listed in will-spam-for-food.eu.org]

[209.85.221.69 listed in will-spam-for-food.eu.org]

[209.85.221.69 listed in will-spam-for-food.eu.org]

[209.85.221.69 listed in will-spam-for-food.eu.org]

[209.85.221.69 listed in will-spam-for-food.eu.org]

[209.85.221.69 listed in will-spam-for-food.eu.org]

[2603:10b6:208:559:cafe:0:0:98 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:559:cafe:0:0:98 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:559:cafe:0:0:98 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:559:cafe:0:0:98 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:559:cafe:0:0:98 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:559:cafe:0:0:98 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:559:cafe:0:0:98 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:559:cafe:0:0:98 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:559:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:559:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:559:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:559:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:559:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:559:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:559:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:559:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[40.93.12.21 listed in will-spam-for-food.eu.org]

[40.93.12.21 listed in will-spam-for-food.eu.org]

[40.93.12.21 listed in will-spam-for-food.eu.org]

[40.93.12.21 listed in will-spam-for-food.eu.org]

[40.93.12.21 listed in will-spam-for-food.eu.org]

[40.93.12.21 listed in will-spam-for-food.eu.org]

[40.93.12.21 listed in will-spam-for-food.eu.org]

[40.93.12.21 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[40.93.12.21 listed in dnsbl.ahbl.org]

[40.93.12.21 listed in dnsbl.ahbl.org]

[40.93.12.21 listed in dnsbl.ahbl.org]

[40.93.12.21 listed in dnsbl.ahbl.org]

[209.85.221.69 listed in dnsbl.ahbl.org]

[209.85.221.69 listed in dnsbl.ahbl.org]

[209.85.221.69 listed in dnsbl.ahbl.org]

[209.85.221.69 listed in dnsbl.ahbl.org]

[2603:10b6:208:559:cafe:0:0:98 listed in]

[dnsbl.ahbl.org]

[2603:10b6:208:559:cafe:0:0:98 listed in]

[dnsbl.ahbl.org]

[2603:10b6:208:559:cafe:0:0:98 listed in]

[dnsbl.ahbl.org]

[2603:10b6:208:559:cafe:0:0:98 listed in]

[dnsbl.ahbl.org]

[2603:10b6:208:559:0:0:0:7 listed in]

[dnsbl.ahbl.org]

[2603:10b6:208:559:0:0:0:7 listed in]

[dnsbl.ahbl.org]

[2603:10b6:208:559:0:0:0:7 listed in]

[dnsbl.ahbl.org]

[2603:10b6:208:559:0:0:0:7 listed in]

[dnsbl.ahbl.org]

Bitcoin Paypal Phish from Microsoft Outlook Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 26 Jun 2026 11:36:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wdASg-000000006ge-1gWP

for dave@doctor.nl2k.ab.ca;

Fri, 26 Jun 2026 11:35:30 -0600

Resent-From: The Doctor

Resent-Date: Fri, 26 Jun 2026 11:35:30 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-eastus2azlp17010021.outbound.protection.outlook.com ([40.93.12.21]:3032 helo=BN1PR04CU002.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wd7eJ-00000000IIk-22JQ

for doctor@doctor.nl2k.ab.ca;

Fri, 26 Jun 2026 08:35:31 -0600

Received: from IA4P221CA0003.NAMP221.PROD.OUTLOOK.COM (2603:10b6:208:559::7)

by MN2PR18MB3624.namprd18.prod.outlook.com (2603:10b6:208:261::15) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.159.13; Fri, 26 Jun

2026 14:34:19 +0000

Received: from BL6PEPF00022574.namprd02.prod.outlook.com

(2603:10b6:208:559:cafe::98) by IA4P221CA0003.outlook.office365.com

(2603:10b6:208:559::7) with Microsoft SMTP Server (version=TLS1_3,

cipher=TLS_AES_256_GCM_SHA384) id 15.21.159.18 via Frontend Transport; Fri,

26 Jun 2026 14:34:19 +0000

Authentication-Results: spf=pass (sender IP is 209.85.221.69)

smtp.mailfrom=gmail.com; dkim=pass (signature was verified)

header.d=google.com;dkim=pass (signature was verified)

header.d=gmail.com;dmarc=pass action=none header.from=gmail.com;compauth=pass

reason=100

Received-SPF: Pass (protection.outlook.com: domain of gmail.com designates

209.85.221.69 as permitted sender) receiver=protection.outlook.com;

client-ip=209.85.221.69; helo=mail-wr1-f69.google.com; pr=C

Received: from mail-wr1-f69.google.com (209.85.221.69) by

BL6PEPF00022574.mail.protection.outlook.com (10.167.249.42) with Microsoft

SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.181.6

via Frontend Transport; Fri, 26 Jun 2026 14:34:19 +0000

X-IncomingTopHeaderMarker:

OriginalChecksum:8D67B1ABF46552157F7D6DF35C77A2BE6F1F87F82056D82C8F79D91BE30802A2;UpperCasedChecksum:BD99FA299667F1FAB877984D68397F438C0D72FAFCD72085412FCFB23FA174E5;SizeAsReceived:3412;Count:15

Received: by mail-wr1-f69.google.com with SMTP id ffacd0b85a97d-46fb9079a04so143056f8f.3

for ; Fri, 26 Jun 2026 07:34:19 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=google.com; s=20251104; t=1782484459; x=1783089259; darn=groups.outlook.com;

h=to:from:subject:date:message-id:sender:reply-to:mime-version:from

:to:cc:subject:date:message-id:reply-to;

bh=OeJ0LC1uduzQGr5J558V/KA4q5cOOhLWN/npaCIdtGY=;

b=bDGheJgefh6vtTt+3uTeOKWOkARXvpi8EJEPF12je+LPLzaRBhJ2jHB+/NUNcSr6pq

0EhIrK50d9MQt2eQrOTzcqPtdZYmihFKHraV+WYE656yUFjOQaGCb84pbmEoB2g8lH8u

N1tH10GHk3Ff07RiBEGr1qHwupw+iM/Q2gdnZLlt6fzVSSdJxMEpRnH3iMLVdv4tXZIZ

L+Nc9U5kJO/6OnEXdQsZT7WPNhjltRMEYkUIFuLqYkJCW2QkZ1QSejBapnF9Ou5N2eAy

rNDWJmOqsN/UT3tmNZFJfWZgyf/bJrJVQhR8H54gvlRUg/Tj/j1aH76ODTQTZoB0M7RN

0u6A==

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1782484459; x=1783089259; darn=groups.outlook.com;

h=to:from:subject:date:message-id:sender:reply-to:mime-version:from

:to:cc:subject:date:message-id:reply-to;

bh=OeJ0LC1uduzQGr5J558V/KA4q5cOOhLWN/npaCIdtGY=;

b=NEOI8fq/Z9AioexNA4WDxjLBAlZJ4/hdBA4G0pNaUDOu2LQOSWXOrqhT78w9yzHoBx

dyTdaaEvB07TFHiWHBXxWf3D8EiMvsS05wSii3Wp6y2T0vxmVNOsA9HF+DGS8nvurJFg

2UQ/JiVU/hfw9o0E3t5jVxnQIlM+Jldu5wiyz3GDkaqiMit8NgyHfQabN4wf40q2KEq4

9UrvYB7o2bM6GDQplqZKaYQzWLNFQxz6fAd2j55t62i7ZldnAICJkQumXTpVZ2Rsn21X

Zv4WTeSyqyqPQ3Wiil3QdrVLM6XMv8mINZzH7hDOvjgrSVQCyxH8vR7MAn6HgvYT05UJ

pGiA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1782484459; x=1783089259;

h=to:from:subject:date:message-id:sender:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=OeJ0LC1uduzQGr5J558V/KA4q5cOOhLWN/npaCIdtGY=;

b=leuFCNhqx4eh+303zvS5/zphUe21Bx8xRKK/6v1WjobFV7OBk1tseLUN2Nz+qfMwqv

zO9ggiJvjSmD0TcJYR+P57eAPovl1W3sqWO6bGimZeNacOXeCNJfITVNypbHjZQvrsI1

L9mHFfUPJSaJMqLpiPK58OO2cw2inI1tUwg1B/y1rer/cITN3lfEO3blHozR+JbhlT8C

bkrLcNjfWGCim+iEu4npEpuTbAjUMoqn06YTi2FPTtWxna/Dhd4BdJuIkUjumqNJVdvx

unc+SjN6tynNkDbRawT3My9thKuMuuySOdjFB+HUxC6Bl+0Z4W7gGIq9/VQ2Vo4CWuIB

YHlw==

X-Gm-Message-State: AOJu0YyptClsB6lWNqwQe4j6UNKrFeF3PimLW5DnEILTBuyS3vB/mmO0

wE0y7YrKLradofVQRYt1PekOZ6n3ECFTd0yXRLcyKC4OacEEpSOWN/J80/2g3lj7ZbSNKFK7ajq

JCXQxFsmjJps6z9p8+KF/IwIg8LXpa3BcS7o=

MIME-Version: 1.0

X-Received: by 2002:a05:600c:41c1:b0:492:324d:e93f with SMTP id

5b1f17b1804b1-4926fcac16cmr12536625e9.36.1782484458696; Fri, 26 Jun 2026

07:34:18 -0700 (PDT)

Reply-To: Haresasz Nxysarwsa

Sender: =?UTF-8?Q?Kalend=C3=A1r_Google?=

Message-ID:

Date: Fri, 26 Jun 2026 14:34:18 +0000

Subject: =?UTF-8?Q?Pozv=C3=A1nky=3A_Transaction_Alert_=2D_Bitcoin_Purchase_Requ?=

=?UTF-8?Q?est_Received_=40_pi_26=2E_j=C3=BAn_2026_=28cynthiaperez389903=40groups=2Eo?=

=?UTF-8?Q?utlook=2Ecom=29?=

From: Haresasz Nxysarwsa

To: cynthiaperez389903@groups.outlook.com

Content-Type: multipart/mixed; boundary="000000000000fa79c40655290045"

X-IncomingHeaderCount: 15

X-EOPAttributedMessage: 0

X-EOPTenantAttributedMessage: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa:0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: BL6PEPF00022574:EE_|MN2PR18MB3624:EE_

X-MS-Office365-Filtering-Correlation-Id: c4af5ba4-748c-4f3f-5587-08ded3900231

X-MS-Exchange-EOPDirect: true

X-Sender-IP: 209.85.221.69

X-SID-PRA: HARESSAZNZXRRSXAXZ321@GMAIL.COM

X-SID-Result: PASS

X-MS-Consumer-Group-Expansion-Loop: cynthiaperez389903@groups.outlook.com

X-MS-Exchange-Group-Expansion-Loop: cynthiaperez389903@groups.outlook.com

X-Microsoft-Antispam:

BCL:0;ARA:1444111002|29080799009|34130799006|32020799003|6149299003|5139299004|3151999006|5149299006|16200799027|4040799016|9000799056|24102599021|1680799066|970799063|9400799043|26000799027|26130799012|9020799019|22000799015|6092099016|1041999012|1602099012|18021999003|30041999003|2145499017|1360799030|1370799030|1380799030|3412199025|4302099013|440099028|26104999009;

Chinese products spam

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 26 Jun 2026 11:37:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wdATO-000000006sT-3pZF

for dave@doctor.nl2k.ab.ca;

Fri, 26 Jun 2026 11:36:14 -0600

Resent-From: The Doctor

Resent-Date: Fri, 26 Jun 2026 11:36:14 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-m128188.netease.com ([103.209.128.188]:56440)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wdAH6-000000001Ch-2NQa

for sales@nk.ca;

Fri, 26 Jun 2026 11:23:47 -0600

Content-Type: multipart/alternative; BOUNDARY="=_Part_700319_1579673706.1782494555366"

To: sales

Reply-To: sales23@abiscircuits.com

Subject: =?UTF-8?B?UmU6RnVsbCB0cmFjZWFiaWxpdHkgZm9yIHlvdXIgbWVkaWNhbCBQQ0JBcw==?=

X-Priority: 3

MIME-Version: 1.0

Received: from diana@abiscircuits.cn( [10.139.4.149] ) by ajax-webmail ( [127.0.0.1] ) ; Sat, 27 Jun 2026 01:22:35 +0800 (GMT+08:00)

From: Diana

Date: Sat, 27 Jun 2026 01:22:35 +0800 (GMT+08:00)

X-WM-Tid: 0a9f04f46cc4080ckunm5992c722dfd37

DKIM-Signature: a=rsa-sha256;

b=FTL9dUdTA0/LhQRv2+2tTjL4BHyIA/2AOkADWcpJ84KTBo7cSm2+J01ljCVhlqmtkXnZMtNma3wx8KE0AxjcRGlMpNMTwRXd1jbP4kd1INBQaHjlIfdfNdL+zcTaERLdFAaZL9wa4DMvrqXKOld5WQP7Uaa+OYh5CpdIU7Qk5rA=; c=relaxed/relaxed; s=default; d=abisassembly.net; v=1;

bh=ZGbpr4JkY6Ulp8netq7jq4M6evLINq/vUWr2jSSq9rg=;

h=date:mime-version:subject:message-id:from;

Message-ID:





Hi sales,

I hope this email finds you well.



I notices you recently viewed my last email.And want to reach out to see if you have any questions or needs future information .



Abis have been makeing OEM circuit boards since 2006



I'm confident with our quality and attractive cost .



Would you mind open a door to add one more good supplier pls ?









Diana Dai

Project Representative | ABIS Circuits Co., Ltd



Rigid PCB, Flex PCB, Rigid-Flex 1~32 Layer PCB, Metal PCB, HDI PCB, PCBA

Mobile / Whatsapp / Wechat: +86 13510754753

Email: sales23@abiscircuits.com / diana@abiscircuits.cn

Website: abiscircuits.com











Web/SEo/App spam from Microsoft outlook Part 2

--_000_SJ0PR03MB7027667C987A5A87800CC14BD7EB2SJ0PR03MB7027namp_

Content-Type: text/plain; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable



Hello,



Which city and Keywords are you focusing on?



If you are interested, please let me know.



Thanks,



________________________________

From: Josh Jonse

Sent: Thursday, June 25, 2026 4:11 PM

Subject: Re: CO: My best Plan!!



Hello,



Love your site design =97 very professional.



I noticed it=92s not showing up on Google.



I offer SEO services that work =97 and I=92d be happy to send you:







My best offer



Pricing

*

Success stories



Please let us know if you=92re interested.



Kind Regards,



Josh Jonse,





--_000_SJ0PR03MB7027667C987A5A87800CC14BD7EB2SJ0PR03MB7027namp_

Content-Type: text/html; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable








252">








Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">

Hello,



nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">







nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">

Which city and Keywor=

ds are you focusing on?



nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">







nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">

If you are interested=

, please let me know.



nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">







Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">

Thanks,





Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">












11pt; color: rgb(0, 0, 0);">

From: Josh Jonse


Sent: Thursday, June 25, 2026 4:11 PM


Subject: Re: CO: My best Plan!!


 





ze: 12pt; color: rgb(0, 0, 0);">

Hello,



ze: 12pt; color: rgb(0, 0, 0);">







ze: 12pt; color: rgb(0, 0, 0);">

Love your site design =97 very professional.



ze: 12pt; color: rgb(0, 0, 0);">







ze: 12pt; color: rgb(0, 0, 0);">

I noticed it=92s not showing up on Google.



ze: 12pt; color: rgb(0, 0, 0);">







ze: 12pt; color: rgb(0, 0, 0);">

I offer SEO services that work =97 and I=92d be happy to send you:



ze: 12pt; color: rgb(0, 0, 0);">







    =3D"direction: ltr; margin-top: 0px; margin-bottom: 0px; list-style-type: d=

    isc;">


  • rgb(0, 0, 0); margin-top: 0px; margin-bottom: 0px;">

    My best offer



  • lor: rgb(0, 0, 0); margin-top: 0px; margin-bottom: 0px;">

    Pricing



  • lor: rgb(0, 0, 0); margin-top: 0px; margin-bottom: 0px;">

    Success stories





ze: 13pt; color: rgb(0, 0, 0);">







ze: 13pt; color: rgb(200, 38, 19);">

Please let us know=

if you=92re interested.



ze: 12pt; color: rgb(0, 0, 0);">







ze: 12pt; color: rgb(0, 0, 0);">

Kind Regards,



ze: 12pt; color: rgb(0, 0, 0);">







ze: 12pt; color: rgb(0, 0, 0);">

Josh Jonse,



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">












--_000_SJ0PR03MB7027667C987A5A87800CC14BD7EB2SJ0PR03MB7027namp_--

Web/SEo/App spam from Microsoft outlook Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 26 Jun 2026 06:42:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wd5ru-00000000FKJ-33p3

for dave@doctor.nl2k.ab.ca;

Fri, 26 Jun 2026 06:41:14 -0600

Resent-From: The Doctor

Resent-Date: Fri, 26 Jun 2026 06:41:14 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-westcentralusazolkn19010017.outbound.protection.outlook.com ([52.103.7.17]:16216 helo=CY7PR03CU001.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wd5EL-00000000NtO-2IXg

for root@nk.ca;

Fri, 26 Jun 2026 06:00:33 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=LTYae4ymx6sef+ckKhI6VspowwzsjxFfVNqXXfu5iMyFobjA4z+geEL0/RbSUT1BN9rDrIoOeh4WciXihRDrf1Spm4nnTuVqnznFklf4p8HPfZ8y4YUwo/CgOqzv+YK9jWngG2Sozy895trG4iTqLDTdhTleKLfEJlzTocMg5eoi1ILp895u8LP6goMvlXzojpzxlyQ9z+S2AvunonTDCx0bLCZKqixBIryjjiMwzcXOjWgXFyPhqCJ1Jewutqc5dcVmHprjhHjkrZBrg9E/szhQwwNuEUrthxXAaFg8NaV3q9uXQcGV/Z74xk9tFaEUdBlKvGANOZ8auXC9+rzBlg==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=kUwpeQehbpYKtjSOgR2Qr8Z2BUO7yJ2q38idkMBXQmE=;

b=F4doejPC/3iS4kyx2ulQfxJ6IH6yFQVYDenlCR6M4TecG3XLJr6OILPIH3hvO0lZy7WHveWx/CQ7Ji71SoFFwCUEyCjpZ2iYG+Onc8qtg36HZ8pwmP6pwYhgjpY7V2e7YE9hYJYnQyRu88kHnbi2nvXSq8cIY9Ynh3Jucdie35w8NNGHFem7JNZY7Me2ofEcpJfyrUl5OIJfhn5escDhTtpz3Ull9lwHz17hDbSpKUzpLnWvq8Ckx17PXXJcWs0wJJDlgdhqn0BYvfRDyWIYsCT7PLINzejuXxdeANf2MmDHDwV0bciZAH0t9Utk1h20v8GcUBpYbx2XRqzIVV9Y0w==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=kUwpeQehbpYKtjSOgR2Qr8Z2BUO7yJ2q38idkMBXQmE=;

b=soM0J9fPZkTpudu0YmrOgpaLxMyKACoh/cfbKX9cOBwxjTPhqbYqc3d5n19m0ncvU9KSqVN4tu/0VmwVt2DcVGYlXc923Uap5lBc7Y7Dksqg+cJxHsd6dzyOLFTW1UQqEfLOxG8k0tmQc5XFW+x8uvQDbUpWr4GLLBpMGoMWtk1OlK5pyaIhVEhD8SfN8//7MwNA9GTYPiPzv4JPuSLCmpaU73eiHWuKgJueB1pHK+AwNrV1WuNGKqkihFcbCbF8U8YDLsQJsKLfwObWbAJnS7qSHqTN3Y2yStpnO4n/52bsAuCRCyGTc/beaXAZogfRmj5/r7bSHX3lrKAHF3yPYg==

Received: from SJ0PR03MB7027.namprd03.prod.outlook.com (2603:10b6:a03:4e3::15)

by DS0PR03MB7584.namprd03.prod.outlook.com (2603:10b6:8:204::7) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.159.16; Fri, 26 Jun

2026 11:59:21 +0000

Received: from SJ0PR03MB7027.namprd03.prod.outlook.com

([fe80::a968:d862:6319:95bc]) by SJ0PR03MB7027.namprd03.prod.outlook.com

([fe80::a968:d862:6319:95bc%5]) with mapi id 15.21.0139.020; Fri, 26 Jun 2026

11:59:21 +0000

From: Josh Jonse

To: Josh Jonse

Subject: Re: CO:

Thread-Topic: CO:

Thread-Index: AQHdBWM5b8LJeNOb/02TjKUGQbvrdA==

Date: Fri, 26 Jun 2026 11:59:20 +0000

Message-ID:



References:



In-Reply-To:



Accept-Language: en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

msip_labels:

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: SJ0PR03MB7027:EE_|DS0PR03MB7584:EE_

x-ms-office365-filtering-correlation-id: aad17378-d325-4f34-6972-08ded37a5b95

x-ms-exchange-slblob-mailprops:

lKmFK9UkC1O1lwmcPpTlqNOWm6nAASt/Q5Y6Jz7WNUEbxDdrXG8kcQVXdJHqaLFJgOs6mIX4NM8q/5qe9OgSWqjRPDfMZVI1grglOdFdZqtv6aVD6IsIpq5MDF1fGJKampEsHlB6ANq78MTX+njhYiZjG8LlWZ8eLxEEjwqqgnPsd7O4yKBDP3ScKgqrKdTE2uzzr1MDJ//ig5B9VyhP3GoQi4rBF/2wa0u0BHNlH7JssquxcSAP9LC/Ic5Pmv6CMKinfVFiK77EO3KUQNOue3zjcKJAgl6EVyXBSUrYig2yUF0AUFFq8BrMDzcpGPsgOHoTHueEPulfRtUYT3vqra+gRpESFLc/Jf5Ah86nPiH9JbEDGHiWSdzHBSrqRmXj8q/Fdryr/R+Kb+YgLs+SiC6dVZCoEnjwSM6xq7ciDDSAarqI2y/8e9D9rOohGdI5LPehGcw3LVmJ0jb3gKQJWOOc98pDwICPp3b4E2/3i+LDV/q21F0HY1SMaTJb2lyu8oOlRDVAf9y1GzbeBtzJXawylUKnsqs06gtxv40kdPY8A+8/p4tBpLC5iPYxwjKjg3pDUHB80os=

x-microsoft-antispam:

BCL:0;ARA:14566002|48001999003|24121999003|4140399003|31061999003|8060799015|8062599012|37011999003|51005399006|37102599003|19110799012|22091999003|45011099003|55001999006|25010399006|15080799012|15030799006|40105399003|11120399003|26121999007|12091999003|56899033|3412199025|440099028|102099032|1710799026;

x-microsoft-antispam-message-info:

=?Windows-1252?Q?rkBh2VfzqOR3WS6mb0MESFSXLC7DVqs+ByENeSgv3sCKGnfjb849e1C5?=

=?Windows-1252?Q?8BRkYB6KwzbZAKe0jerTPhQxdV6BwX+3mwTyEz2lJBwGAPUdxOD4jlo0?=

=?Windows-1252?Q?4dPnxwoejhz6vqp7Q0Cpikb8TAVbHRNmmG4LewAcpC9/KgX+ZxJ6+os7?=

=?Windows-1252?Q?/T6vjo59xo7bVGmEjicNDAhdhznPRT02543CtIpkRhG5cKg9dMB5VpGk?=

=?Windows-1252?Q?DD6jgicjONWtwV1QpQhjBe9Tatpr90A/tMi0ZCruBsXmTjjdJ42VMDTZ?=

=?Windows-1252?Q?x1rvZgjdRvqMrmqdCPMEtuDMtIn/L4sZU5sztuFNWhRfDOQ05cgvCjIC?=

=?Windows-1252?Q?OViUIJRfQu6Bo0ChCaXVUxqJBthIIQ/RO3m8cZKIPwZbGcImcUcDgZik?=

=?Windows-1252?Q?Op1ziqA308JmA00k/4ZnljiIYRpdLpCUBd81eXW/SSPYAecjQl5Itb34?=

=?Windows-1252?Q?6IW7gV8POiQVMIdI/Ml+uQUnzmeKJjjPetJQbuOvcuFBk5o0JpQYKNNy?=

=?Windows-1252?Q?OhLdq7sVLLyMmSxesB4vL4UhRrTKyAD/XRynaBmi5kyk/0Nw6gz07xeV?=

=?Windows-1252?Q?qOLVycWE6c8fVLEAHc0xwnIIWEjRbKzBFsaPpJiISoIoVKKofesn+eqF?=

=?Windows-1252?Q?2/I3PI2d/lFCRbCIYgyTt/CMXSNsK1ZhRpuFZanXdQQgKbLtVFBgkRNS?=

=?Windows-1252?Q?fzNEWErdHlutpjwgKA1blMV+d7a+P77YcwtZ7cyffX7xPyGvJVOKTlhm?=

=?Windows-1252?Q?I0CwrYkDcanlZ3oR2DB9qXtzzhwUePvEsu05XkgM4zaEYMu0yG4lrif3?=

=?Windows-1252?Q?rgggjDBahsy5J8W5IZeL6tHxlzsf+uJ4nF5SYlDDA+h4lggB0zLPKq06?=

=?Windows-1252?Q?vTbjvYtBGx/neg8Uncy5MnPx+kkA7FAo8SpPoF0ZesZPa3AkjLlWts/I?=

=?Windows-1252?Q?rtGEp+nDcPgolpuZaYIai2IPjFV9fBve+1xehtX9tFIrALjh0XQhqyef?=

=?Windows-1252?Q?sn7eQKZRoNhaGPTbWJnVVO76o9k/zfhr8tHG8kFqJ4FKXYvD5T7/1C86?=

=?Windows-1252?Q?5Kcy24KXkN/EgxEtagdckhRJ8QDkkJOPoJTHE7JCxUOtSzDtNmjG7uw/?=

=?Windows-1252?Q?S2ibM8/+FmiRkwd20nOLrBmY59WVzdlti+IOYLMbj3GnpzyK/CJ5dbPM?=

=?Windows-1252?Q?ZxmidHsDEkw3k03A+uv6tUoFPjV3+sL+OlCcz6nDupQfZoW2YOydZD79?=

=?Windows-1252?Q?Bvo9wm10E8/RdwCovPUld1ggovVdfi7wjGomyexiFtlN8HEtZlPjP0Xt?=

=?Windows-1252?Q?wXrXpfKQVX96w+VvQcMsFlAMnrg7Ye76tO3XQO6OytXmjGLo?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?Windows-1252?Q?QEx73/KVrfeIql6MFZHdqLGJidQ0WcoZJfu3wQO3XoaVw0HCG58nqiqa?=

=?Windows-1252?Q?VMikDM/mbyEHp6DEQ3h9Qf1oIeouhOuB04j7kanHaeth6d49URIuUniD?=

=?Windows-1252?Q?M1alTtLfgVYoaQpmfYQ/AbiuXIuCjdA8+cqcKusdfAQogbwEza9oQAPc?=

=?Windows-1252?Q?9mZCjbmwfDUKBVCUDc797owq9lY0NSqRjOBay6zwS5bvMD8s9T4DVsMc?=

=?Windows-1252?Q?9HFk/IbsuxuOuEDojFioH+K8Wwu5GwAYUdSpONyOJElFipv23u4zqNa0?=

=?Windows-1252?Q?effVLN/LOj17uiF7sYjzSuwrFX+rHiY/DiL99Tch93Z5Zm5fogrFms/s?=

=?Windows-1252?Q?gbO0ALkXCFPF45kXv+0f0yUONr36mOKTg5gNTVaEFef4wZtmSBOwgFP7?=

=?Windows-1252?Q?o/8EQY1gsZdL2yhmc8CepPV76T9C+LSAt8n6rj904OmS+OVTzj/eDIVs?=

=?Windows-1252?Q?Ap3ZsS+Wv1ywF1mo4NE5DaaOabN5bBansN3aKxdIhTqSNSvGjGaTigHZ?=

=?Windows-1252?Q?kiF6rAZ1xBSg+z3on1O5ZG6jey9fCVeh8EVLp2w9dnYv9K4FUgPrVKXj?=

=?Windows-1252?Q?+vvGde2a85+lRzmj8POrURQjXZtdEHpcZXaHsN5ez7iExWQ/4u7WOi1q?=

=?Windows-1252?Q?HeBMr/LEonFsfNklr9dBBK0mxzZ6FipF0KiP4+chqZDQBIr/WWVByRbA?=

=?Windows-1252?Q?ACbIG2t/IZn5XIFjF9f39+5jkQJ/uhAYhEfC2RMBtvJfOw2mRxYiBKsr?=

=?Windows-1252?Q?CLdL583Y34itAojFXIJttgn034B5uJTGKgqxeB2WFN8Z5OL2yP62LNyI?=

=?Windows-1252?Q?kuVtZRpOnGDfgfEoWDqBjk4WK2qQ1TPw5RsZH7KMAIy85so2wcHvtiRo?=

=?Windows-1252?Q?f+kWQ9Q/ooPwHzikWeXbl08CYr1L3FP08YNXbv21ReUdD8g+1lryxlFb?=

=?Windows-1252?Q?lx1ynSB/P6UuWby++8thUQ/4Gj7oZdDljtVIoRMjB7OCxdaG/au3MRAq?=

=?Windows-1252?Q?FnwnN7DnlaUN8wyMfP2xwWdDZ/CkU5/RIKFmVjaQC0SNvCvru2XVykuG?=

=?Windows-1252?Q?1T6B1jtn2nj4doiz9dAxrXNNbs/6nKOYpUA+QgW3EVXnz5MSs+Y0lsa6?=

=?Windows-1252?Q?gLFQTcX3oCWnLNvWHoNggQq+h9BgJnsE/pHFcuRjRqhAxguCD1E/GAcu?=

=?Windows-1252?Q?nwAtX/fjDD81+bbAHla2jWRdr8z3yRWnAd9Qwr6VzrfyuqjI25EJLe5n?=

=?Windows-1252?Q?kb9ANoqgoP5eEhRHNsktxKKrT7xKRnOFO86ems+NgSLzOg6mQTfSkZUV?=

=?Windows-1252?Q?fTirD5hTFzYIJx5hsyO8YGNbj2+fvbiBWMskCsOEuI9rPldES1f88R32?=

=?Windows-1252?Q?P/TZHzbEA7wCaubSRcttP6bQBqBEvKXV9HkPH1LLsSoYBP2kZ4YeLL4X?=

=?Windows-1252?Q?VT9prqfdVcl3GG21toiFTUTJnfc71D/jXLGQ9FzlGapZ+u/WKF/Nkgr+?=

=?Windows-1252?Q?qPacNbboYh3HDA1Cz9ZHqDDXs+IgfXPrar/mCI4HfRB5J49z7cSQnrNY?=

=?Windows-1252?Q?5MzrT7euTE5Fe5zp?=

Content-Type: multipart/alternative;

boundary="_000_SJ0PR03MB7027667C987A5A87800CC14BD7EB2SJ0PR03MB7027namp_"

MIME-Version: 1.0

X-OriginatorOrg: outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: SJ0PR03MB7027.namprd03.prod.outlook.com

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: aad17378-d325-4f34-6972-08ded37a5b95

X-MS-Exchange-CrossTenant-originalarrivaltime: 26 Jun 2026 11:59:20.8248

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: DS0PR03MB7584

Domain monetisation spam from Google Gmail Part 2

--00000000000013e2c00655254f58

Content-Type: text/plain; charset="UTF-8"



Hey, this is Nik from Roller. Could you please clarify whether you

currently monetize your domains?



--



Teams : nik@rollerads.com



Telegram : @nikrollerads

























--00000000000013e2c00655254f58

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Hey, this is Nik from Roller. Could you please clarif=

y whether you currently monetize your domains?


n class=3D"gmail_signature_prefix">--

gmail_signature" data-smartmail=3D"gmail_signature">


=3D"ltr" style=3D"color:rgb(34,34,34);line-height:1.8;margin-top:0pt;margin=

-bottom:0pt">
olor:rgb(0,0,0);background-color:transparent;vertical-align:baseline">Teams=

:=C2=A0

17,85,204)" target=3D"_blank">
eway,sans-serif;color:rgb(61,101,255);background-color:transparent;vertical=

-align:baseline">nik@rollerads.com


lor:rgb(34,34,34);line-height:1.8;margin-top:0pt;margin-bottom:0pt">
tyle=3D"font-size:10pt;font-family:Raleway,sans-serif;color:rgb(0,0,0);back=

ground-color:transparent;vertical-align:baseline">Telegram :=C2=A0

href=3D"https://wearerollerads-com.rmailroute.net/x/d?c=3D51984853&l=

=3D32492627-e514-479b-9c1a-7f23d37ddec8&r=3D44ed6dd5-5b51-4f06-8f4a-be3=

7dfe5098a" style=3D"color:rgb(17,85,204)" target=3D"_blank">
font-size:10pt;font-family:Raleway,sans-serif;color:rgb(61,101,255);backgro=

und-color:transparent;vertical-align:baseline">@nikrollerads

=


margin-bottom:0pt">
?c=3D51984853&l=3D79e14ed5-e0d0-48be-82d6-2046629a4f22&r=3D44ed6dd5=

-5b51-4f06-8f4a-be37dfe5098a" style=3D"color:rgb(17,85,204)" target=3D"_bla=

nk">
-color:transparent;vertical-align:baseline">
ium;border-style:none;border-color:currentcolor;display:inline-block;overfl=

ow:hidden;width:29px;height:29px">
.com/fTU2P6eNkI7ODZiH9uTXVdhaDO5LLgqxAo83zMEGnjTwjV84D46Vl9HH0JdvuhoLCCYQZh=

HcjICV2Vh96079A69V1hlkrggTLo1GW_ZdFdsc3L5s6eRaUnrcXsZCLQNUZffPbl83KzNDbiPoN=

biWUwQ" width=3D"29" height=3D"29" style=3D"margin-left:0px;margin-top:0px"=

>

erif;color:rgb(51,51,51);background-color:transparent;vertical-align:baseli=

ne">=C2=A0

=3D51984853&l=3D083d7851-4875-44e2-a705-fd2b7d4c519f&r=3D44ed6dd5-5=

b51-4f06-8f4a-be37dfe5098a" style=3D"color:rgb(17,85,204)" target=3D"_blank=

">
olor:transparent;vertical-align:baseline">
m;border-style:none;border-color:currentcolor;display:inline-block;overflow=

:hidden;width:29px;height:29px">
om/N_LdgS_iUjSIzAnbYXRSRfLQlCx-PWtEsL6Rt4rC1fVs-neJV3V-Zy2eejwAS3CZqH4KzKWm=

WxQvoAjpo9gTCg0zjwHOMT8hexaOJMPYRs77Ra5ioHCfc0ZUkbSmba5hZHBZjYyTd1YZt638RWc=

Pj14" width=3D"29" height=3D"29" style=3D"margin-left:0px;margin-top:0px"><=

/span>

if;color:rgb(51,51,51);background-color:transparent;vertical-align:baseline=

">=C2=A0

=3D51984853&l=3D8190a883-1ef5-4752-9b0a-b000ffc7bb1f&r=3D44ed6dd5-5=

b51-4f06-8f4a-be37dfe5098a" style=3D"color:rgb(17,85,204)" target=3D"_blank=

">
olor:transparent;vertical-align:baseline">
m;border-style:none;border-color:currentcolor;display:inline-block;overflow=

:hidden;width:29px;height:29px">
om/ISM_gt9kYDdaepq-KeOuz5w1ieXIZLGsvEwsjrrjd35ZqPfjywU6MjMv5A1ibZuVsMKb4_wz=

8G-63TkawvITv6fQ5h9cBMylj1QZgaG6_nzMo1Y0m6YOsCdJ1geNrB7ol6ES0FmqlbcKfO5EFWA=

rWIA" width=3D"29" height=3D"29" style=3D"margin-left:0px;margin-top:0px"><=

/span>

if;color:rgb(51,51,51);background-color:transparent;vertical-align:baseline=

">=C2=A0=C2=A0

/d?c=3D51984853&l=3De5884f1b-199d-4272-a0c7-ad873130ee8d&r=3D44ed6d=

d5-5b51-4f06-8f4a-be37dfe5098a" style=3D"color:rgb(17,85,204)" target=3D"_b=

lank">
nd-color:transparent;vertical-align:baseline">
edium;border-style:none;border-color:currentcolor;display:inline-block;over=

flow:hidden;width:29px;height:29px">
nt.com/zeF6Fm2lylM2nQM7NRYoFFRlVhZm_ShgaU7PCpBR67bLIj-mzeGy37hAo8FSSlJii63O=

jH06tfKxMxzKlqC9Fk4QUUarHs92cOMMEAyD_LtIH1p52ZboLPDh2V2tGPvhvE6ZCcF2qqpxw10=

QL8Bq-V4" width=3D"29" height=3D"29" style=3D"margin-left:0px;margin-top:0p=

x">

rgb(0,0,0);background-color:transparent;vertical-align:baseline">=C2=A0 =C2=

=A0 =C2=A0 =C2=A0=C2=A0

ute.net/x/d?c=3D51984853&l=3D32492627-e514-479b-9c1a-7f23d37ddec8&r=

=3D44ed6dd5-5b51-4f06-8f4a-be37dfe5098a" style=3D"color:rgb(17,85,204)" tar=

get=3D"_blank">
background-color:transparent;vertical-align:baseline">
-width:medium;border-style:none;border-color:currentcolor;display:inline-bl=

ock;overflow:hidden;width:108px;height:23px">
usercontent.com/vkTobz8uGezGseujZQGbTzFlavwAqhqnG7I-_JwLchoxxv9hdHnqYMR7rty=

JNK22HsONx6rP0_xDiXbJbH_p_Q2RS-lB4xbycRlDe7xe-ouu8soMibD6nkRtV_GVji3CvGtoFP=

1y9WInoA_fH53yJLc" width=3D"108" height=3D"23" style=3D"margin-left:0px;mar=

gin-top:0px">




-M-Fc68Xr3uGtKDlJcR0ByHNbRyuNtwC_WLzCTjEOCDAnibCsZKuo8bzPkdwOXHYmTNQ4oMxQeY=

AQ_84t4eDnAprg6t7YpqRf-ocLsxO6G2WYUy4iCWMdsRMTs5mQWJWewcIvXjdTrVsAWmwvMaEsM=

ajgmzq4-vcdraV93hYvuyXEi" alt=3D"">



--00000000000013e2c00655254f58--

Domain monetisation spam from Google Gmail Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 26 Jun 2026 06:41:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wd5rT-00000000Dp1-0LRW

for dave@doctor.nl2k.ab.ca;

Fri, 26 Jun 2026 06:40:47 -0600

Resent-From: The Doctor

Resent-Date: Fri, 26 Jun 2026 06:40:46 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-qk1-f194.google.com ([209.85.222.194]:53350)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wd3WG-00000000BJI-07sJ

for root@nl2k.ab.ca;

Fri, 26 Jun 2026 04:10:52 -0600

Received: by mail-qk1-f194.google.com with SMTP id af79cd13be357-915b5ce94c7so75484385a.2

for ; Fri, 26 Jun 2026 03:09:55 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1782468589; cv=none;

d=google.com; s=arc-20260327;

b=jXZYUy4aomYdGCd5/LHADd2jieKsrhi358Za0CkmZV9vTzPb0lQ/JaVIK5JbH3Ei/G

iwak66CLSH5ff92L+EPEl2hP/jkfqFwrdHpkgSEXk+sjP8PuXehJIUJ1I7Sl1qn6QNhx

QclXeuRGgm8McWC+ceVMe5rLyuSnevgCXDUBlZp76TD6RPzN1VknnIJ9Y7oAsDwINVhm

a9QPiQvqGDFqt/d4P2Z+fHilwM96sDVdVWn5lsqtAxvs4AzWQSFlbzZ8/Kg9jBuuZefD

7nVOiaJTWkOHZ8BeHvBCfNubqmOGMz5lv6pzFWFjGgO2BgPDr0qi3QhZ3QspUho+Bim8

sSRg==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;

h=to:subject:message-id:date:from:mime-version:dkim-signature;

bh=H9+9ZXpPOJGSINFd5gV+RPQB73Xki5oeraT6UKMkY54=;

fh=xlaqb4BBoLdJtBZev3L7vUQ7NrRWtYUi797wkNVG1OA=;

b=H232fqOCJoHqVvcXkk8ZZ+6UE/d6FnSX9CEqD7DOtbKdhgymOYbQNxW4drN0h4kyK5

p3miSdJ6g+w7oYFhzB+Plfb0cdgB8mieHLZcdBSQUBqgma1T1/baZ9itNBIOx6PH6gka

lfqeRSf1y6oPwhYOuHjOXmOjcA4ZJwlWWMPc1lRsmH/YuIocrb0Frp69Brv2XuSWlG+b

KgrxjP44BdCaDY0jrGgrW2Zq7NzvVZJ1g7poG8piOB1oVwLfhyOemZld+TnHvHscZXNN

VQ8PSddkdHuLsQ7xgnmHW1mBQAGXHRXgac6MRAH91uVcplfwPVrDewyShgBZUDrE/k7p

toLw==;

darn=nl2k.ab.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=wearerollerads.com; s=google; t=1782468589; x=1783073389; darn=nl2k.ab.ca;

h=to:subject:message-id:date:from:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=H9+9ZXpPOJGSINFd5gV+RPQB73Xki5oeraT6UKMkY54=;

b=dYnAqV6pyP3YK5IacTm/tpDpbIFwdYXRJxJ+zlZxeKdslxQS9G579XVkyzzMVjJivZ

4FhUzYVWF8tXJexX/Y832t7p2XccNcyODi3a9857JQO/cqIK6b+BIS07LSoORakV0uwS

dee12yfd/k86WXjXCBI4mSDspKQYgBk2ODl7A=

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1782468589; x=1783073389;

h=to:subject:message-id:date:from:mime-version:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=H9+9ZXpPOJGSINFd5gV+RPQB73Xki5oeraT6UKMkY54=;

b=Psq+NbKsjy6ptWazvp+u1xl+x9Ac+SUoGId39e+tx3DTwDFCaG35E477OFnIh4WQIZ

+FkjPhYAzY70+61jwptQLE3hJDHrDSCS4LDWAO98L/1FIf4y6jEOL5nLXDXBZ96riozo

zHUuBEL1pJzS8o9coA6Ddy2J7wFn4mXtj2Wgu34siBomqQG5xnlBz3NR0MF6L4jIWbXm

mOxSUGwUIHxtq9o27qLXE3XV537cyXLxpazChgIvMwfJqZApkqelTKUaMz1wFafeIwev

/g0PVjOeRM3oUjWHvAVekCR2ldMhGfIMD5+OoFvIaGaSH2WM1XE/rMNErmOXdXc0NRCW

jRpw==

X-Gm-Message-State: AOJu0YwcA0fcMVf6URWW1y4jSzBHzvlT2qK2/PEY9iRnp6ZZiYDgkGsf

Ymb1R6ExEpj8vJIgs83ciCdhLoR/5brA7pCWa8XTrKhdZmWvCVmj7fkPksFqEQUMPPSjbBf9kJO

Bc35MqPI0IHWb331y52dJc1gjf34WVo9PvJeSQ/iX5dT0QkmUn4It3w==

X-Gm-Gg: AfdE7cmncIcXOSLf/vI1pOOJ64k6+MQ6bU+PMDAHwR3K9Q8GDCWtqmUCWsgRV2SBVw4

kKS2+UGj+YqcBW018mmyJZUKJ3DJPfx/v1YhUndv74Dn8LYEOlvmFgbOC9ERpf+WjUkvIXPHXxY

Z+dMmT582nuLWPPupJGZKvqYviNFq0VEEruq4pF7zP4MS5PR6WB+AQ4HpqOcmfSF8C0QnCwXo5Y

l9a632IxsnInLDOaXXVM+emvh9AuNh2jctXF6Dfndj+2CzsW7PFp/aKXidQ72LzypqCCnZnIDZr

h4gNRaEnIKqKrQ2AUaiXtbfozw==

X-Received: by 2002:a05:620a:6412:b0:915:aa63:f34a with SMTP id

af79cd13be357-9293abad59bmr931719785a.22.1782468589114; Fri, 26 Jun 2026

03:09:49 -0700 (PDT)

Received: from 776393159873 named unknown by gmailapi.google.com with

HTTPREST; Fri, 26 Jun 2026 03:09:48 -0700

Received: from 776393159873 named unknown by gmailapi.google.com with

HTTPREST; Fri, 26 Jun 2026 03:09:48 -0700

MIME-Version: 1.0

From: Niko

Date: Fri, 26 Jun 2026 03:09:48 -0700

X-Gm-Features: AVVi8Cf4whc8IkGTtQEOmaJl4worBUlu6FspxiInwc2CafThRCj9bvd84jFebNs

Message-ID:

Subject: Parker Roller Party

To: root@nl2k.ab.ca

Content-Type: multipart/alternative; boundary="00000000000013e2c00655254f58"

X-Spam_score: 6.8

X-Spam_score_int: 68

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hey, this is Nik from Roller. Could you please clarify whether

you currently monetize your domains? -- Teams : nik@rollerads.com





Content analysis details: (6.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.222.194 listed in will-spam-for-food.eu.org]

[209.85.222.194 listed in will-spam-for-food.eu.org]

[209.85.222.194 listed in will-spam-for-food.eu.org]

[209.85.222.194 listed in will-spam-for-food.eu.org]

[209.85.222.194 listed in will-spam-for-food.eu.org]

[209.85.222.194 listed in will-spam-for-food.eu.org]

[209.85.222.194 listed in will-spam-for-food.eu.org]

[209.85.222.194 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.222.194 listed in dnsbl.ahbl.org]

[209.85.222.194 listed in dnsbl.ahbl.org]

[209.85.222.194 listed in dnsbl.ahbl.org]

[209.85.222.194 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.222.194 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.222.194 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.222.194 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.222.194 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.222.194 listed in list.dnswl.org]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: rmailroute.net]

1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist

[URI: hmailroute.net]

[URI: rmailroute.net]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.222.194 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.222.194 listed in wl.mailspike.net]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.5 IMPRONONCABLE_2 Too much mixed numbers and lower-case letters

Subject: {SPAM?} Parker Roller Party

Web/SEo/App spam from Microsoft Outlook PArt 2





--_000_PUZPR01MB54262AE186CE08F1B212C678A6EB2PUZPR01MB5426apcp_

Content-Type: text/plain; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable



Hi,



still awaiting your reply.

Thanks.



From: lyra rao

Sent: , june 25, 2026 1:39 PM

Subject: Re- SEO plan



Hello!



Your website looks great, but it=92s not Rank well on Google.



Can I send you a free_ analysis report and price_ list?



Looking forward to your reply!



Thank you!



Lyra





--_000_PUZPR01MB54262AE186CE08F1B212C678A6EB2PUZPR01MB5426apcp_

Content-Type: text/html; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable








252">








font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helve=

tica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">

Hi,



font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helve=

tica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">

 



family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica,=

sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">

still awaiting your reply.



family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica,=

sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">

Thanks.



-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica=

, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">

 



-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica=

, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">

From: lyra rao



-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica=

, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">

Sent: , june 25, 2026 1:39 PM



-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica=

, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">

Subject: Re- SEO plan



-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica=

, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">

 



font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helve=

tica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">

Hello!



font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helve=

tica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">

 



font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helve=

tica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">

Your website looks great, but it=92s not Rank well on Google.



font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helve=

tica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">

 



font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helve=

tica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">

Can I send you a free_ analysis report and price_ list?



font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helve=

tica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">

 



font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helve=

tica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">

Looking forward to your reply!



font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helve=

tica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">

 



font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helve=

tica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">

Thank you!



font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helve=

tica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">

 



font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helve=

tica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">

Lyra



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">












--_000_PUZPR01MB54262AE186CE08F1B212C678A6EB2PUZPR01MB5426apcp_--

Web/SEo/App spam from Microsoft Outlook PArt 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 26 Jun 2026 06:41:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wd5rF-00000000D5R-3d6z

for dave@doctor.nl2k.ab.ca;

Fri, 26 Jun 2026 06:40:33 -0600

Resent-From: The Doctor

Resent-Date: Fri, 26 Jun 2026 06:40:33 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-koreacentralazolkn19013084.outbound.protection.outlook.com ([52.103.74.84]:31803 helo=SEYPR02CU001.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wd32i-000000009iE-1pxd

for sales@nk.ca;

Fri, 26 Jun 2026 03:40:23 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=mIj1TNtt1Fji1XousbMn+HMbeZs4sggAqVLZHhm04FJ/iiRYQ/tSO4ldK2oV5gEZm5HdjtIbs5pXHKrK89lifdWPasNR8HZFvBXiKDK1HZFV5drFsLeCqeNFqr6/rXAnrl5AypSCVlx2YYBbzqKztvzCaH1TMdiE+bNMRlLyyegywi+qShXtgySXekZcIZm9jkm0q0msZEv69ZavrxHXKWeDEHSQaqsXPPa2eRjRkXWYmJTPygB45XkH7yOKfuJzNmQ0Ygo51/UVrKRvDXK1pVkCfT1rrnMedmBiEvPiKUq0L7i+UJP5QgZZsMX+usBiu4Wi4YhTAvIGAgkhcU7aqQ==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=Dql6GjmHRcqSOzqGOleROoX+zbnkwZnyQtasiwoEtAY=;

b=DSq7Mqz7XSyrAhWUrNY88MGVRPd1y3s/joiK9pMsgBljuwKmfcDVKmsLYiGPk6Z0SDzXpmWHnqY9K2GVDocMHgdHEf5BStc47Onwx15f1YfW8aGg1utB4I4zCbEOIeGrrkgOH/XZ8vTDzQ6HXs283YAOjSabkXPUQsqHI7SDPEPlRP4WzOKW3aIp6M+isXEB/NqEC4G0pb59SfTuezrYuMB2ExgPc8PMEe8SxgLuRYq00OsaE0U6SLmynt0bq9Jmsbo52o2cWu62kP5SiPxgxnuZHVUSPlf+zsLHmd9g5bZ4XPPbAdddHuKb9r9wtI3BGwzJWJ1Z52E45HEItr7SMw==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=Dql6GjmHRcqSOzqGOleROoX+zbnkwZnyQtasiwoEtAY=;

b=c2o1itc8H2msAsulNkDGPOBbZSgwHLItYWmV/fdi0q2dUIMyHMO7UpMYfnykBJ4DI7IuS9aA0urv9NLsAuy5jzBzcs5mHvyZO9Z8eZ706/iDpzX1FhklWLtrIQE/54rXqPOS5trL6Dm8h8G7lmvtvXdpT7ztWQOJpg6IOv3gULmwpWeKqx5OEGJNDo3adt2hDb4LXZ7dxhSqg/x5g2U7AL5xFZwf34zHm+09Hf0I6r/MrCXBBje5D4xxBCJwd1U5miuI/aotHuN5Ax+0HftfvR6FAQLaySBJLMcums+cG4jrBEpM7GWMl+v1GnIKrtaQZqsuQD03EzuAhxP1wNQwDA==

Received: from PUZPR01MB5426.apcprd01.prod.exchangelabs.com

(2603:1096:301:101::6) by PUZPR01MB4833.apcprd01.prod.exchangelabs.com

(2603:1096:301:fe::12) with Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.159.17; Fri, 26 Jun

2026 09:38:59 +0000

Received: from PUZPR01MB5426.apcprd01.prod.exchangelabs.com

([fe80::5340:e52:5ed0:2597]) by PUZPR01MB5426.apcprd01.prod.exchangelabs.com

([fe80::5340:e52:5ed0:2597%5]) with mapi id 15.21.0159.016; Fri, 26 Jun 2026

09:38:59 +0000

From: lyra rao

To: lyra rao

Subject: Re: Reminder

Thread-Topic: Reminder

Thread-Index:

AQHdAL3c41+yov9EK0apIzcHCG/RerZHernbgAGcBLyAAAB8c4ABPDPMgAAAg3SAAX7fkIAAAH+cgAGqmUOAAABrY4ABkTGUgAAAe8aAAY0j4IAAAJO8

Date: Fri, 26 Jun 2026 09:38:59 +0000

Message-ID:



References:



























In-Reply-To:



Accept-Language: en-GB, en-US

Content-Language: en-GB

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

msip_labels:

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: PUZPR01MB5426:EE_|PUZPR01MB4833:EE_

x-ms-office365-filtering-correlation-id: f0668842-a874-4e59-2bcf-08ded366bfe2

x-microsoft-antispam:

BCL:0;ARA:14566002|19110799012|8060799015|8062599012|37011999003|24121999003|39105399006|37102599003|31061999003|22091999003|2604031031799003|16051099003|55001999006|15001099006|15030799006|15080799012|2604032031799003|704163111799003|25010399006|4140399003|40105399003|51015399003|26121999007|18071099003|12091999003|102099032|440099028|3412199025|26104999009|1710799026;

x-microsoft-antispam-message-info:

=?Windows-1252?Q?vHsTTbhKDkoZoZKEM3mTcgeJVcsNP9V2+aeJe0eSRLT6Jf/cy/QknZz3?=

=?Windows-1252?Q?393g9i3uGkVstTk2pSzqF6J/x+kaqmOQJXmj7WgMvWNxItikLSLXZe+1?=

=?Windows-1252?Q?v6FLnpwcqgyclDmRZnBUOpr386J8u/2VODEmam3xK5GTudp3lHMQi6l6?=

=?Windows-1252?Q?m5c8/6wQ6uox/Er3/PUlktWxY9IJ8HUPR61Gect/BMeLcvtoAT24ek62?=

=?Windows-1252?Q?BcAWdebUq6tM/PWR7olmUryZvVmWGWt6n6SPLC4C4aaF20p4IiaiGWJd?=

=?Windows-1252?Q?ApiFMdZXnZwn97RGSzbkPbDDhgaci8qpsCre8JOaIYIdax7OUur3j1AM?=

=?Windows-1252?Q?bfl474F7A2uHm0aBleAyNur1CXy6NHeSBo2iDorVlORGu0L20DUgdmF4?=

=?Windows-1252?Q?UTstIWzCcAXFWjgdNURcJ/oPO0qt//NqxQraHxa0d1vs0NBg7M/i+XAO?=

=?Windows-1252?Q?pI2WomDWSbeM9QVP6MWWKZNBd01UD2WaFZxAvOKw/q/gfIdLEwAjxpVn?=

=?Windows-1252?Q?A3a0/tTSm31MaxJd/qX4XjF9tBrl57YfgbdRuh4hwj89G1mG02LjoemP?=

=?Windows-1252?Q?G7pfRgWvzaOvy+3SED+BYuUJW6Ia4j10N1bl6rBdJcC+5EGl++wrwu1x?=

=?Windows-1252?Q?nIfzv7S7dIgFbGUZ/haUm8uj0UH9xEY6o5UWsbZLjIPjVZ1KJwdSHecu?=

=?Windows-1252?Q?VUO97HozUsP2VxuneV8G3/wkWZ1Mlc3ofPbR453eGp86njpIa8NZLtUk?=

=?Windows-1252?Q?74GsSFnHZRsjtRZmo6yrIBlsjSUzI5LAIxuUCjr4YZa1/gveutc9E/vQ?=

=?Windows-1252?Q?CsF1hgtG4ZqKsxZL/Nzbkz4K5MIrnlg8PJ8KPy+QyWolEXSff6tLCC9Y?=

=?Windows-1252?Q?LoU1d12LHGKQ2ioBKPocddaF5tn/Uorv1CYx/W2I/AtnyeepN1XCixlr?=

=?Windows-1252?Q?YqwrWzdzSs9w66EAMvyBFkOs5/uT0A+36jOtW2mfvP0zCt4RQgjyW105?=

=?Windows-1252?Q?CT0zl67XORgOYSe49h1VBrdTIY7R55c5Eg0T4DCwtANs/XsVgkr7Xto5?=

=?Windows-1252?Q?WDd1D2CIXeM3lvhmNJXX5yuejD+o52LHXvuyJ1jjsrSWppYHldC3o9cL?=

=?Windows-1252?Q?fb/ffzD2NVon669LtE1FUeaMhjUbRgyVgdpzaQzOM687so99ZpBuZxIy?=

=?Windows-1252?Q?KaXqr7BA5+Ya4mzbGwrQ1sZJ2SDGu79uLL18bxOJVpHHnOtVyEsrLSSR?=

=?Windows-1252?Q?8VGtwWuSbQAm5QldLKVfZK8aYhHxVYqeaopGShlW5Jz86Xl3CtZE1iOx?=

=?Windows-1252?Q?OgX8oWmceyYujXmWqv1Um8rw89nQzvx/AMe1rME2Hy4MLOD8bhNvlCZn?=

=?Windows-1252?Q?C6GXrIGwJVmMstlug0miI08mf7AghTfAQmcgxVYO3uopV2oeD5NPvyzj?=

=?Windows-1252?Q?cHxoJC1tdH7x9iK1Dtes67DwHd8j7Aocqvp3hnWjL9HiSiDOI62E8pTE?=

=?Windows-1252?Q?UK3nhTKfLAIPeKYOVGglKM4JLTPwXNjf3S36c08JbL2FVInIWex3yo//?=

=?Windows-1252?Q?9yGQ6cjtNM15lqNx?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?Windows-1252?Q?nYXVkMq+lAD7X2wCnitUc8liuvOeZOGno2ucSf8z0IDY8w5GWIJmGCI8?=

=?Windows-1252?Q?dGe3iU7zg+dfswee3CA1N2g2GFIplvlN9SkqdoGSd0xPtNx1DQU8Enfx?=

=?Windows-1252?Q?teTUUEXRSrrs9H8CFcUEHHtW6YOhMGdtRge6Xy9Mb+gSNyLwf07Q96D9?=

=?Windows-1252?Q?dXsyC17HO1nF4y64DES5VeLD2A7JlgYyfweErM7dU489W9YvmoQwuABW?=

=?Windows-1252?Q?J9tSd1eadCJebOyOvrwlvIQuOhbJSEw1wp/ciYLWUlWrCNozJK3gnGHW?=

=?Windows-1252?Q?Vbkk0t+QuPjIyG3Yehc5aEXpTcIhBdwFHBaaYT6O2U7BZQk7UuGdw71d?=

=?Windows-1252?Q?0urJYURmou2/V/430ZhC44HMVNge5ypMjShWZfCQJD0WnQYe4/cfWq9/?=

=?Windows-1252?Q?zde5Zdhn1Zl374zX0DAoNw04vx/wBnJXz2jsc3EPs/tYYU62n25l+we/?=

=?Windows-1252?Q?psJGYOrgFupERSO5yIlTdSqDuxQHoSaXiHduWVjagPyQm8gjIvt3hKwQ?=

=?Windows-1252?Q?vD9gBYTpKJe/iFoPlXz4UvgK6bWFaGx553dVWpJRUiEdCqyuIZKvxWpg?=

=?Windows-1252?Q?TgXUbNn7wqSknB7qMPt3+vzc8p9Fe3+2o7BegjJQt0kO3uGjjp953yHO?=

=?Windows-1252?Q?Ob5NYtyfinJ49NgPZjTLj8HBVNeroX8aFjcrW5LZ/o/wGwilJilctyLQ?=

=?Windows-1252?Q?YCqIx4m7mGlwwL2wuUCWXjMtcJ+L+MW4NG++i+L+Ljwfis0iPcMFKooe?=

=?Windows-1252?Q?0R4p2YkchJ/M9farAqUPnH0vGAtyYUOoF1XQKbzYkVLRov7i5zlRh1um?=

=?Windows-1252?Q?hWEvCk73k31bHfPaXBaM7uuEZEbOdMG6Bhmt/TX9D9T1tr9VJvnHjDSf?=

=?Windows-1252?Q?HNBo+rUkpozKm78ORW+SuMbhBP+qNcilgMpXOx/sXWH3VFYDr6jGVa3K?=

=?Windows-1252?Q?TB0gSuJUr9DFq2Da2aguA77Ypw7eJPJEgWdNvs8H/2sgwnf/mx5TpaJJ?=

=?Windows-1252?Q?fXySxwn5JeG13wTN90RJMaV4KkAT4+REEZR8O8kPlVAvy/896OgjTjdV?=

=?Windows-1252?Q?GeXNtE1En+CWCUT0PMy0lC6Abrifpgbai+u25wtRBdQE2KkaPYJ+scV1?=

=?Windows-1252?Q?QYoqzdaKKkGMp/6lGFwvK6tm7XyRD0995DDhLioG7Xin/7f4nkxpver+?=

=?Windows-1252?Q?0usyoBJ/E0iEwcAwIj3X1HD+NMSIdJTlNjfmh52O8TdrwQea37ir2ywG?=

=?Windows-1252?Q?Ka7+uLi8SnLfbSC1F5UJpm24pJaYSbt9PwnKOajVQsnbRpFrn6UmrvTH?=

=?Windows-1252?Q?llmWRQMUw9kaIPvNugmRTxs1z2X79KQDPLCDDCRizIdNErnZpGbL2JwU?=

=?Windows-1252?Q?Kwli2Hjmatu9URd+gGtv8jlXI+vBhHPwI8eJVs1Q7yaOQITWErcriTm2?=

=?Windows-1252?Q?iQjf5O1WCrNJcv08fcPtebf1Rq0Er9sTyizH0Bq17ys1mvCzVMgan7mT?=

=?Windows-1252?Q?DBjHPCgd?=

Content-Type: multipart/alternative;

boundary="_000_PUZPR01MB54262AE186CE08F1B212C678A6EB2PUZPR01MB5426apcp_"

MIME-Version: 1.0

X-OriginatorOrg: outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: PUZPR01MB5426.apcprd01.prod.exchangelabs.com

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: f0668842-a874-4e59-2bcf-08ded366bfe2

X-MS-Exchange-CrossTenant-originalarrivaltime: 26 Jun 2026 09:38:59.2558

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: PUZPR01MB4833

Chinese Products spam PArt 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dve@doctor.nl2k.ab.ca

Delivery-date: Fri, 26 Jun 2026 06:41:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wd5r2-00000000CQJ-1MUG

for dve@doctor.nl2k.ab.ca;

Fri, 26 Jun 2026 06:40:20 -0600

Resent-From: The Doctor

Resent-Date: Fri, 26 Jun 2026 06:40:20 -0600

Resent-Message-ID:

Resent-To: dve@doctor.nl2k.ab.ca

Received: from [156.224.82.244] (port=35762 helo=mail-m82244.xmail.ntesmail.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wd2Ke-000000007AM-1eiX

for sales@nk.ca;

Fri, 26 Jun 2026 02:54:59 -0600

Content-Type: multipart/alternative; BOUNDARY="=_Part_575140_916626598.1782464017687"

To: sales

Subject: =?UTF-8?B?UmU6UmU65Yqg5ou/5aSnRk9CL0REUC9MRFAg77yM5LiA566x5Lmf6IO95Y+R?=

X-Priority: 3

MIME-Version: 1.0

Received: from julin@yunsongtrans.com( [10.139.4.160] ) by ajax-webmail ( [127.0.0.1] ) ; Fri, 26 Jun 2026 16:53:37 +0800 (GMT+08:00)

From: Julin

Date: Fri, 26 Jun 2026 16:53:37 +0800 (GMT+08:00)

X-WM-Tid: 0a9f032274b1069ckunm7b4bdfcbb7cb2

DKIM-Signature: a=rsa-sha256;

b=Y/+XSWLW7bS4zd8O3+JAp9Enfu1kA8l/27FsB00rhJtsxaiCsKdVa0XUMfKjpDbKRXaJ9PE3pm3pt1YY9mVw257SP3wdRjO5hKJWqn/OG6MdlMNEZmlxSyKydrDOnqU8cSwohSg2tjNMGMqeTQagjKCBjvg3m8GOS1CKyPMoYXWUpbZmYCvTKTHxDy65M2BARjFQEKQ+60wFed6WfYXen7guq6nfSqKQ3Y1aeyfsfq+HFnH6kZgr3+Umxdtox1TsNQo2QgiES68/yyJghPIK+pLSL0/9NXRIGKTsf+J2m9JwVDiXWxjReh8Mit4cdMWsD0ZOQfydBN384rGqR7sfVw==; c=relaxed/relaxed; s=default; d=yunsongtrans.com; v=1;

bh=UODPuQmLsDStYmUmyjeJDZfudBxlP+UjIY61BGOb340=;

h=date:mime-version:subject:message-id:from;

Message-ID:

X-Spam_score: 15.7

X-Spam_score_int: 157

X-Spam_bar: +++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi sales, I hope everything is going well for you. We value

your interest and look forward to connecting with you. Welcome aboard, and

thank you again for subscribing! Please let us know your required quantities

and any specific needs.We will provide the best possible discounts. Your

swift feedback will ensure we meet your needs effectively.



Content analysis details: (15.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[156.224.82.244 listed in will-spam-for-food.eu.org]

[156.224.82.244 listed in will-spam-for-food.eu.org]

[156.224.82.244 listed in will-spam-for-food.eu.org]

[156.224.82.244 listed in will-spam-for-food.eu.org]

[156.224.82.244 listed in will-spam-for-food.eu.org]

[156.224.82.244 listed in will-spam-for-food.eu.org]

[156.224.82.244 listed in will-spam-for-food.eu.org]

[156.224.82.244 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[156.224.82.244 listed in dnsbl.ahbl.org]

[156.224.82.244 listed in dnsbl.ahbl.org]

[156.224.82.244 listed in dnsbl.ahbl.org]

[156.224.82.244 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[156.224.82.244 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[156.224.82.244 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[156.224.82.244 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[156.224.82.244 listed in dnsbl.ahbl.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: yunsongtrans.com]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[156.224.82.244 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[156.224.82.244 listed in wl.mailspike.net]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[156.224.82.244 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

1.6 SUBJ_ALL_CAPS Subject is all capitals

0.6 J_CHICKENPOX_52 BODY: 5alpha-pock-2alpha

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

1.0 VOWEL_URI_5 URI hostname with 5 consecutive vowels

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.6 HTML_TEXT_INVISIBLE_STYLE HTML hidden text + other spam signs

2.0 MIXED_HREF_CASE Has href in mixed case

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

3.0 LONG_INVISIBLE_TEXT Long block of hidden text - bayes poison?

Subject: {SPAM?} =?UTF-8?B?UmU6UmU65Yqg5ou/5aSnRk9CL0REUC9MRFAg77yM5LiA566x5Lmf6IO95Y+R?=























Chinese Products spam Part 2

Hi sales,

I hope everything is going well for you.

We value your interest and look forward to connecting with you. Welcome aboard, and thank you again for subscribing!

Please let us know your required quantities and any specific needs.We will provide the best possible discounts.

Your swift feedback will ensure we meet your needs effectively.

Thank you for giving this your attention. I look forward to your response soon.

Best regards,







Reserve your spot for ongoing updates: select . Retain My Notifications



Not in the mood for more info? Hit Limit My Communications.





Miss Julin

With 13 years of dedicated focus on US-Canada dedicated shipping lines,we save your time, effort and money with DDP PRICE.

Shenzhen Ethan Freight Forwarding Co., Ltd.

Room 2806, 28th Floor, Building 1, Evergrande Metropolis Plaza, Bantian Street, Longgang District, Shenzhen City, Guangdong, China

T.0755-84826401/ M.13798412845/E.julin@ethanfreight.com

www.ethantrans.com













在2026-06-24,Julin 写道:



-----原始邮件-----

发件人: Julin

发件时间: 2026年06月24日 周三

收件人: [sales ]

主题: Re:加拿大FOB/DDP/LDP ,一箱也能发



Hi sales,

I hope everything is going well for you.

Your interest in our updates means a lot to us. We look forward to keeping you informed with our latest news and offers.

We are interested in learning more about your purchasing needs and the types of products you are seeking. Please let us know, and we can provide you with our comprehensive product catalog..

Your swift feedback will ensure we meet your needs effectively.

Thank you for taking the time to review this. I look forward to your prompt reply.

Best regards,







Do not miss a product highlight: hit . Stay Engaged



Whenever you’d like fewer emails, use Edit Email Choices.





Miss Julin

With 13 years of dedicated focus on US-Canada dedicated shipping lines,we save your time, effort and money with DDP PRICE.

Shenzhen Ethan Freight Forwarding Co., Ltd.

Room 2806, 28th Floor, Building 1, Evergrande Metropolis Plaza, Bantian Street, Longgang District, Shenzhen City, Guangdong, China

T.0755-84826401/ M.13798412845/E.julin@ethanfreight.com

www.ethantrans.com













在2026-06-13,Julin 写道:



-----原始邮件-----

发件人: Julin

发件时间: 2026年06月13日 周六

收件人: [sales ]

主题: 加拿大FOB/DDP/LDP ,一箱也能发



Hi 亲们



我是深圳市云松跨境物流有限公司的Julin,



我们专注于美加欧澳墨西哥国际物流13年,能做CIF,FOB ,DDU,DDP,LDP等条款.

下面是不同的重量发加拿大的价格,一箱也能发,几百元就到加拿大,双清包税到门。

欢迎扫码加微信,随时详聊!DDU/DDP双清专线让您省心省力省钱。

祝您万事如意,生意兴隆,货如轮转,财源滚滚。





散货价格

起运港 目的港 价格(40HQ) 备注

深圳/广州/宁波/上海/义乌/青岛/天津/长沙/郑州/佛山/中山/泉州 温哥华 8.3 散货包含海运费,清关,关税,派送

埃德蒙顿 7.5

卡尔加里 7.5

多伦多 8.1

蒙特利尔 8.1

温尼泊 8.2







Maintain your product-savvy edge with . Stay Updated on News



If you prefer to exit, choose Review Communication Options.





Miss Julin



深耕美加专线13年



DDU/DDP双清专线,让您省心省力省钱



Shenzhen Yunsong Cross-border Logistics Co.,Ltd



Room 2806, 28th Floor, Building 1, Evergrande Metropolis Plaza, Bantian Street, Longgang District,



Shenzhen City, Guangdong, China



深圳市龙岗区坂田街道马安堂社区环城南路15号



恒大都会广场1栋2806



Phone : 13798412845



Email: julin@yunsongfreight.com