Intelcom phish

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 14 May 2026 18:02:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wNfzL-00000000L7J-3Pml

for dave@doctor.nl2k.ab.ca;

Thu, 14 May 2026 18:01:11 -0600

Resent-From: The Doctor

Resent-Date: Thu, 14 May 2026 18:01:11 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from v71123.phpnet.fr ([46.255.164.209]:33570 helo=v71123.webmo.fr)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wNd7r-0000000086W-07Qj

for root@nk.ca;

Thu, 14 May 2026 14:57:54 -0600

Received: by v71123.webmo.fr (Postfix, from userid 10000)

id 9667D1FAB21; Thu, 14 May 2026 20:11:43 +0000 (UTC)

To: root@nk.ca

Subject: Customs fees must be paid (delivery delay).

Date: Thu, 14 May 2026 20:11:43 +0000

From: Intelcom

Message-ID:

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="b1_bda9bb99a54e75819f95cc840169ee86"

Content-Transfer-Encoding: 8bit



This is a multi-part message in MIME format.



--b1_bda9bb99a54e75819f95cc840169ee86

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit



























Goods imported into Canada may be subject to applicable duties and/or taxes. Couriers are authorized by the CBSA (Canada Border Services Agency) to account for casual shipments in lieu of the importer or owner and may remit any applicable duties and/or taxes to the CBSA.







In the meanwhile, a parcel belonging to you has been seized by customs for failure to declare its contents by the sender and we ask you to pay the amount of 2.96 CAD in duties and taxes to by contacting us as soon as possible using the button below:









Plan my delivery



Thanks for choosing Intelcom.









This email was sent from an automated system. Please do not reply.



© 2026 Intelcom Express - Dragonfly Express. All rights reserved.









--b1_bda9bb99a54e75819f95cc840169ee86

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: 8bit













Intelcom















Goods imported into Canada may be subject to applicable duties and/or taxes. Couriers are authorized by the CBSA (Canada Border Services Agency) to account for casual shipments in lieu of the importer or owner and may remit any applicable duties and/or taxes to the CBSA.









In the meanwhile, a parcel belonging to you has been seized by customs for failure to declare its contents by the sender and we ask you to pay the amount of 2.96 CAD in duties and taxes to by contacting us as soon as possible using the button below:











Plan my delivery





Thanks for choosing Intelcom.





















--b1_bda9bb99a54e75819f95cc840169ee86--



Intelcom phish

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 14 May 2026 18:02:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wNfzG-00000000L6X-120J

for dave@doctor.nl2k.ab.ca;

Thu, 14 May 2026 18:01:06 -0600

Resent-From: The Doctor

Resent-Date: Thu, 14 May 2026 18:01:06 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from v71123.phpnet.fr ([46.255.164.209]:48312 helo=v71123.webmo.fr)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wNcvu-000000007JL-40hl

for sales@netknow.ca;

Thu, 14 May 2026 14:45:34 -0600

Received: by v71123.webmo.fr (Postfix, from userid 10000)

id 5ADF51FA933; Thu, 14 May 2026 20:11:43 +0000 (UTC)

To: sales@netknow.ca

Subject: Customs fees must be paid (delivery delay).

Date: Thu, 14 May 2026 20:11:42 +0000

From: Intelcom

Message-ID: <79459da19152e2d883bfcbe5c80e4e10@accord-cadre-hp.qualitycorporate.com>

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="b1_79459da19152e2d883bfcbe5c80e4e10"

Content-Transfer-Encoding: 8bit



This is a multi-part message in MIME format.



--b1_79459da19152e2d883bfcbe5c80e4e10

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit



























Goods imported into Canada may be subject to applicable duties and/or taxes. Couriers are authorized by the CBSA (Canada Border Services Agency) to account for casual shipments in lieu of the importer or owner and may remit any applicable duties and/or taxes to the CBSA.







In the meanwhile, a parcel belonging to you has been seized by customs for failure to declare its contents by the sender and we ask you to pay the amount of 2.96 CAD in duties and taxes to by contacting us as soon as possible using the button below:









Plan my delivery



Thanks for choosing Intelcom.









This email was sent from an automated system. Please do not reply.



© 2026 Intelcom Express - Dragonfly Express. All rights reserved.









--b1_79459da19152e2d883bfcbe5c80e4e10

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: 8bit













Intelcom















Goods imported into Canada may be subject to applicable duties and/or taxes. Couriers are authorized by the CBSA (Canada Border Services Agency) to account for casual shipments in lieu of the importer or owner and may remit any applicable duties and/or taxes to the CBSA.









In the meanwhile, a parcel belonging to you has been seized by customs for failure to declare its contents by the sender and we ask you to pay the amount of 2.96 CAD in duties and taxes to by contacting us as soon as possible using the button below:











Plan my delivery





Thanks for choosing Intelcom.





















--b1_79459da19152e2d883bfcbe5c80e4e10--



Web/SEO/App spam from Microsoft Outlook PArt 3


d-color: rgb(255, 255, 255); margin: 0px; font-family: Aptos, Aptos_Embedde=

dFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt=

;">

From: 
=3D"color: rgb(12, 100, 192);">Charles Huggies



d-color: rgb(255, 255, 255); margin: 0px; font-family: Aptos, Aptos_Embedde=

dFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt=

; color: rgb(0, 0, 0);">

Sent: Monday, January 05, 2026, 6:54 PM


Subject: Website New Look 2026





Hi,



d-color: rgb(255, 255, 255); margin: 0px; font-family: Aptos, Aptos_Embedde=

dFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt=

;">

=

Could I talk to you about the website


04, 204);">would you be interested in build or Re-build your websit=

e? or designing new website
,

background-color: rgb(204, 204, 204);"> with

additional feature that might benefit the overall usability and user exper=

ience which usually leads to better sales.



d-color: rgb(255, 255, 255); margin: 0px; font-family: Aptos, Aptos_Embedde=

dFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt=

; color: rgb(200, 38, 19);">

1. Enhance your we=

bsite=92s look.



d-color: rgb(255, 255, 255); margin: 0px; font-family: Aptos, Aptos_Embedde=

dFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt=

; color: rgb(200, 38, 19);">

2. Improve site sp=

eed.



d-color: rgb(255, 255, 255); margin: 0px; font-family: Aptos, Aptos_Embedde=

dFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt=

; color: rgb(200, 38, 19);">

3. Boost conversio=

n rates!



d-color: rgb(255, 255, 255); margin: 0px; font-family: Aptos, Aptos_Embedde=

dFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt=

; color: rgb(200, 38, 19);">

Let us handle the =

redesign for you.



d-color: rgb(255, 255, 255); margin: 0px; font-family: Aptos, Aptos_Embedde=

dFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt=

; color: rgb(0, 0, 0);">

If you=92re interested, I can share our pricing portfolio and previous w=

ork.



d-color: rgb(255, 255, 255); margin: 0px; font-family: Aptos, Aptos_Embedde=

dFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt=

; color: rgb(0, 0, 0);">

Thanks & Regards,


Charles Huggies.










--_000_TY2PPFF4FD188E151C4DDAA19E01933BF33B2072TY2PPFF4FD188E1_--

Web/SEO/App spam from Microsoft Outlook PArt 2

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi We will send you our price list. Thanks & Regards,



Content analysis details: (5.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[52.103.66.59 listed in dnsbl.ahbl.org]

[52.103.66.59 listed in dnsbl.ahbl.org]

[52.103.66.59 listed in dnsbl.ahbl.org]

[52.103.66.59 listed in dnsbl.ahbl.org]

[2603:1096:408:0:0:0:0:3df listed in]

[dnsbl.ahbl.org]

[2603:1096:408:0:0:0:0:3df listed in]

[dnsbl.ahbl.org]

[2603:1096:408:0:0:0:0:3df listed in]

[dnsbl.ahbl.org]

[2603:1096:408:0:0:0:0:3df listed in]

[dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[52.103.66.59 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[52.103.66.59 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[52.103.66.59 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[52.103.66.59 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[2603:1096:408:0:0:0:0:3df listed in]

[will-spam-for-food.eu.org]

[2603:1096:408:0:0:0:0:3df listed in]

[will-spam-for-food.eu.org]

[2603:1096:408:0:0:0:0:3df listed in]

[will-spam-for-food.eu.org]

[2603:1096:408:0:0:0:0:3df listed in]

[will-spam-for-food.eu.org]

[2603:1096:408:0:0:0:0:3df listed in]

[will-spam-for-food.eu.org]

[2603:1096:408:0:0:0:0:3df listed in]

[will-spam-for-food.eu.org]

[2603:1096:408:0:0:0:0:3df listed in]

[will-spam-for-food.eu.org]

[2603:1096:408:0:0:0:0:3df listed in]

[will-spam-for-food.eu.org]

[52.103.66.59 listed in will-spam-for-food.eu.org]

[52.103.66.59 listed in will-spam-for-food.eu.org]

[52.103.66.59 listed in will-spam-for-food.eu.org]

[52.103.66.59 listed in will-spam-for-food.eu.org]

[52.103.66.59 listed in will-spam-for-food.eu.org]

[52.103.66.59 listed in will-spam-for-food.eu.org]

[52.103.66.59 listed in will-spam-for-food.eu.org]

[52.103.66.59 listed in will-spam-for-food.eu.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.6 HK_RANDOM_ENVFROM Envelope sender username looks random

1.0 HK_RANDOM_FROM From username looks random

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[cxbxfs57cxc(at)outlook.com]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[52.103.66.59 listed in list.dnswl.org]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[52.103.66.59 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[52.103.66.59 listed in wl.mailspike.net]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.5 VOWEL_FROM_6 Impronouncable from header (6 consecutive vowels)

1.5 VOWEL_TOCC_6 To or Cc header with 6 consecutive vowels

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} Re: HTML



--_000_TY2PPFF4FD188E151C4DDAA19E01933BF33B2072TY2PPFF4FD188E1_

Content-Type: text/plain; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable



Hi



We will send you our price list.



Thanks & Regards,

-----Original Message-----

From: Charles Huggies

Sent: Monday, January 05, 2026, 6:54 PM

Subject: Website New Look 2026



Hi,

Could I talk to you about the website would you be interested in build or R=

e-build your website? or designing new website, with additional feature tha=

t might benefit the overall usability and user experience which usually lea=

ds to better sales.

1. Enhance your website=92s look.

2. Improve site speed.

3. Boost conversion rates!

Let us handle the redesign for you.

If you=92re interested, I can share our pricing portfolio and previous work=

.

Thanks & Regards,

Charles Huggies.



--_000_TY2PPFF4FD188E151C4DDAA19E01933BF33B2072TY2PPFF4FD188E1_

Content-Type: text/html; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable








252">








nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">

   Hi



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

 



eft: 1px solid rgb(204, 204, 204);">


d-color: rgb(255, 255, 255); margin: 0in 0in 12pt; font-family: Aptos, Apto=

s_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-s=

ize: 12pt;">

We will send you our price list=

.






Thanks & Regards, &nbs=

p;



d-color: rgb(255, 255, 255); margin: 0px; font-family: Aptos, Aptos_Embedde=

dFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt=

; color: rgb(0, 0, 0);">

-----Original Message-----

Web/SEO/App spam from Microsoft Outlook PArt 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 14 May 2026 18:01:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wNfz3-00000000L5C-2XJC

for dave@doctor.nl2k.ab.ca;

Thu, 14 May 2026 18:00:53 -0600

Resent-From: The Doctor

Resent-Date: Thu, 14 May 2026 18:00:53 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-japanwestazolkn19012059.outbound.protection.outlook.com ([52.103.66.59]:39435 helo=OS8PR02CU002.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wNc01-0000000030b-380E

for root@nk.ca;

Thu, 14 May 2026 13:45:48 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=N4ZsU/8IEP/lpoZwETPUmQV5dYbXuhpBXviT9TAMg3KpNBfS0iCtQd8Bkisj7N8+20zuOcUHeNIlNJfcpJDZTApky8WQMOK6Fuuy3s4Kkbk/AhqH27RJsDOGuSoTBHH8ei38blQ9PBPQTxWs2uJuYPEpiEjdM68OS5lr+k65Mf+KBGPYrsBSasfyR2prM+s82xqEsqzWaJnJxxoClK0asBg1z0Ma6VG+0gLjwo3QLaCwcqfeSCTwJ6H3cc/0G9gDIAwsosTbMyPuK2A41iBKl+toPW87EAxqnFLyfmuDoIC37aBFX5oCt5jutiN2WqSnunFFEFX7lZLtk+sRrzhLYQ==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=DQGm9+FkxlM4jIgAEMbT051coJFPu+jIQY0DXWZAgNg=;

b=dYAM+Z8pXm04ZjkdGqLalH5XOaOmGR89NW+reJ4godjNk9AWTElzTdzH6M2p9Iq79Wv0huC/1CHFAgh/DUCuOQScg4qzF0Hr8nds9vi2jXDREkOQNxXoYjhgZdwvANwDKWM0v/F0ukk0XpnUvvQJJobXWKs6kbso5mdDguujeffuDx2HDKsME3SrG84Q+OI/0ENOdOAHlYEv0+gdgOWsLOzWGorjZpVcbOz1i31pgO+xrB+GOUHYvn8lRw5U2KLzu4VIznG5zFgA5S92jeibYeEfsH3SMmqRbTx9h5f/tGfG9cmCUIZikDizKTxWbAdZWdm3aKaIanXxQjw3QSu6cw==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=DQGm9+FkxlM4jIgAEMbT051coJFPu+jIQY0DXWZAgNg=;

b=YaSfJ9njCb5BAXpEKthS824SPApqSo1HHqMvJ4gYzds8RIm74noioDkSWk1lFFetWaQbVQfbycKgmIXaCMAF4SYhAOpJgZHQVbEXccy8RLxEA3deEHfUVlmqZhLTgad4H/ma9Tqg+XofbokwHfbu0kK5rStWA/yEacPWrQwYjzIEGfHq2SmkoV+TvJoKX5SCDTm5Gm3JQY3cNLc90BHa/lWdqsc6H+JJxf5fRz1vl1N/hPMf6HxlFkZszgUBajfbxUXy1Hm3jZb2nDJtER+5Hy62dGY5vZIWrvuFOzta2lC3bAEGwymMHQXpRbMGegCmzN/znQS3bN8htSuPgTSi1w==

Received: from TY2PPFF4FD188E1.apcprd01.prod.exchangelabs.com

(2603:1096:408::3df) by SEZPR01MB4825.apcprd01.prod.exchangelabs.com

(2603:1096:101:a5::7) with Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.25.18; Thu, 14 May

2026 19:43:47 +0000

Received: from TY2PPFF4FD188E1.apcprd01.prod.exchangelabs.com

([fe80::7543:bdb1:507f:c918]) by

TY2PPFF4FD188E1.apcprd01.prod.exchangelabs.com

([fe80::7543:bdb1:507f:c918%3]) with mapi id 15.20.9913.009; Thu, 14 May 2026

19:43:47 +0000

From: Charles Huggies

To: Charles Huggies

Subject: Re: HTML

Thread-Topic: HTML

Thread-Index:

AQHc0Kaw0QFvwJeVWUeV9PjOT5LquLXqzgtBgAGYgAWAAYtAP4AABBvQgAG6A02AAAQeL4ADVozSgAE13j+ADLBeBYABpmfBgAniKM6AAZk0vA==

Date: Thu, 14 May 2026 19:43:46 +0000

Message-ID:



References:





























In-Reply-To:



Accept-Language: en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

msip_labels:

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: TY2PPFF4FD188E1:EE_|SEZPR01MB4825:EE_

x-ms-office365-filtering-correlation-id: 22e3acb3-bc74-4876-3ff1-08deb1f11cc0

x-microsoft-antispam:

BCL:0;ARA:14566002|55001999006|704163111799003|2604032031799003|16051099003|39105399006|37011999003|19101099003|24121999003|22091999003|48001999003|19110799012|15080799012|31061999003|15030799006|8062599012|8060799015|43065399003|31055399003|40105399003|26121999007|440099028|3412199025|18071099003|102099032|1710799026;

x-microsoft-antispam-message-info:

=?Windows-1252?Q?57Pq8Ha23Dt4ATdbhGWtL8N+x2dsSXYrEzs9mwRZ+lWBOkfeqU7M6JQH?=

=?Windows-1252?Q?peIY/hAq9ktFgKO214ylEHhwGw2tkLRtBYD53Q7XWg5TQElemN1BuLqv?=

=?Windows-1252?Q?gHMcabepm0V7iC67r9I3PlQFbX0MOX3pab/GaD0wTiu3Tt3awVB7Zv/T?=

=?Windows-1252?Q?FB4O9jtWYHvfUetBVuzMl11QnAJSVv9wwPWILm/onXgAGDyl638AoU2k?=

=?Windows-1252?Q?hlMr7Fw2o6bUrVo0nZHE2PxlZXgfIkdGeIR8DLcxexf52f9vu+x9tjHF?=

=?Windows-1252?Q?uD9Ati3Cr9/Qa/eBc4inIkagEk3W4xxu08hGuBGgDRzuSnFB/DYmTOh6?=

=?Windows-1252?Q?BUaE4eHHnvaFcwZqlpOAqTeuMO0PyUwVHy8L3wHanxHOm0nVKSMYl+/O?=

=?Windows-1252?Q?HC9APhdB1NKgYqI5ngfUUuBVW4IsZ1AwNSZL+hkh9xBo94k52+CpSLH9?=

=?Windows-1252?Q?ukG4OndHAZmY/WdKpj5Bz377oYHEsIH7c/X34vgmZZdXR+vDIFKT6Sgb?=

=?Windows-1252?Q?oDR72qFkWfIkhjXjwsPkagCbsOO9gjFUq9WeGVxkezO9FA+wc8S31zTX?=

=?Windows-1252?Q?5ism5BAYX7NLOf7RrZ/E1Zo2m7tWMwSSMhjxaEvuTZkYt02HCO3cIvpi?=

=?Windows-1252?Q?/vJirGL6ZsTm0QTfljoyCOCUnyMfMyJiUih4F6FpYEX0aHDqqTCwrrXR?=

=?Windows-1252?Q?7bUBvmzCCGnAv/SlSsELXDcYTzewDS/ymtbKw9J04nOkSP2YO0mRBRYg?=

=?Windows-1252?Q?4wVwY8D8gFNzVj5pxkKk4Fvtz2Cjdexav73zdhZ/l/25zQJX7gKWY8wP?=

=?Windows-1252?Q?kGD8ef0arxtePiiRIPN09ruCyfDWbghap6PywiPmEXofmT+o70Vyojn9?=

=?Windows-1252?Q?ZRuKI/zNMOBgoQHBSDuViOq+11FMZwGXGcNxSNWO/t/r8A0/eIgEbHRT?=

=?Windows-1252?Q?ix7kFXqhiFOH7MpbyvTDeA6epErBXlRrNfBTQp5fw3yhWzpBecnkueQY?=

=?Windows-1252?Q?XbJzWyTjLqOsTsJTt7kuoWIqBcL40cR3QKzDB3YELPBmbU3+ELBwE7k8?=

=?Windows-1252?Q?Blqcgwv4J1kacYaGyE6C4d0T4nvxDlxZ7il1hX30p+egrNWYLRde8N5P?=

=?Windows-1252?Q?Wl9i/j8NsLEc7jKergua85rFPxZKV6zVbDzHVIRGRFCglHcTbAnF4NKo?=

=?Windows-1252?Q?mg3cClBYe8Z2joC7xkmw9W//M1YiMaU9J0lp23n7TmewX6/n1511wLm6?=

=?Windows-1252?Q?jNoq2/tPU8WbTQh20KrdlgrEYyduLhTdtQRgOhOI/DNDboqUguf5EWyE?=

=?Windows-1252?Q?22PEJIfiV7CvNTMAW15WF3yW0FRjuHHksEPXAsZBlwdxx3kKW4eJJ2gT?=

=?Windows-1252?Q?giptz2hNnRIMlJudjQhLWZhdCaKiw74kVbh+Z2YXhyYZOcFGFVTzTjMs?=

=?Windows-1252?Q?NHD0vJagty/L3zTjJY8Zvu8mEIz2UbOcnG9ZCDYAZJTXpL6Yuh2yg1PC?=

=?Windows-1252?Q?a1uoqLetyNKaF1BRzJQPF7pKHmpeRg=3D=3D?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?Windows-1252?Q?i38oBIuN/NUnYyHaQTokE4VDnqhgcOc6Cc2il4uIBJydQhWZH8iTARve?=

=?Windows-1252?Q?H+mpR8jMGEyVPRxjZ0wHsV0B5TD3bD4NdX0E/8zo/sqkJB80qxnoIt/t?=

=?Windows-1252?Q?6PQ5Bnt8HWY/29CrGUEpthRuaEhcAb1i+Ni+oV76jUR3WVPCo0l2ndjH?=

=?Windows-1252?Q?wqCweGwpXjjTzhITcg2GAHc3GMzo1l4KKvbZi7P9YUCRggY3BrpVgFRW?=

=?Windows-1252?Q?aBeA33Kca5NRbwKWETpBWJPqBLQfTG00eej/y6fEly9uSa15Z3PTgA5Q?=

=?Windows-1252?Q?M5auQ/BMe5ae847ELgeY1rLDCfNXJo5Jbr8slP2nBEs0aUcKDTRt1v8g?=

=?Windows-1252?Q?3amAr+lzk2pFOcjETSHbHf76smpLTjR1PGi61V1paxJUuRFcAPYrobpq?=

=?Windows-1252?Q?rHbGpM1TkyqbPfY7gFrtMce7wzISdc/cdzeVDHdzeznBlyTLVmW2f4rv?=

=?Windows-1252?Q?6wrDuQepwG3VR7fuEtEcR9gDCotRWCUpQzhX7sd4WddNHKSRWjT73VvR?=

=?Windows-1252?Q?IMdWe7x5HAJHJ1rONZNqgy+jbUTqyqpMrJXkexvQZF+jB2LvSNq1gagv?=

=?Windows-1252?Q?fGHQcCUASe9Xz+VG+AwRKMNP3UvJepx8wGfvDjAKku/HOzuOM0RpWYtz?=

=?Windows-1252?Q?2HufWfyENymNIGSZoAzTlQd5RhQZ589nQXr6OElxSrXGesmfwikV5JPN?=

=?Windows-1252?Q?uJumrKxeKySsbF4QB9xSlF2FTkXO/tknRZppsn6p0OTeEpuIptAdRzku?=

=?Windows-1252?Q?16qOk0ob+XMLOMuTz3Ba5gHosyjBLxBCTPI+7+6fLRqc457ub67XcHnV?=

=?Windows-1252?Q?DQ5B9epAfuexh8ESmGVOjrw2jfui8JJBwAdzZyNE2zeP3g7J65Y++QNt?=

=?Windows-1252?Q?Mna2v57U4GgmJYJw0tltako52F0eM9/PH6i0sQ/KnsQC5y8/mryfad24?=

=?Windows-1252?Q?8DY59LyWd9nJs8VDFv0hoysydE/terNe+58cgiL25G2lEREJrqMtH52R?=

=?Windows-1252?Q?4E0MfNx/be/aonhyY3x2kgyLuOqlr+5XCpwGOFIaBJXPpFzikVqXdhPo?=

=?Windows-1252?Q?pFvrfBkJKr6PRCqHFESDHG7XKaJD76QX1QnAGWm6ukoK6PxQ+B0xuDH1?=

=?Windows-1252?Q?bgWFhD7XmyU96qTmZMXatQFl7dm7mW2uaZ2j9N18gxqSNGsIbnEfAOe6?=

=?Windows-1252?Q?JX67xq7g/D1fNOQeu1zOdiRu+SXAvE6rLhyXwlDVBt0ByV4VH5XBlZM8?=

=?Windows-1252?Q?cG8ebt6+KnaS0K/RXXbXGBWW602IwrCSu3yk0Fa+DUMhOSUjWlYWJvFx?=

=?Windows-1252?Q?vlmW7KOLp6GzaoZt6BqWajukKxt0M58DpyX2XN3AHu5NmTchakjp8/vl?=

=?Windows-1252?Q?/DFzcs7jVD9BvNvbLPHUz1eLR7vgI6e7AS4m3mdF5sNgxGTyuyjQ31gi?=

=?Windows-1252?Q?cpuNW/JLh70WX0XtvcqInEV38tfLBEQ2qHUUfHiyRdMsnCqs3taV8Xz6?=

=?Windows-1252?Q?wOrjA2BT/PuaUFXo04ULgb335LkmG9M6NTfhsDKiiHlRaVFjMc2fzMj8?=

=?Windows-1252?Q?XxzAHOuxUcYFbM3m?=

Content-Type: multipart/alternative;

boundary="_000_TY2PPFF4FD188E151C4DDAA19E01933BF33B2072TY2PPFF4FD188E1_"

MIME-Version: 1.0

X-OriginatorOrg: outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: TY2PPFF4FD188E1.apcprd01.prod.exchangelabs.com

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: 22e3acb3-bc74-4876-3ff1-08deb1f11cc0

X-MS-Exchange-CrossTenant-originalarrivaltime: 14 May 2026 19:43:46.0615

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: SEZPR01MB4825

X-Spam_score: 5.7

X-Spam_score_int: 57

X-Spam_bar: +++++

costco rewards phish from Microsoft Outlook Part 2

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[45.248.37.74 listed in will-spam-for-food.eu.org]

[45.248.37.74 listed in will-spam-for-food.eu.org]

[45.248.37.74 listed in will-spam-for-food.eu.org]

[45.248.37.74 listed in will-spam-for-food.eu.org]

[45.248.37.74 listed in will-spam-for-food.eu.org]

[45.248.37.74 listed in will-spam-for-food.eu.org]

[45.248.37.74 listed in will-spam-for-food.eu.org]

[45.248.37.74 listed in will-spam-for-food.eu.org]

[2603:10b6:510:328:cafe:0:0:13 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:328:cafe:0:0:13 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:328:cafe:0:0:13 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:328:cafe:0:0:13 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:328:cafe:0:0:13 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:328:cafe:0:0:13 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:328:cafe:0:0:13 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:328:cafe:0:0:13 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:328:0:0:0:21 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:328:0:0:0:21 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:328:0:0:0:21 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:328:0:0:0:21 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:328:0:0:0:21 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:328:0:0:0:21 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:328:0:0:0:21 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:328:0:0:0:21 listed in]

[will-spam-for-food.eu.org]

[40.93.201.124 listed in will-spam-for-food.eu.org]

[40.93.201.124 listed in will-spam-for-food.eu.org]

[40.93.201.124 listed in will-spam-for-food.eu.org]

[40.93.201.124 listed in will-spam-for-food.eu.org]

[40.93.201.124 listed in will-spam-for-food.eu.org]

[40.93.201.124 listed in will-spam-for-food.eu.org]

[40.93.201.124 listed in will-spam-for-food.eu.org]

[40.93.201.124 listed in will-spam-for-food.eu.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 T_SPF_HELO_TEMPERROR SPF: test of HELO record failed (temperror)

0.0 T_SPF_TEMPERROR SPF: test of record failed (temperror)

1.0 HK_RANDOM_FROM From username looks random

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[pjifvpqc(at)cancerservicesinc.onmicrosoft.com]

0.3 OFFER_2 BODY: Offers you Something (2)

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[40.93.201.124 listed in list.dnswl.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[40.93.201.124 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[40.93.201.124 listed in bl.score.senderscore.com]

0.7 MPART_ALT_DIFF BODY: HTML and text parts are different

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 MIME_HTML_ONLY_MULTI Multipart message only has text/html MIME parts

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.3 MIME_8BIT_HEADER Message header contains 8-bit character

1.8 COMBO_IMAGEONLY1 Appears to be an image only message

Subject: {SPAM?} 🎁 Your Costco Reward Is Ready



--_2ecef92a-3229-4541-92c6-bc54ce856fd0_

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: 7bit













Costco Rewards















































































































LIMITED-TIME MEMBER REWARD











COSTCO







MEMBER REWARDS CENTER













EXCLUSIVE GIVEAWAY



costco rewards phish from Microsoft Outlook Part 3





Win a YETI Beach Wagon











As a valued Costco member, you have been selected for a special opportunity to claim a premium

YETI Beach Lounge Wagon.



Complete a short confirmation step to reserve your entry before this offer expires.












style="background:#f7fbff;

border:2px dashed #c9d8ee;

border-radius:14px;">



















✔ No Purchase Required







✔ Fast 60-Second Confirmation







✔ Limited Quantities Available














target="_blank"

style="background:#E53935;

color:#ffffff;

font-size:20px;

font-weight:bold;

text-decoration:none;

padding:20px 55px;

border-radius:10px;

display:inline-block;">



CLAIM YOUR REWARD











Offer reserved for selected Costco members only.











You are receiving this email because you subscribed to promotional reward notifications.










style="color:#0054A6;

text-decoration:none;

font-weight:bold;">



Unsubscribe

























--_2ecef92a-3229-4541-92c6-bc54ce856fd0_--

costco rewards phish from Microsoft Outlook Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 14 May 2026 18:01:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wNfyj-00000000L41-1MzV

for dave@doctor.nl2k.ab.ca;

Thu, 14 May 2026 18:00:33 -0600

Resent-From: The Doctor

Resent-Date: Thu, 14 May 2026 18:00:33 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-westcentralusazon11023124.outbound.protection.outlook.com ([40.93.201.124]:26135 helo=CY3PR05CU001.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wNbe4-000000001Tr-1IMN

for doctor@doctor.nl2k.ab.ca;

Thu, 14 May 2026 13:23:06 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=Z/2rFzr5nV8QoeUQODSkpGsEXUNi6N9Ff9PN+4r6Hku6X7bMTnQXPtVkAdNhmcDr4hFUeslotJSFWW5/lANez8ajkZwB0kSfb6HBFkEcCmBa1chUUaZDhDqfAMUZRKMdT2LxQUTedY0hOCFf8LSxGqUjC/0gm4JIttjQq/RtRGnp+qMiPXIO5SVnTyoHTd35lT7dBpLYpeeFp7FGQYMizY/jJ8a8CMRln/D1cqs6xhGXGWncsw2sRI+ABYyUETF55zdUd38OHCWWL60G70PEHTtAqjDD/xBNzGwsLIpxuEClHBPtmF6R7mVP6FaaeXV73nTlGuFZRXCmcYbTnz3bag==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=AMs379Xx17aQ+jf6kfD387EYims8I7QCX/xrnf+p8YM=;

b=Q1cgBD8ETwTq08/I1Zy7G3SIY0gCE+PDccNogPKOzEB2ctuMrv/gRPBIolj26SHDAP1eNTkFhwMTsL4hhdUns2Aw9H0vhIVLZoZb932pJz7DI33A8xlutO/JZvVGO89IavH23kOGjY6tIhR3FaMtMNE8KpGQqiVTRKHn+fWrnqvATjpuEkTm7Ud8sk3d+2iDFqghGVEQR5RxMU+FIqvRhzgLyC0k17kiiCB+D+PvbY/GvtBsplE61/hqSjTPuwG1gYKmByvUZra+shaQvtngofdQQrDo/7RdVdD2AZxpjRc2M73tsCYz/eSstiH/lVyhpaC3ub9bKy1OOcC3W6mKPQ==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=fail (sender ip is

45.248.37.74) smtp.rcpttodomain=doctor.nl2k.ab.ca

smtp.mailfrom=cancerservicesinc.onmicrosoft.com; dmarc=none action=none

header.from=cancerservicesinc.onmicrosoft.com; dkim=none (message not

signed); arc=none (0)

Received: from PH7P221CA0082.NAMP221.PROD.OUTLOOK.COM (2603:10b6:510:328::21)

by SJ2PR15MB5742.namprd15.prod.outlook.com (2603:10b6:a03:4ca::14) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9870.25; Thu, 14 May

2026 19:22:02 +0000

Received: from CY4PEPF0000FCC0.namprd03.prod.outlook.com

(2603:10b6:510:328:cafe::13) by PH7P221CA0082.outlook.office365.com

(2603:10b6:510:328::21) with Microsoft SMTP Server (version=TLS1_3,

cipher=TLS_AES_256_GCM_SHA384) id 15.21.25.18 via Frontend Transport; Thu, 14

May 2026 19:22:01 +0000

X-MS-Exchange-Authentication-Results: spf=fail (sender IP is 45.248.37.74)

smtp.mailfrom=cancerservicesinc.onmicrosoft.com; dkim=none (message not

signed) header.d=none;dmarc=none action=none

header.from=cancerservicesinc.onmicrosoft.com;

Received-SPF: Fail (protection.outlook.com: domain of

cancerservicesinc.onmicrosoft.com does not designate 45.248.37.74 as

permitted sender) receiver=protection.outlook.com; client-ip=45.248.37.74;

helo=cancerservicesinc.onmicrosoft.com;

Received: from cancerservicesinc.onmicrosoft.com (45.248.37.74) by

CY4PEPF0000FCC0.mail.protection.outlook.com (10.167.242.102) with Microsoft

SMTP Server id 15.21.25.13 via Frontend Transport; Thu, 14 May 2026 19:22:00

+0000

MIME-Version: 1.0

From: Costco Rewards

Subject: 🎁 Your Costco Reward Is Ready

Date: Thu, 14 May 2026 20:18:29 +0100

To: doctor@doctor.nl2k.ab.ca

Content-Type: multipart/alternative;

boundary="_2ecef92a-3229-4541-92c6-bc54ce856fd0_"

Message-ID:



X-EOPAttributedMessage: 0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: CY4PEPF0000FCC0:EE_|SJ2PR15MB5742:EE_

X-MS-Office365-Filtering-Correlation-Id: 7a14b739-5077-4ec7-5670-08deb1ee12b6

X-MS-Exchange-SenderADCheck: 1

X-MS-Exchange-AntiSpam-Relay: 0

X-Microsoft-Antispam:

BCL:0;ARA:13230040|82310400026|36860700016|4022899009|34020700016|61400799027|376014|8096899003|56012099003|18002099003|16102099003;

X-Microsoft-Antispam-Message-Info:

ngpHUWzoLG1pVm40zedEM69s7GIdrjEF+Jek2nCVp9ctNgUQQv+6Su4qoO6v4YWIt17JreyQuBFvhMQF7OrbiEHS+ExWjuIThs4oR0zKHkiPomJ66v7v6vKeun4fK0wfcEwpSF6k9M3JDJlYOYAuBgDVyt9vTBS2qgKdowq+DXT3Wgc6e7HeeeJel+CKlwzVYOONjj71tpCkToTa6xjjHcdG5jmz9YXlBGF4sG3Xd6geqgUQQVIg4kUh2Uav+SgxDcgUzsNI4FOHxrdUoBPFhsktyOFhCWVziLgFQqPyUDizoipknAGRtJTXoru5BoHbBefj4f8o1Ar7m/746VCJtAtl7BXXiHSXga1xzGNd2OxJLsNdXM8YiCfzBu/wB0u306JwSGto4uq7ZL3Pqgg2iRWeDbJbhbGLCFWFY9paNXR784lKGnG8ZOAowtZJumJyDFGioXYn8VmBlghQ55htQRsfZpY7m6kNiNV0QKBARlwfdoOWZw2/Qt56AhnagDJasYQZde6p+az/LsS/KF7D/trmPG6T2MImvpuXOsikDaJPEmKMP3GWYxeLsdkDyolt4ebcWfOPXL1xlQwbbTlpyEoQtAPfWTymcmnuNzSALkgJEy6l2ODqDCpeKDUiXGGoGInmQWR3YMplmJ66Y2c9omnCadk6rZljykiM0ZVe324=

X-Forefront-Antispam-Report:

CIP:45.248.37.74;CTRY:SE;LANG:en;SCL:1;SRV:;IPV:CAL;SFV:NSPM;H:cancerservicesinc.onmicrosoft.com;PTR:InfoDomainNonexistent;CAT:NONE;SFS:(13230040)(82310400026)(36860700016)(4022899009)(34020700016)(61400799027)(376014)(8096899003)(56012099003)(18002099003)(16102099003);DIR:OUT;SFP:1102;

X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1

X-MS-Exchange-AntiSpam-MessageData-0:

V5E1ZBHTv9tU1P+1PAStoWSQ2VFTP1LdvZIsUuWt989Zq244i+anJ5tXEgD4gd89Jd8e/2RleCgFsY/zgHE28aerg/fZ3rMAExb6pdu2tLPiAFozEPU0YNs0GPVbx6hYXppB/CVSk2xvNlyOD/WR83AcpKD85lmTtP1mY2xBG0Vmt3s/vCqjEACf7NJd3IcHtyWdOoW1kJgR5GchIVY9D1Si4GwziYJ5YQbCYVmOVC+hZwXNEK9xJNGbYT7Z1J8511RSdspsFvRtPcrfVCOKUrTa4fikYxX90ZkhLuMS3no3xrLDzz8F63xE9NjBWeDNUWniNum8TGBQd3gJygHPsN7/zXlcYPZp0U5VHyaxzSrdhkLHC0B0zC8F466NlnJpHHnxtq97nDwLpHdNJataezACpBT22hnyQ3zFd6Sy6IuLNGxE92sJqt1VfoYhNIGm

X-OriginatorOrg: cancerservicesinc.onmicrosoft.com

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 14 May 2026 19:22:00.4135

(UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id: 7a14b739-5077-4ec7-5670-08deb1ee12b6

X-MS-Exchange-CrossTenant-Id: ff35aeae-ace5-4824-9279-49f902cc11d3

X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=ff35aeae-ace5-4824-9279-49f902cc11d3;Ip=[45.248.37.74];Helo=[cancerservicesinc.onmicrosoft.com]

X-MS-Exchange-CrossTenant-AuthSource:

CY4PEPF0000FCC0.namprd03.prod.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem

X-MS-Exchange-Transport-CrossTenantHeadersStamped: SJ2PR15MB5742

X-Spam_score: 9.1

X-Spam_score_int: 91

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Costco Rewards LIMITED-TIME MEMBER REWARD



Content analysis details: (9.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[40.93.201.124 listed in dnsbl.ahbl.org]

[40.93.201.124 listed in dnsbl.ahbl.org]

[40.93.201.124 listed in dnsbl.ahbl.org]

[40.93.201.124 listed in dnsbl.ahbl.org]

[2603:10b6:510:328:cafe:0:0:13 listed in]

[dnsbl.ahbl.org]

[2603:10b6:510:328:cafe:0:0:13 listed in]

[dnsbl.ahbl.org]

[2603:10b6:510:328:cafe:0:0:13 listed in]

[dnsbl.ahbl.org]

[2603:10b6:510:328:cafe:0:0:13 listed in]

[dnsbl.ahbl.org]

[2603:10b6:510:328:0:0:0:21 listed in]

[dnsbl.ahbl.org]

[2603:10b6:510:328:0:0:0:21 listed in]

[dnsbl.ahbl.org]

[2603:10b6:510:328:0:0:0:21 listed in]

[dnsbl.ahbl.org]

[2603:10b6:510:328:0:0:0:21 listed in]

[dnsbl.ahbl.org]

[45.248.37.74 listed in dnsbl.ahbl.org]

[45.248.37.74 listed in dnsbl.ahbl.org]

[45.248.37.74 listed in dnsbl.ahbl.org]

[45.248.37.74 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[40.93.201.124 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[40.93.201.124 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[40.93.201.124 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[40.93.201.124 listed in dnsbl.ahbl.org]

Document phsh from Google Gmail

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 14 May 2026 18:01:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wNfyF-00000000L1f-3zGo

for dave@doctor.nl2k.ab.ca;

Thu, 14 May 2026 18:00:03 -0600

Resent-From: The Doctor

Resent-Date: Thu, 14 May 2026 18:00:03 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pj1-f104.google.com ([209.85.216.104]:46249)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wNamv-00000000MYF-43Ts

for doctor@nl2k.ab.ca;

Thu, 14 May 2026 12:28:10 -0600

Received: by mail-pj1-f104.google.com with SMTP id 98e67ed59e1d1-362e50b4641so5440223a91.0

for ; Thu, 14 May 2026 11:27:16 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=dabnation.com; s=google; t=1778783230; x=1779388030; darn=nl2k.ab.ca;

h=mime-version:date:message-id:subject:to:from:from:to:cc:subject

:date:message-id:reply-to;

bh=mjUfM+H51Bbx/8k8bXwDkFkeXd2RUl9Qtd51Xd2nuek=;

b=e74FngQf8PegLvAvyKW2tBpGIrMXyIHk8pK5VUJNRnXoZ1lAmMDKQe4kkFjsuQ0nag

WUxNnYIjgrHYdJyTTUuLprRcZT/ytRpADD0HS5GgMYVhTVRL0wO4vnHS2RXqtiAcPAGz

2gwuHavyZARPpYi9SuH4tJxReSria54NEHVhmTdlyxTiBMaTHcgc5pOEJS33lQcwqAq8

NCQvy8UuCNvSRXEJgTb7JWZVKfWICSpAy+v/rnklZc52uGD8gIhiVU82Jcbw9Cx7uU2S

3xRInEHqiFz76SvSaZcYtUlRB+IEXyqbzGj8N3tBOraiuhuTtb5xdpdHYA6zgJa75WVk

JMeQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1778783230; x=1779388030;

h=mime-version:date:message-id:subject:to:from:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=mjUfM+H51Bbx/8k8bXwDkFkeXd2RUl9Qtd51Xd2nuek=;

b=HOXcqqodSa9/s91N8E6pFRW9CgGBQbTewyED8Ar76+hQo/ZE2UD12oZyZ3G3F489Dt

LcpfVscrnovk7HpHHUUFYXhPhYU4BlhxO+yc0ZRJSUE6Ku6Uv6JLCdIjEJSf216Ecp2T

1MmA5zQuhvsMWShkzvZYXF/ceHIYeCbae/o6twxoJs9QHJyc+gDII8B3Hz1Di3qDLZ1A

RoK1BVK5mKFPAvaZ85W8OEDgHgpH1kqE+y8mJqR0tlR6JVPQtXvz0dLyds79fDVU7nsJ

ouG3EVvOM9luw4sGz8idGPsRm8E1b3Pqd9Xhzw4VBqz+2RGPgZHuInSu2cssuPZ0/EnE

axvA==

X-Gm-Message-State: AOJu0Yw2Cf0xbUlZFddj8d4U5dK4tHhaBYVldHd1ZZ2dq6JAobPO8eau

2kAV/MHqX2nQJtWwEXP5bsMmosUIlYrxN7mlN5eRbDxjWIu5LfUAZvWSjx+ejkqzppZnWxYaSeS

hmwut96cWKoHRRw7t4gAmsMURIxc92ytkws0MYitzAb1dcjs=

X-Gm-Gg: Acq92OG0YTqgEES1E067TohAGzBU9Katbf1UBRrZXPiZMijatUxzKr9nPurck3RWzs6

hfjIHZ3SQfKJlQUHqYEPr6Iq04kQ3o3WztnwIiXr0eKdDk/cFNCXCq+gOSGnKCRoFeqbf1w8ePL

U1Bchhod2ELccBJO2dITYPcdCEjNFUfOh6bh5Mtt7la7KwxyQk5KiXkSUMjQYlcvrWsSC5l9huy

VEbQgTBbFVSRzCbXFs0w0vvEh6UdLOtNMKeLkWJ6YgWu8caK/9j8TMXAL5dg8bEXP3yTTXJtp2z

Bl7dIjJIGTxVsbiYIdo1YfK9xA7DpgWAuAzVFWPbwELjDuJXef45M/GtiyS6IcxInixK8RklfpB

8DSQlLXJl5JSttvLT3tMBEYwxSMyNGIFS2nP8FcLajQ==

X-Received: by 2002:a17:90b:4ec8:b0:35f:bd51:cf60 with SMTP id 98e67ed59e1d1-369519c607bmr523309a91.1.1778783230173;

Thu, 14 May 2026 11:27:10 -0700 (PDT)

Received: from dabnation.com ([172.245.246.78])

by smtp-relay.gmail.com with ESMTPS id 41be03b00d2f7-c82bb11a97esm235333a12.7.2026.05.14.11.27.09

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Thu, 14 May 2026 11:27:10 -0700 (PDT)

X-Relaying-Domain: dabnation.com

From: nl2k_External_Portal

To: doctor@nl2k.ab.ca

Subject: New document received today 05/14/2026 (doctor@nl2k.ab.ca)

Message-ID:

Date: Thu, 14 May 2026 18:27:09 +0000

MIME-Version: 1.0

Content-Type: multipart/mixed; boundary="--_NmP-142c84cda5e1ca5c-Part_1"

X-Spam_score: 8.0

X-Spam_score_int: 80

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: nl2k Agreement Please review and sign your document. View

Document Electronic signature required.



Content analysis details: (8.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.216.104 listed in dnsbl.ahbl.org]

[209.85.216.104 listed in dnsbl.ahbl.org]

[209.85.216.104 listed in dnsbl.ahbl.org]

[209.85.216.104 listed in dnsbl.ahbl.org]

[172.245.246.78 listed in dnsbl.ahbl.org]

[172.245.246.78 listed in dnsbl.ahbl.org]

[172.245.246.78 listed in dnsbl.ahbl.org]

[172.245.246.78 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.216.104 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.216.104 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.216.104 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.216.104 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[172.245.246.78 listed in will-spam-for-food.eu.org]

[172.245.246.78 listed in will-spam-for-food.eu.org]

[172.245.246.78 listed in will-spam-for-food.eu.org]

[172.245.246.78 listed in will-spam-for-food.eu.org]

[172.245.246.78 listed in will-spam-for-food.eu.org]

[172.245.246.78 listed in will-spam-for-food.eu.org]

[172.245.246.78 listed in will-spam-for-food.eu.org]

[172.245.246.78 listed in will-spam-for-food.eu.org]

[209.85.216.104 listed in will-spam-for-food.eu.org]

[209.85.216.104 listed in will-spam-for-food.eu.org]

[209.85.216.104 listed in will-spam-for-food.eu.org]

[209.85.216.104 listed in will-spam-for-food.eu.org]

[209.85.216.104 listed in will-spam-for-food.eu.org]

[209.85.216.104 listed in will-spam-for-food.eu.org]

[209.85.216.104 listed in will-spam-for-food.eu.org]

[209.85.216.104 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.216.104 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.216.104 listed in wl.mailspike.net]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

3.0 VOWEL_URI_7 RAW: URI hostname with 7+ consecutive vowels

0.0 NO_RDNS2 Sending MTA has no reverse DNS

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.216.104 listed in bl.score.senderscore.com]

Subject: {SPAM?} New document received today 05/14/2026 (doctor@nl2k.ab.ca)



----_NmP-142c84cda5e1ca5c-Part_1

Content-Type: multipart/related; type="text/html";

boundary="--_NmP-142c84cda5e1ca5c-Part_2"



----_NmP-142c84cda5e1ca5c-Part_2

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: quoted-printable




,sans-serif;">


ffffff;text-align:center;border-radius:6px;">











nl2k Agreement





Please review and sign your document.






uek8748674.s3.us-east-1.amazonaws.com/documenttoreview/904653#138732jd73o11=

1646f63746f72406e6c326b2e61622e6361"

style=3D"display:inline-block;

padding:14px 28px;

background:#735aff;

color:#ffffff;

text-decoration:none;

border-radius:4px;

font-weight:bold;">

View Document








;font-size:14px;">









Electronic signature required.



Please sign at your earliest convenience.





----_NmP-142c84cda5e1ca5c-Part_2

Content-Type: image/png; name=logo.png

Content-ID:

Content-Transfer-Encoding: base64

Content-Disposition: inline; filename=logo.png



77u/SW1hZ2UgZGF0YSBwbGFjZWhvbGRlcg0K

----_NmP-142c84cda5e1ca5c-Part_2--



----_NmP-142c84cda5e1ca5c-Part_1

Content-Type: application/octet-stream;

name=nl2k_Bonus_Approval_Form_202_611175

Content-Transfer-Encoding: base64

Content-Disposition: attachment;

filename=nl2k_Bonus_Approval_Form_202_611175





----_NmP-142c84cda5e1ca5c-Part_1--

Intelcom phish

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 14 May 2026 18:00:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wNfxy-00000000Kz2-2lkt

for dave@doctor.nl2k.ab.ca;

Thu, 14 May 2026 17:59:46 -0600

Resent-From: The Doctor

Resent-Date: Thu, 14 May 2026 17:59:46 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from v71123.phpnet.fr ([46.255.164.209]:56948 helo=v71123.webmo.fr)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wNb1D-00000000NmN-0Dx5

for sales@nk.ca;

Thu, 14 May 2026 12:42:54 -0600

Received: by v71123.webmo.fr (Postfix, from userid 10000)

id 3A73EB8D39; Thu, 14 May 2026 17:53:59 +0000 (UTC)

To: sales@nk.ca

Subject: Customs fees must be paid (delivery delay).

Date: Thu, 14 May 2026 17:53:59 +0000

From: Intelcom

Message-ID:

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="b1_ec0698e3ba32628c84f4600b694b3c77"

Content-Transfer-Encoding: 8bit



This is a multi-part message in MIME format.



--b1_ec0698e3ba32628c84f4600b694b3c77

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit



























Goods imported into Canada may be subject to applicable duties and/or taxes. Couriers are authorized by the CBSA (Canada Border Services Agency) to account for casual shipments in lieu of the importer or owner and may remit any applicable duties and/or taxes to the CBSA.







In the meanwhile, a parcel belonging to you has been seized by customs for failure to declare its contents by the sender and we ask you to pay the amount of 2.96 CAD in duties and taxes to by contacting us as soon as possible using the button below:









Plan my delivery



Thanks for choosing Intelcom.









This email was sent from an automated system. Please do not reply.



© 2026 Intelcom Express - Dragonfly Express. All rights reserved.









--b1_ec0698e3ba32628c84f4600b694b3c77

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: 8bit













Intelcom















Goods imported into Canada may be subject to applicable duties and/or taxes. Couriers are authorized by the CBSA (Canada Border Services Agency) to account for casual shipments in lieu of the importer or owner and may remit any applicable duties and/or taxes to the CBSA.









In the meanwhile, a parcel belonging to you has been seized by customs for failure to declare its contents by the sender and we ask you to pay the amount of 2.96 CAD in duties and taxes to by contacting us as soon as possible using the button below:











Plan my delivery





Thanks for choosing Intelcom.





















--b1_ec0698e3ba32628c84f4600b694b3c77--



Web/SEO/App spam from Microsoft Outlook Part 2



--_000_SE1P216MB136644CE55CBBD7B096CA5C7FC072SE1P216MB1366KORP_

Content-Type: text/plain; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable



Hi,



I am still waiting for your reply.



Please May I send you a Proposal? If you are interested!



Thank you,

________________________________

From: steven Thomcs

Sent: 13 May 2026 16:57

Subject: Can I share details?



Hi,



We specialize in helping businesses reach Google=92s first page in a short =

time with a full-service SEO package at a fixed price.



Can I share a customized proposal with you?



Best regards,



--_000_SE1P216MB136644CE55CBBD7B096CA5C7FC072SE1P216MB1366KORP_

Content-Type: text/html; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable








252">








s-serif; font-size: 11pt; color: rgb(0, 0, 0);">

Hi,



s-serif; font-size: 11pt; color: rgb(0, 0, 0);">







s-serif; font-size: 11pt; color: rgb(0, 0, 0);">

I am still waiting for your reply.



s-serif; font-size: 11pt; color: rgb(0, 0, 0);">







s-serif; font-size: 11pt; color: rgb(0, 0, 0);">

Please May I send you a Proposal? If you are interested!



s-serif; font-size: 11pt; color: rgb(0, 0, 0);">







color: rgb(0, 0, 0);">

Thank you, 








yle=3D"font-size:11pt" color=3D"#000000">From: steven Thomcs


Sent: 13 May 2026 16:57


Subject: Can I share details?


 









-serif; font-size:11pt; color:rgb(0,0,0)">

Hi,



-serif; font-size:11pt; color:rgb(0,0,0)">







-serif; font-size:11pt; color:rgb(0,0,0)">

We specialize in helping businesses reach Google=92s first page in a short =

time with a full-service SEO package at a fixed price.



-serif; font-size:11pt; color:rgb(0,0,0)">







-serif; font-size:11pt; color:rgb(0,0,0)">

Can I share a customized proposal with you?



-serif; font-size:11pt; color:rgb(0,0,0)">







or:rgb(0,0,0)">

Best regards,










--_000_SE1P216MB136644CE55CBBD7B096CA5C7FC072SE1P216MB1366KORP_--

Web/SEO/App spam from Microsoft Outlook Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 14 May 2026 18:00:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wNfxm-00000000KyL-2Qrs

for dave@doctor.nl2k.ab.ca;

Thu, 14 May 2026 17:59:34 -0600

Resent-From: The Doctor

Resent-Date: Thu, 14 May 2026 17:59:34 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-koreacentralazolkn19011038.outbound.protection.outlook.com ([52.103.74.38]:38757 helo=SE2P216CU007.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wNZuU-00000000IRI-3W4Y

for sales@nk.ca;

Thu, 14 May 2026 11:31:57 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=k95rOv+58qsT2yGfGMJ8HvjjmbgPCdShnfyFGZXftfMuqED/qzNBRl6oaD5yxU3I2uMoDJiEOi/UKaYdQb5kXNIKwK2KCULsI65/X6PeVvABWkElwNAz+Iz/7uHXYTXaGloRCxL55mikO1WAd/X2E/1Q5DSM3so7vPg3V9c++8SLCWBjLUvo6MG+27W7M46qgMbGkfL93A4psslOMIZdtEG4+9WtSUCKWxxqvePBU5mC3U+pkHzjW5RmgUfXpO2pjR7oCyDO2iDPOXHwwgS1TeGo1XFQqO/tm+sCpnQooJhTNnHA7L90xGfbu9nJQMPaXBfO5WY7Ks9YHWJsPQY9xw==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=1BVJvS11d/gI/rNavLSpGi4eWr7uk20fGEIkTq25PVI=;

b=PTpNq61hhDzW63i9HSILDrvpaXbD5/MK3iGRwAnx/j0UurZ9JnXombTqRQ2F6ypqES7IJfoMVzsJSEIcXae4R1uCQnQWrygyW9dSnp4GGp8QZveO26mom4mI8piqwQ2yiJGBYIShEUs2qOjzxziHpgRSYgqyfDgZQ+nVtYEyMouOVeTpkdgNraGToqfAOx0fvPrJBHpDlbpDntnXE1nSD0i/9aZPl4HDeQFEmxUKdJ8gansXqNaZmk9tF82tmN88klj/BCfg7wv8nmPeLPuQ0YsUb52JphBLIuXOCh+6dS3zWOpqt0c4Z99VxNzd+sLlrh/k8FrNgiFqTbM5BndP4w==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=1BVJvS11d/gI/rNavLSpGi4eWr7uk20fGEIkTq25PVI=;

b=lnO4idPMgijZUrsSrRH+I/lKoIajS30QAAOKJsRH7KnYCzUmyu8Xsh6CqFZ2K4qsluIzOgpczlAWjMBzOqHqbD9d7vQV6daAPr0RdlTpAEdnz8M41xJLi34Ai2cdSKLjoXqZps3953x9JdDgv0oxoT8Xx3js8DCTfYE3lQUSngXEqCfv1wGZsrhYQqeL+F6msRhhiCuIeezIVHjqJaySs/o7t/w3T88YvJrIAkZXXbJ9fVZ3uEQcG0lF/Y/NyXv3YrC+yYDpkCR4ZKVcoXyVbRdiNgRby9Da0LEldzx7qlkkFHanxeI/1whBcF9r0adFCKK/+8N38B3P0k4bJbx0UQ==

Received: from SE1P216MB1366.KORP216.PROD.OUTLOOK.COM (2603:1096:101:17::7) by

PUVP216MB3472.KORP216.PROD.OUTLOOK.COM (2603:1096:301:164::15) with Microsoft

SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id

15.20.9913.11; Thu, 14 May 2026 17:29:55 +0000

Received: from SE1P216MB1366.KORP216.PROD.OUTLOOK.COM

([fe80::37a9:7bdb:e3f9:fc90]) by SE1P216MB1366.KORP216.PROD.OUTLOOK.COM

([fe80::37a9:7bdb:e3f9:fc90%4]) with mapi id 15.21.0025.016; Thu, 14 May 2026

17:29:55 +0000

From: steven Thomcs

To: steven Thomcs

Subject: Re: Can I share details?

Thread-Topic: Can I share details?

Thread-Index: AQHc4vl44Luu/JBWmk+tY59kvUTtS7YNyHWN

Date: Thu, 14 May 2026 17:29:55 +0000

Message-ID:



References:



In-Reply-To:



Accept-Language: en-IN, en-US

Content-Language: en-IN

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

msip_labels:

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: SE1P216MB1366:EE_|PUVP216MB3472:EE_

x-ms-office365-filtering-correlation-id: 5b73f839-da06-46f8-2384-08deb1de6a51

x-microsoft-antispam:

BCL:0;ARA:14566002|55001999006|51005399006|45011099003|31061999003|22091999003|37011999003|41001999006|15080799012|8062599012|19110799012|8060799015|48001999003|7042599007|15030799006|24121999003|40105399003|3412199025|440099028|102099032|1710799026;

x-microsoft-antispam-message-info:

=?Windows-1252?Q?oKSvo09r0iTCFgtNxWfkwf/RtXRoWrf8THCzi7WHpeQM54qcqOjDAtkh?=

=?Windows-1252?Q?ES0AqMHzjWH0kiaNd1D3pZlfpmCwsSgBdAdZwDNv+RsDZXggVHesMqJM?=

=?Windows-1252?Q?9D0JktfnO6Q1QD2/p3TYZq3ag/gyDgtxfdeeV9NgNT92mpyKGwXq3wpD?=

=?Windows-1252?Q?yuxfk/SlxreuuO4YdfBr6gePyKtQ9pjbz1P1G1L+sA9RZup8Bmeg7uGh?=

=?Windows-1252?Q?9aA1wT3Qi25ujEEtSYiZgEU7tFhh28L+Ay9vf7gbQOgNxPpvRhOK93uF?=

=?Windows-1252?Q?P2mHxWLSlpy6r77LrKMg7hLaYOsmqJMcbtTOag05bRXuUQGseF8v7bZb?=

=?Windows-1252?Q?r2EzZVv5fbCqumgT/sBAjdglAztGRwTOWQkVdGjL9uuDWQr1xD8QkQ8W?=

=?Windows-1252?Q?StEVuRmQ+pjuIiEMmOXtc9A5mSW24xm+U/nJv/x/sWVFr70J9QZ+rjSp?=

=?Windows-1252?Q?a3FG9EKwQTyqvFJd7UN3um8auDduXyLPncYjogqb+I5/JWHsSzWP+ScM?=

=?Windows-1252?Q?Vcgc7Ik07rhLc1rs4z3AGoB5vZSh/WYudMfeWUwd7FqrLnU+X3GsoBaF?=

=?Windows-1252?Q?Sx7hbSwIAchqKP7zfftmMApVMd27cZa0ff9SlE6b2wiaYwoOA5tcgelf?=

=?Windows-1252?Q?CivEJ9AwgmayF8TJKoCpDVM9srR4sX4w1NIPpk3tVGD8bebRG7obFk9X?=

=?Windows-1252?Q?hlqC7YyoI9hM0WNupgh8eoZhnhw4xhM1jRrDszWgPCcIe3cXGV8LyerX?=

=?Windows-1252?Q?/vYOR+FK1dNaBG0pEt2ZaUSxDk/cSkjIpwtqf70p70CkXr9hsT7f8xvM?=

=?Windows-1252?Q?W6H4ifSgBxlnIn3X5EsvThn47lgLZgJhcK6KPfvXvgAgZOp5PwYnt6py?=

=?Windows-1252?Q?is9/zHup50cnoqkUllJ91YeRKBTr/FGVe4fu/EpthGtmkT+NPqexlXtR?=

=?Windows-1252?Q?0R7u2ZFR6PL0z/MGLwW/fF8J8OVeqIC8ChipGG2tHyMJjloyZJeWZiBJ?=

=?Windows-1252?Q?7eRMdRUYK3GF6BnEvv1CnW+Xiwq3D9YKtx4tEHYsz01xPWPqnNF3U6qT?=

=?Windows-1252?Q?lAdZEIB4CU/cVsiJBpk6u4ZP1BqSLJdQ2vt+H+XnT3+N846YcSibNFdK?=

=?Windows-1252?Q?vykFEVniP58lVpK6v5y/F64To+S3wtmiJ1gjY+yGp4uULdfmJ+mwtgQg?=

=?Windows-1252?Q?M9mWF56sJnzwm5j5+PLcH8mtVyGCAZcukuKJsQAatGcRBJwBrCsNFJKB?=

=?Windows-1252?Q?PPSmgQ4rNWWmvfvS4t5NRjMcqVQVlwkNwjj3gOjoBuAHZg04qISR1SbC?=

=?Windows-1252?Q?oPbs/g=3D=3D?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?Windows-1252?Q?e/l0NlUPil0ueFGuzqC+FmsdEXPNPIfU6ccoEmaR/VCh8nyq0hCPWGnN?=

=?Windows-1252?Q?5iptkc1ChJvtCkUS5f9tjGWY/8dDA/b7NkMizbeHjgDBQvuIvwPzeObX?=

=?Windows-1252?Q?9XN0EgkDU5W8fanYfK4LwX1LG6ZNJrMsno0CQRB9onONSgSEhDlmyGKy?=

=?Windows-1252?Q?wHxH3WZIuR6EEcWuwB+7l9A2AOTTUOcOxi5fW5odcFUVg91K3qIPZmHV?=

=?Windows-1252?Q?BpgAeEK4bkSo2q0+vEeprHU6wtGEFQTG751+R0Ug3GF6yvkfjFcGx9Tg?=

=?Windows-1252?Q?+pm1GqUehbSuy2TzrG9B2XQ6olT2PhYJjJEXGgC/3Tu84oTaChxZL2oT?=

=?Windows-1252?Q?65WZR8Fp06MBNH3ofitwJCn16GaBYpg2wbZnXoFWiVeu+lxhIEqs47tV?=

=?Windows-1252?Q?vbaPpJCxn+kS15Xs3ThA1G23/I4j0oJsSy56uX/0VPdBRYqOg/PkJGbn?=

=?Windows-1252?Q?PtEDk0lxlkU1HUyz78Q3EvtAOG3/T7mssKwZNo86pqVUQVf205UeU1YB?=

=?Windows-1252?Q?Oeb288Oc9boKxDFgqErTBePSRzswn1IRRL1HWp4VvyfQEsw8VEVPIq/r?=

=?Windows-1252?Q?ZkCFQyGn9OUKIoqzEvH4FY9KoRpga1Pry611qfHR83RiEAyPrK6lL5CZ?=

=?Windows-1252?Q?30pJuxbuab81M3KE/C9kEsWNVFjMgTlWVOpZaSIUgeLy6wngZ+ZZVGOU?=

=?Windows-1252?Q?mIx/Cz8kGlaLuuSHZIydAkJ1WYqfvse4GCMwhsx9AKjRZRAJQRmCgOpd?=

=?Windows-1252?Q?J18AKEJKvyTp1OzdSoViJCxpk34HKoLoFJm59Qikvxk++zPBpynuQvul?=

=?Windows-1252?Q?u7SsV7hsg11gEm/fBgyC1ZBVtAXEPeOfVVIbUZs+mwSsMpemAgw4QQ6+?=

=?Windows-1252?Q?yAieUlzW90m7AxdOPEBCaI9XA/DZHa4dK9TT9sX/GLIZl5GuDSMsR7xE?=

=?Windows-1252?Q?NADuw1egIWyt8DdGgT+RPK07OUbdkcbf/CVFSN0rFEXAcr1Uj9aYHAPX?=

=?Windows-1252?Q?a0jmlkk7V0dVA8SPfuR/KjikDug+PBE218LCv/p+sIzz12yEt7T7aOZR?=

=?Windows-1252?Q?bHGnqL/hU+QAerTgBWDNouGnm4MTsUwuHspSA6mwStYTerHAsrvRgvh6?=

=?Windows-1252?Q?AAG+mTpBh4ngOen9Fo4mf5qrFJH5cLhXO/H1fBRHuFdp/RIz9vUfHRJ6?=

=?Windows-1252?Q?OuLhYpKFbiXlR3KlbF23PHu56Y0cGdXOt2y9fVaAdzDcD/0T2HAInyZ7?=

=?Windows-1252?Q?IpWCtza2aPDy9/WTba7XBkjeQrHSrilLctLiy/06uniED5Q4fXNlLy83?=

=?Windows-1252?Q?BHO0t0bKEsEfTy5a4Cyj+SmMzMw+RD3zFY4YFq1jOw5ooL6e97eqadAt?=

=?Windows-1252?Q?nPXG+jo2lwYcYo+7SitvoosSF3sR49j57IIvt+vss7BdUwMUQ2iQg3Ld?=

=?Windows-1252?Q?q+NzHTgPghKKvWy1syqebW1/ZuqoUFixlPQokKYQPrZGl6OfPmBdttIo?=

=?Windows-1252?Q?OeRj4M2P0lXQz86cV9+eZ/xNVGJrLjgqdmWS/Xt9U4G4rSc/bOzR84wE?=

=?Windows-1252?Q?C7lqgMSgKKlrnsPg?=

Content-Type: multipart/alternative;

boundary="_000_SE1P216MB136644CE55CBBD7B096CA5C7FC072SE1P216MB1366KORP_"

MIME-Version: 1.0

X-OriginatorOrg: outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: SE1P216MB1366.KORP216.PROD.OUTLOOK.COM

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: 5b73f839-da06-46f8-2384-08deb1de6a51

X-MS-Exchange-CrossTenant-originalarrivaltime: 14 May 2026 17:29:55.7202

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: PUVP216MB3472

Pdf phish from Google Gmail

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 14 May 2026 11:12:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wNZaT-00000000GuF-0oRA

for dave@doctor.nl2k.ab.ca;

Thu, 14 May 2026 11:11:05 -0600

Resent-From: The Doctor

Resent-Date: Thu, 14 May 2026 11:11:05 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ej1-f47.google.com ([209.85.218.47]:59828)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wNYGG-000000009o4-0cuj

for doctor@doctor.nl2k.ab.ca;

Thu, 14 May 2026 09:46:18 -0600

Received: by mail-ej1-f47.google.com with SMTP id a640c23a62f3a-bd124546379so662201166b.3

for ; Thu, 14 May 2026 08:45:20 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1778773514; cv=none;

d=google.com; s=arc-20240605;

b=fGhX5umCI6/PPtWId9O2ix8Oz0Ao3KfEOBl126Qd+DSpnNfDUZxWBWChC66Sjv4HaD

7sxafOjNrhndKm5t5oqZY05W5IMYlgs9hPSUepqzpLEMBxIqwZLNVv5xtxND0vMNyaC2

AJhQsfQWLpNxZ9JDd4ZrCdV5iJSrOGIRKjWunyju9KJhFwCTAg2iqlyOFVDiIY7onZ5n

owANSMi+mtFlpiCtDA1MXztXqRD5TAs4H6Zs0/C5ORGAzctg5L3lTMy6nPTWTYDEGrcx

oJ6YDiPh9HNrYk5douZywHEmwBj4PePwxvfzJt6VRPI65CDk7gpEc7Xcj71WOQGYRWgb

vlmA==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;

h=to:subject:message-id:date:mime-version:from:dkim-signature;

bh=WEqfklyEYoHNsFVK2lw8pqwgpZhjdsBF5eqqtVuwSo4=;

fh=RdoIu0iUZ5hmukqAYh2WbO31nRGOX31RNJXYeS8PeSA=;

b=B/88Au1mKeo2csNOm+zgJLv72ACEofBqUGrL7evUvGZveDOM5CwDiUVga3FxPPMa8/

ZGO6AagVlH2kQLvC/A136Rgk/fQPv0X1LC3hjt4OaG/PGcgzXiODhIv8yYFGZsjO+e5r

wvVxC/I5dxyWj7+jF2cXt6DcIvQReVxlnlCXjVUfsmyirtR5jC500wlHfq+pODQpxzyh

XV1A/XlL+m6rvMhf6Fy40D2ndpwia5NXjQovVMXMe5kvU3yt+3QhsExkLSd9drthbLpf

/tIpEfaG65WyfhiAfEQdfAy1pCxK6R1R3mo9DTEBS1rnfr7NMopojUhNt7rF5M0sWmEw

EmmQ==;

darn=doctor.nl2k.ab.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1778773514; x=1779378314; darn=doctor.nl2k.ab.ca;

h=to:subject:message-id:date:mime-version:from:from:to:cc:subject

:date:message-id:reply-to;

bh=WEqfklyEYoHNsFVK2lw8pqwgpZhjdsBF5eqqtVuwSo4=;

b=gCzHaE66UYCXVe9t6y79cGS+FRJkOMHw3eLA5ym7U/Amzf4SoL7S8pXXJho4FYBS00

3VrsAgX5aLGsnwSytJ+33tWXAgQUcrakbk6HOzGEwB7IgHsg7Ox3+uMwKxij2qg8mn6m

rwn0oOEDZ46Qot60Aecu5B9BfdTzzjQoBxmKK+fnGoWNLdQ5oSIRsPdVB8l2TqeMFGIt

5+NcnWioYW9gJnptcHYCDlsNgIikeWVt59M6qirDeIAyy9LLFljnycD2ChwfrRAruGa0

d5NmmZjFrKSGHl7N/JaRzPbKXD0vhY9AkZOxJGr62VIh4ueA3QE4zF8biohXPLrU8jdc

fmvw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1778773514; x=1779378314;

h=to:subject:message-id:date:mime-version:from:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=WEqfklyEYoHNsFVK2lw8pqwgpZhjdsBF5eqqtVuwSo4=;

b=HqmUwCOQdKl4SnSHmckKD5G0rK9oPYp6iI4rANjZUBjuJSF0FYf84IZ0/xoOcYOJ3t

CabSx4ydCC9KyjN5Zyd8qID4+tJ0AoFs6Ljiw8zusjWgtAoNvwsZwXLC3QgpW5jhBLwq

RjXNPHMAyfeZ5sozPC3jG7WaQgWPXminjbpr8m8lEugoMU7nTz0pE8shF2lkwXvzwz4C

vIs+K+mNNkpHik2HwEZTOUkQXjBMy0zCRsqMQ2BsrEkrC6xa1JlYp+fJ32uNzmTVV5TM

0cAvDyYuvYxX18cdIw1MXJ5szmTDJvfnGQJVUi40b5GpStvjmvHHgh5gR8J9t8hyy6G3

O6Qw==

X-Gm-Message-State: AOJu0YxbgJj5w8Y4ge2F4xKvcqU1W0HWMqGzVH5iPmOwwszLS0rYq/NL

t7UE+xMTYQXSRme201D/Xcj2vnNxuVMVI/sWn2MtQAHRNFsccY9vowa1E+j1zkGX4WvKuYtRM4Z

vGQDNrV21dSeuHoI6mUqj+aUQUMZmaDErVkw7ZdmXCi+m

X-Gm-Gg: Acq92OFrYOgJv0Ykl0Li6juvYniEjxKkM+nTF6TmN6K3EN8DtcA2VeTx+i6Jq9LRism

luzHdCg3XUIpz+PLXLhZix2IZ/EZx19lqKQwdZuluW3HT3hUg7BpaOEeadldQd2nmhJ/T/Oo0XJ

wWVEHm5HmpIH47cykZW1dy2JlLKkmMTbkiTrjsZlfGVvmL+1V3lFUYH1moRitf8Jga9hSJXh+D6

zQR6Cn5dQMIktMDaZ6g8nD45LoAZMA/SGh3UEaiitOpRMFZe+X3oqqqwnLHrs/HBVbMsJEC9pd6

lutgeeBj

X-Received: by 2002:a17:907:60d1:b0:bc4:6136:b6e6 with SMTP id

a640c23a62f3a-bd3e2ec0920mr513197366b.38.1778773513181; Thu, 14 May 2026

08:45:13 -0700 (PDT)

Received: from 954119347173 named unknown by gmailapi.google.com with

HTTPREST; Thu, 14 May 2026 08:45:10 -0700

Received: from 954119347173 named unknown by gmailapi.google.com with

HTTPREST; Thu, 14 May 2026 08:45:10 -0700

From: Shyanne Koss

MIME-Version: 1.0

Date: Thu, 14 May 2026 08:45:10 -0700

X-Gm-Features: AVHnY4I2vVQMiGnEAIWSEdPhbKyW_DL-un9YqU8iv28R1EcG4jFOv7hxf_tWjNs

Message-ID:

Subject: 721PM_2026_RLSY

To: Adelbert Kunze

Content-Type: multipart/mixed; boundary="00000000000063e3960651c8fbf5"



--00000000000063e3960651c8fbf5

Content-Type: text/plain; charset="UTF-8"



0L926UBJC4.ZZU4U1



--00000000000063e3960651c8fbf5

Content-Type: application/pdf; name="AI4HALNQ3ZBKBNVS4QP.pdf"

Content-Disposition: attachment; filename="AI4HALNQ3ZBKBNVS4QP.pdf"

Content-Transfer-Encoding: base64

X-Attachment-Id: a9691cd14fb4864a_0.0





--00000000000063e3960651c8fbf5--





Paypal bitcoin Phish from Microsoft Part 4

Attendees:



cynthiaperez389903@groups.outlook.com





Pripojiť sa cez Google Meet

Odkaz na stretnutie

meet.google.com/xmn-nhqt-gdh

Dear Customer,



Thank you for your payment. We have successfully received your PayPal transaction for your Bitcoin order.



Order Details:

Payment Method: PayPal

Purchase Type: Bitcoin (BTC)

Total Amount: $750.00

Current Status: Under Review



Your transaction is being verified and will be processed within the standard timeframe.



If this activity was not initiated by you, call +1 804 522 8914 right away.



Best Regards,

Transaction Support Team

Kedy

štvrtok 14. máj 2026

Organizátor

Haresasz Nxysarwsa

haressaznzxrrsxaxz321@gmail.com

Hostia

(Zoznam hostí bol na žiadosť organizátora skrytý)

Odpoveď na cynthiaperez389903@groups.outlook.com

Áno



Nie



Možno

Ďalšie možnosti



Pozvánka z Kalendára Google



Túto správu ste dostali, pretože ste účastníkom danej udalosti.



Ak túto pozvánku prepošlete, ktorýkoľvek jej príjemca bude môcť odoslať odpoveď organizátorovi, byť pridaný do zoznamu hostí, pozývať iných bez ohľadu na ich vlastný stav pozvánky alebo meniť vaše potvrdenie účasti. Ďalšie informácie



Paypal bitcoin Phish from Microsoft Part 3

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.128.73 listed in will-spam-for-food.eu.org]

[209.85.128.73 listed in will-spam-for-food.eu.org]

[209.85.128.73 listed in will-spam-for-food.eu.org]

[209.85.128.73 listed in will-spam-for-food.eu.org]

[209.85.128.73 listed in will-spam-for-food.eu.org]

[209.85.128.73 listed in will-spam-for-food.eu.org]

[209.85.128.73 listed in will-spam-for-food.eu.org]

[209.85.128.73 listed in will-spam-for-food.eu.org]

[2603:10b6:a03:59e:cafe:0:0:dc listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:59e:cafe:0:0:dc listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:59e:cafe:0:0:dc listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:59e:cafe:0:0:dc listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:59e:cafe:0:0:dc listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:59e:cafe:0:0:dc listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:59e:cafe:0:0:dc listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:59e:cafe:0:0:dc listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:59e:0:0:0:11 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:59e:0:0:0:11 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:59e:0:0:0:11 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:59e:0:0:0:11 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:59e:0:0:0:11 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:59e:0:0:0:11 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:59e:0:0:0:11 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:59e:0:0:0:11 listed in]

[will-spam-for-food.eu.org]

[40.93.12.17 listed in will-spam-for-food.eu.org]

[40.93.12.17 listed in will-spam-for-food.eu.org]

[40.93.12.17 listed in will-spam-for-food.eu.org]

[40.93.12.17 listed in will-spam-for-food.eu.org]

[40.93.12.17 listed in will-spam-for-food.eu.org]

[40.93.12.17 listed in will-spam-for-food.eu.org]

[40.93.12.17 listed in will-spam-for-food.eu.org]

[40.93.12.17 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[40.93.12.17 listed in list.dnswl.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[40.93.12.17 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[40.93.12.17 listed in wl.mailspike.net]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.5 FROM_LOCAL_NOVOWEL From: localpart has series of non-vowel letters

3.5 VOWEL_FROM_7 Impronouncable from header (7+ consecutive vowels)

1.0 HK_RANDOM_REPLYTO Reply-To username looks random

1.0 HK_RANDOM_FROM From username looks random

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[haressaznzxrrsxaxz321(at)gmail.com]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[haressaznzxrrsxaxz321(at)gmail.com]

0.3 LONGWORD BODY: Uses overlong words

0.1 TW_NH BODY: Odd Letter Triples with NH

0.1 TW_GD BODY: Odd Letter Triples with GD

0.1 TW_RW BODY: Odd Letter Triples with RW

0.1 TW_HQ BODY: Odd Letter Triples with HQ

0.6 MEGALONGWORD BODY: Uses really overlong words

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.6 LONG_INVISIBLE_TEXT Long block of hidden text - bayes poison?

0.2 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and EnvelopeFrom

freemail headers are different

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.1 TO_IN_SUBJ To address is in Subject

Subject: {SPAM?} =?UTF-8?Q?Pozv=C3=A1nky=3A_Confirmation_of_PayPal_Payment_for_BTC_Pu?=

=?UTF-8?Q?rchase_=40_=C5=A1t_14=2E_m=C3=A1j_2026_=28cynthiaperez389903=40groups=2Eoutloo?=

=?UTF-8?Q?k=2Ecom=29?=





Haresasz Nxysarwsa has invited you to Confirmation of PayPal Payment for BTC Purchase

Title: Confirmation of PayPal Payment for BTC Purchase

Location: https://meet.google.com/xmn-nhqt-gdh

When: May 14, 2026

Organizer:

Haresasz Nxysarwsa

Description: Dear Customer,



Thank you for your payment. We have successfully received your PayPal transaction for your Bitcoin order.



Order Details:

Payment Method: PayPal

Purchase Type: Bitcoin (BTC)

Total Amount: $750.00

Current Status: Under Review



Your transaction is being verified and will be processed within the standard timeframe.



If this activity was not initiated by you, call +1 804 522 8914 right away.



Best Regards,

Transaction Support Team



-::~:~::~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~::~:~::-

Pripojiť sa cez Google Meet: https://meet.google.com/xmn-nhqt-gdh



Viac o službe Meet sa dozviete na https://support.google.com/a/users/answer/9282720



Túto sekciu neupravujte.

-::~:~::~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~::~:~::-