Paypal phish from Google Gmail
Posted by Dave Yadallee on
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Mon, 12 Oct 2026 11:41:41 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))
(envelope-from)
id 1xGK1S-00000000HNN-2qQG
for dave@doctor.nl2k.ab.ca;
Mon, 12 Oct 2026 11:41:14 -0600
Resent-From: The Doctor
Resent-Date: Mon, 12 Oct 2026 11:41:14 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-ed1-f71.google.com ([209.85.208.71]:53369)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.100.1 (FreeBSD))
(envelope-from <12058stu@iesreienjaume.eu>)
id 1xGHe4-00000000J6j-3u7O
for doctor@doctor.nl2k.ab.ca;
Mon, 12 Oct 2026 09:09:07 -0600
Received: by mail-ed1-f71.google.com with SMTP id 4fb4d7f45d1cf-6b1c285faebso970043a12.2
for; Mon, 12 Oct 2026 08:08:08 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=google.com; s=20251104; t=1791817682; x=1792422482; darn=doctor.nl2k.ab.ca;
h=content-type:from:subject:date:message-id:sender:reply-to
:mime-version:from:to:cc:subject:date:message-id:reply-to
:content-type;
bh=lv9ecGsyKrZ1sBfEwnhsytZgnlD9SGmCeBrWTHIplDk=;
b=DKG3xw0ayV6ddSnE4zDyULIyBS+iHqWjmBdXMzFvvkMVypPYvMxsU2mwdwC0/2Regk
bVy2O3j3SPkdZxJQscWXh99ddJ6ygKn9XD9jk6jJOgGyvDq+diCZYce3XfeOxs1ViJul
3zLlJVmg7zFzXmb3PMIc5q9O/2HtFej3SVc9cwudgRlmDZ8LdDO4+HXY9FFQZoUh9nl9
1I6h1Z3Qs8gpopKeMDKZB4vpe0g7+Oh83VBkZ9jLJK85ZdTr8TCs5w3MRvYm10nNauqN
oULlBmaU3XZJ0BihdX7AEnn5VQXA6Ey+2EfPMlGfKrIB6hSczOJpgfQKH/B4ZlD239EN
5Igw==
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=iesreienjaume-eu.20251104.gappssmtp.com; s=20251104; t=1791817682; x=1792422482; darn=doctor.nl2k.ab.ca;
h=content-type:from:subject:date:message-id:sender:reply-to
:mime-version:from:to:cc:subject:date:message-id:reply-to
:content-type;
bh=lv9ecGsyKrZ1sBfEwnhsytZgnlD9SGmCeBrWTHIplDk=;
b=tS1RXQbMYx0if5NpFkR6utiMTr3oYgGffNoc8F9ZTswywGihe2lhgokmI5bFxnpZHs
XJu0rHs+JtBpEyvBLoBl2gSHymtjrJUYkhHgzwcPSZLcWEAmHURlZYfosM0H96kLayyW
TugL5gowGsVevS17ZPVvnMM7Hyzv9cPooVkXQNgDUzQl1qnDAqZRSI0LfXKqtoKeiNiE
fJFyYjelAhQ+vfCEAEvlPF+kw/T20r/Mbja4oFNtpU2O/lUKu7PFhHLDdDA15hun2/54
5oNL6237b8rtRQjgRNSznNPGygtHgQ2MIWGd+2KhICEsApZaaGQbdIS4YDYQBK0ZIEmE
fAAw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20260707; t=1791817682; x=1792422482;
h=content-type:from:subject:date:message-id:sender:reply-to
:mime-version:x-gm-message-state:from:to:cc:subject:date:message-id
:reply-to:content-type;
bh=lv9ecGsyKrZ1sBfEwnhsytZgnlD9SGmCeBrWTHIplDk=;
b=fdVmcK/q83pmt9iFLCXX8kwQzyLWG3j+EYIiHSQG4kvJrydEbGjyHgUDj2IGLYuGs7
e+tb+AeQ2L0IfOSv1W+FnlfGXkZPwnbLs8iAuTbFHpCvh+NV5LqUxR26uZJEiD0Uv9/V
3+e2cBGGonaTuth0fSkJuwjrc07aR9/isRIx9lQHtDdgNI8E6ED9EulbQjQ5hR2nw3AO
VQppOk0utP7xiiyoFZbt8I624yKPWxApuOzJD5FdDPGLFY2PaFI1fe4Nc4GGvAWjZLlp
027tDH+7PuWD4h5WF3+PR1VBl90717HIYHHUXpoW8LHISTJIp8SHHTxvvqjyWFk2NBAS
h60Q==
X-Forwarded-Encrypted: i=1; AKwUvBwY496u/Go+TWBiY/T3s2K89dv0yQfx+3H0hD9OywyGG/bKKIEnLSooLas6Cszf/DnGOEUZfUo=@doctor.nl2k.ab.ca
X-Gm-Message-State: AFq9FYIR7MxzZSneFbcgzGk1tnGfB1pbKstee5si6oIOfGZ544ovAFCQ
njGaO9U79VxpXIf3qjd/q2itMmk4E5pnuNiH6qRh8lFVgPv1W8bigR3962d0AmBQtNyKt9zOgX5
DRUa+QSMM02ntOi8acV3MpdWYpiW918dxfPmFDLTbu2iMlA==
MIME-Version: 1.0
X-Received: by 2002:a05:6402:2807:b0:6ab:541:a685 with SMTP id
4fb4d7f45d1cf-6b17c252b8cmt8209093a12.17.1791817681432; Mon, 12 Oct 2026
08:08:01 -0700 (PDT)
Reply-To: MARC ROS <12058stu@iesreienjaume.eu>
Sender: Google Calendar
Message-ID:
Date: Mon, 12 Oct 2026 15:08:01 +0000
Subject: Final reminder
From: MARC ROS <12058stu@iesreienjaume.eu>
Content-Type: multipart/alternative; boundary="0000000000006ba520065da610fa"
X-Spam_score: 7.4
X-Spam_score_int: 74
X-Spam_bar: +++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Dear Valued Customer, PayPal has observed activity that doesn't
match your usual usage patterns on your account. Our fraud prevention system
recently logged a $292.95 PayPal purchase attempt at an App [...]
Content analysis details: (7.4 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[209.85.208.71 listed in will-spam-for-food.eu.org]
[209.85.208.71 listed in will-spam-for-food.eu.org]
[209.85.208.71 listed in will-spam-for-food.eu.org]
[209.85.208.71 listed in will-spam-for-food.eu.org]
[209.85.208.71 listed in will-spam-for-food.eu.org]
[209.85.208.71 listed in will-spam-for-food.eu.org]
[209.85.208.71 listed in will-spam-for-food.eu.org]
[209.85.208.71 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[209.85.208.71 listed in dnsbl.ahbl.org]
[209.85.208.71 listed in dnsbl.ahbl.org]
[209.85.208.71 listed in dnsbl.ahbl.org]
[209.85.208.71 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[209.85.208.71 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[209.85.208.71 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[209.85.208.71 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[209.85.208.71 listed in dnsbl.ahbl.org]
0.6 FROM_STARTS_WITH_NUMS From: starts with several numbers
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.208.71 listed in list.dnswl.org]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |]
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |]
1.2 MISSING_HEADERS Missing To: header
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[209.85.208.71 listed in bl.score.senderscore.com]
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.208.71 listed in wl.mailspike.net]
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 HTML_MESSAGE BODY: HTML included in message
1.9 REPLYTO_WITHOUT_TO_CC No description available.
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars
0.6 LONG_INVISIBLE_TEXT Long block of hidden text - bayes poison?
Subject: {SPAM?} Final reminder
X-Antivirus: AVG (VPS 261012-0, 10/11/2026), Inbound message
X-Antivirus-Status: Clean
--0000000000006ba520065da610fa
Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes
Content-Transfer-Encoding: base64
RGVhciBWYWx1ZWQgQ3VzdG9tZXIsIFBheVBhbCBoYXMgb2JzZXJ2ZWQgYWN0aXZpdHkgdGhhdCBk
b2Vzbid0IG1hdGNoIHlvdXIgIA0KdXN1YWwgdXNhZ2UgcGF0dGVybnMgb24geW91ciBhY2NvdW50
LiBPdXIgZnJhdWQgcHJldmVudGlvbiBzeXN0ZW0gcmVjZW50bHkgIA0KbG9nZ2VkIGEgJDI5Mi45
NSBQYXlQYWwgcHVyY2hhc2UgYXR0ZW1wdCBhdCBhbiBBcHBsZSBTdG9yZSBsb2NhdGlvbiBpbiAg
DQpNYXNzYWNodXNldHRzIChNQSkuIElmIHRoaXMgcHVyY2hhc2Ugd2FzIG1hZGUgYnkgeW91OiBJ
Z25vcmUgdGhpcyBtZXNzYWdlLiAgDQpUaGUgdHJhbnNhY3Rpb24gd2lsbCBjbGVhciBhbmQgc2hv
dyB1cCBpbiB5b3VyIGFjY291bnQgd2l0aGluIDI0IGhvdXJzLiBJZiAgDQp0aGlzIHB1cmNoYXNl
IHdhcyBOT1QgbWFkZSBieSB5b3U6IENhbGwgUGF5UGFsIFN1cHBvcnQgYXMgc29vbiBhcyBwb3Nz
aWJsZSAgDQphdCArMSA4NDMtNDQ2LTA1MDYgZm9yIGltbWVkaWF0ZSB2ZXJpZmljYXRpb24gYW5k
IGFjY291bnQgcHJvdGVjdGlvbi4gWW91ciAgDQphY2NvdW50IHNhZmV0eSBpcyBvdXIgdG9wIGNv
bmNlcm4sIGFuZCB3ZSBhcHByZWNpYXRlIHlvdXIgY29vcGVyYXRpb24uICANClRoYW5rcywgUGF5
UGFsIFN1cHBvcnQgVGVhbSArMSA4NDMtNDQ2LTA1MDYgS2luZGx5IGRvIG5vdCByZXBseSB0byB0
aGlzICANCm1lc3NhZ2UsIGFzIHRoaXMgYWRkcmVzcyBpcyBub3QgYWN0aXZlbHkgbW9uaXRvcmVk
LiBzZXJ2aWNlQHBheXBhbC5jb20gTm8gIA0KbG9uZ2VyIHdhbnQgdG8gcmVjZWl2ZSB0aGVzZSBl
bWFpbHM/IFVuc3Vic2NyaWJlIMKpIDIwMjYgc2VydmljZUBwYXlwYWwuY29tDQoNCkZpbmFsIHJl
bWluZGVyDQpkaWpvdXMgMTUgb2N0LiAyMDI2IOKLhSAxMGFtIOKAkyAxMWFtDQpIb3JhIGTigJlF
dXJvcGEgY2VudHJhbCAtIE1hZHJpZA0KDQoNCg0KT3JnYW5pdHphZG9yDQpNQVJDIFJPUw0KMTIw
NThzdHVAaWVzcmVpZW5qYXVtZS5ldQ0KDQo=
--0000000000006ba520065da610fa
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-microsoft-com:office:offi=
ce">
t=3D"text/html; charset=3DUTF-8">
=3Ddevice-width,initial-scale=3D1">
ight dark">
=20
=20
=20
=20
/InformAction">
emtype=3D"http://schema.org/EmailMessage">
ntent=3D"MARC ROS: Dear Valued Customer, PayPal has observed activity that =
doesn't match your usual usage patterns on your account. Our fraud prev=
ention system recently logged a $292.95 PayPal purchase attempt at an Apple=
Store location in Massachusetts (MA). If this purchase was made by you: Ig=
nore this message. The transaction will clear and show up in your account w=
ithin 24 hours. If this purchase was NOT made by you: Call PayPal Support a=
s soon as possible at +1 843-446-0506 for immediate verification and accoun=
t protection. Your account safety is our top concern, and we appreciate you=
r cooperation. Thanks, PayPal Support Team +1 843-446-0506 Kindly do not re=
ply to this message, as this address is not actively monitored. service@pay=
pal.com No longer want to receive these emails? Unsubscribe =C2=A9 2026 ser=
vice@paypal.com"/>
tp://schema.org/Event">
ema.org/EventScheduled"/>
"http://schema.org/Organization">
Calendar"/>
peto8f071snctc3ujv8u5h"/>
r: #fff; line-height: 1px; height: 0; max-height: 0; width: 0; max-width: 0=
; opacity: 0; overflow: hidden;" itemprop=3D"name">Final reminder
an aria-hidden=3D"true">
80000Z">
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Mon, 12 Oct 2026 11:41:41 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))
(envelope-from
id 1xGK1S-00000000HNN-2qQG
for dave@doctor.nl2k.ab.ca;
Mon, 12 Oct 2026 11:41:14 -0600
Resent-From: The Doctor
Resent-Date: Mon, 12 Oct 2026 11:41:14 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-ed1-f71.google.com ([209.85.208.71]:53369)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.100.1 (FreeBSD))
(envelope-from <12058stu@iesreienjaume.eu>)
id 1xGHe4-00000000J6j-3u7O
for doctor@doctor.nl2k.ab.ca;
Mon, 12 Oct 2026 09:09:07 -0600
Received: by mail-ed1-f71.google.com with SMTP id 4fb4d7f45d1cf-6b1c285faebso970043a12.2
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=google.com; s=20251104; t=1791817682; x=1792422482; darn=doctor.nl2k.ab.ca;
h=content-type:from:subject:date:message-id:sender:reply-to
:mime-version:from:to:cc:subject:date:message-id:reply-to
:content-type;
bh=lv9ecGsyKrZ1sBfEwnhsytZgnlD9SGmCeBrWTHIplDk=;
b=DKG3xw0ayV6ddSnE4zDyULIyBS+iHqWjmBdXMzFvvkMVypPYvMxsU2mwdwC0/2Regk
bVy2O3j3SPkdZxJQscWXh99ddJ6ygKn9XD9jk6jJOgGyvDq+diCZYce3XfeOxs1ViJul
3zLlJVmg7zFzXmb3PMIc5q9O/2HtFej3SVc9cwudgRlmDZ8LdDO4+HXY9FFQZoUh9nl9
1I6h1Z3Qs8gpopKeMDKZB4vpe0g7+Oh83VBkZ9jLJK85ZdTr8TCs5w3MRvYm10nNauqN
oULlBmaU3XZJ0BihdX7AEnn5VQXA6Ey+2EfPMlGfKrIB6hSczOJpgfQKH/B4ZlD239EN
5Igw==
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=iesreienjaume-eu.20251104.gappssmtp.com; s=20251104; t=1791817682; x=1792422482; darn=doctor.nl2k.ab.ca;
h=content-type:from:subject:date:message-id:sender:reply-to
:mime-version:from:to:cc:subject:date:message-id:reply-to
:content-type;
bh=lv9ecGsyKrZ1sBfEwnhsytZgnlD9SGmCeBrWTHIplDk=;
b=tS1RXQbMYx0if5NpFkR6utiMTr3oYgGffNoc8F9ZTswywGihe2lhgokmI5bFxnpZHs
XJu0rHs+JtBpEyvBLoBl2gSHymtjrJUYkhHgzwcPSZLcWEAmHURlZYfosM0H96kLayyW
TugL5gowGsVevS17ZPVvnMM7Hyzv9cPooVkXQNgDUzQl1qnDAqZRSI0LfXKqtoKeiNiE
fJFyYjelAhQ+vfCEAEvlPF+kw/T20r/Mbja4oFNtpU2O/lUKu7PFhHLDdDA15hun2/54
5oNL6237b8rtRQjgRNSznNPGygtHgQ2MIWGd+2KhICEsApZaaGQbdIS4YDYQBK0ZIEmE
fAAw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20260707; t=1791817682; x=1792422482;
h=content-type:from:subject:date:message-id:sender:reply-to
:mime-version:x-gm-message-state:from:to:cc:subject:date:message-id
:reply-to:content-type;
bh=lv9ecGsyKrZ1sBfEwnhsytZgnlD9SGmCeBrWTHIplDk=;
b=fdVmcK/q83pmt9iFLCXX8kwQzyLWG3j+EYIiHSQG4kvJrydEbGjyHgUDj2IGLYuGs7
e+tb+AeQ2L0IfOSv1W+FnlfGXkZPwnbLs8iAuTbFHpCvh+NV5LqUxR26uZJEiD0Uv9/V
3+e2cBGGonaTuth0fSkJuwjrc07aR9/isRIx9lQHtDdgNI8E6ED9EulbQjQ5hR2nw3AO
VQppOk0utP7xiiyoFZbt8I624yKPWxApuOzJD5FdDPGLFY2PaFI1fe4Nc4GGvAWjZLlp
027tDH+7PuWD4h5WF3+PR1VBl90717HIYHHUXpoW8LHISTJIp8SHHTxvvqjyWFk2NBAS
h60Q==
X-Forwarded-Encrypted: i=1; AKwUvBwY496u/Go+TWBiY/T3s2K89dv0yQfx+3H0hD9OywyGG/bKKIEnLSooLas6Cszf/DnGOEUZfUo=@doctor.nl2k.ab.ca
X-Gm-Message-State: AFq9FYIR7MxzZSneFbcgzGk1tnGfB1pbKstee5si6oIOfGZ544ovAFCQ
njGaO9U79VxpXIf3qjd/q2itMmk4E5pnuNiH6qRh8lFVgPv1W8bigR3962d0AmBQtNyKt9zOgX5
DRUa+QSMM02ntOi8acV3MpdWYpiW918dxfPmFDLTbu2iMlA==
MIME-Version: 1.0
X-Received: by 2002:a05:6402:2807:b0:6ab:541:a685 with SMTP id
4fb4d7f45d1cf-6b17c252b8cmt8209093a12.17.1791817681432; Mon, 12 Oct 2026
08:08:01 -0700 (PDT)
Reply-To: MARC ROS <12058stu@iesreienjaume.eu>
Sender: Google Calendar
Message-ID:
Date: Mon, 12 Oct 2026 15:08:01 +0000
Subject: Final reminder
From: MARC ROS <12058stu@iesreienjaume.eu>
Content-Type: multipart/alternative; boundary="0000000000006ba520065da610fa"
X-Spam_score: 7.4
X-Spam_score_int: 74
X-Spam_bar: +++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Dear Valued Customer, PayPal has observed activity that doesn't
match your usual usage patterns on your account. Our fraud prevention system
recently logged a $292.95 PayPal purchase attempt at an App [...]
Content analysis details: (7.4 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[209.85.208.71 listed in will-spam-for-food.eu.org]
[209.85.208.71 listed in will-spam-for-food.eu.org]
[209.85.208.71 listed in will-spam-for-food.eu.org]
[209.85.208.71 listed in will-spam-for-food.eu.org]
[209.85.208.71 listed in will-spam-for-food.eu.org]
[209.85.208.71 listed in will-spam-for-food.eu.org]
[209.85.208.71 listed in will-spam-for-food.eu.org]
[209.85.208.71 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[209.85.208.71 listed in dnsbl.ahbl.org]
[209.85.208.71 listed in dnsbl.ahbl.org]
[209.85.208.71 listed in dnsbl.ahbl.org]
[209.85.208.71 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[209.85.208.71 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[209.85.208.71 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[209.85.208.71 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[209.85.208.71 listed in dnsbl.ahbl.org]
0.6 FROM_STARTS_WITH_NUMS From: starts with several numbers
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.208.71 listed in list.dnswl.org]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |
1.2 MISSING_HEADERS Missing To: header
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[209.85.208.71 listed in bl.score.senderscore.com]
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.208.71 listed in wl.mailspike.net]
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 HTML_MESSAGE BODY: HTML included in message
1.9 REPLYTO_WITHOUT_TO_CC No description available.
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars
0.6 LONG_INVISIBLE_TEXT Long block of hidden text - bayes poison?
Subject: {SPAM?} Final reminder
X-Antivirus: AVG (VPS 261012-0, 10/11/2026), Inbound message
X-Antivirus-Status: Clean
--0000000000006ba520065da610fa
Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes
Content-Transfer-Encoding: base64
RGVhciBWYWx1ZWQgQ3VzdG9tZXIsIFBheVBhbCBoYXMgb2JzZXJ2ZWQgYWN0aXZpdHkgdGhhdCBk
b2Vzbid0IG1hdGNoIHlvdXIgIA0KdXN1YWwgdXNhZ2UgcGF0dGVybnMgb24geW91ciBhY2NvdW50
LiBPdXIgZnJhdWQgcHJldmVudGlvbiBzeXN0ZW0gcmVjZW50bHkgIA0KbG9nZ2VkIGEgJDI5Mi45
NSBQYXlQYWwgcHVyY2hhc2UgYXR0ZW1wdCBhdCBhbiBBcHBsZSBTdG9yZSBsb2NhdGlvbiBpbiAg
DQpNYXNzYWNodXNldHRzIChNQSkuIElmIHRoaXMgcHVyY2hhc2Ugd2FzIG1hZGUgYnkgeW91OiBJ
Z25vcmUgdGhpcyBtZXNzYWdlLiAgDQpUaGUgdHJhbnNhY3Rpb24gd2lsbCBjbGVhciBhbmQgc2hv
dyB1cCBpbiB5b3VyIGFjY291bnQgd2l0aGluIDI0IGhvdXJzLiBJZiAgDQp0aGlzIHB1cmNoYXNl
IHdhcyBOT1QgbWFkZSBieSB5b3U6IENhbGwgUGF5UGFsIFN1cHBvcnQgYXMgc29vbiBhcyBwb3Nz
aWJsZSAgDQphdCArMSA4NDMtNDQ2LTA1MDYgZm9yIGltbWVkaWF0ZSB2ZXJpZmljYXRpb24gYW5k
IGFjY291bnQgcHJvdGVjdGlvbi4gWW91ciAgDQphY2NvdW50IHNhZmV0eSBpcyBvdXIgdG9wIGNv
bmNlcm4sIGFuZCB3ZSBhcHByZWNpYXRlIHlvdXIgY29vcGVyYXRpb24uICANClRoYW5rcywgUGF5
UGFsIFN1cHBvcnQgVGVhbSArMSA4NDMtNDQ2LTA1MDYgS2luZGx5IGRvIG5vdCByZXBseSB0byB0
aGlzICANCm1lc3NhZ2UsIGFzIHRoaXMgYWRkcmVzcyBpcyBub3QgYWN0aXZlbHkgbW9uaXRvcmVk
LiBzZXJ2aWNlQHBheXBhbC5jb20gTm8gIA0KbG9uZ2VyIHdhbnQgdG8gcmVjZWl2ZSB0aGVzZSBl
bWFpbHM/IFVuc3Vic2NyaWJlIMKpIDIwMjYgc2VydmljZUBwYXlwYWwuY29tDQoNCkZpbmFsIHJl
bWluZGVyDQpkaWpvdXMgMTUgb2N0LiAyMDI2IOKLhSAxMGFtIOKAkyAxMWFtDQpIb3JhIGTigJlF
dXJvcGEgY2VudHJhbCAtIE1hZHJpZA0KDQoNCg0KT3JnYW5pdHphZG9yDQpNQVJDIFJPUw0KMTIw
NThzdHVAaWVzcmVpZW5qYXVtZS5ldQ0KDQo=
--0000000000006ba520065da610fa
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-microsoft-com:office:offi=
ce">
t=3D"text/html; charset=3DUTF-8">
=3Ddevice-width,initial-scale=3D1">
ight dark">
=20
=20
=20
=20
/InformAction">
emtype=3D"http://schema.org/EmailMessage">
ntent=3D"MARC ROS: Dear Valued Customer, PayPal has observed activity that =
doesn't match your usual usage patterns on your account. Our fraud prev=
ention system recently logged a $292.95 PayPal purchase attempt at an Apple=
Store location in Massachusetts (MA). If this purchase was made by you: Ig=
nore this message. The transaction will clear and show up in your account w=
ithin 24 hours. If this purchase was NOT made by you: Call PayPal Support a=
s soon as possible at +1 843-446-0506 for immediate verification and accoun=
t protection. Your account safety is our top concern, and we appreciate you=
r cooperation. Thanks, PayPal Support Team +1 843-446-0506 Kindly do not re=
ply to this message, as this address is not actively monitored. service@pay=
pal.com No longer want to receive these emails? Unsubscribe =C2=A9 2026 ser=
vice@paypal.com"/>
tp://schema.org/Event">
ema.org/EventScheduled"/>
"http://schema.org/Organization">
Calendar"/>
peto8f071snctc3ujv8u5h"/>
r: #fff; line-height: 1px; height: 0; max-height: 0; width: 0; max-width: 0=
; opacity: 0; overflow: hidden;" itemprop=3D"name">Final reminder
an aria-hidden=3D"true">
80000Z">
body>
--0000000000006ba520065da610fa--