Microsoft Credential Phish Part 4

Posted by Dave Yadallee on
border-spacing: 0px; border-collapse: collapse; padding: 0px; vertical-alig=

n: top; width: 640px; background-color: #f3f2f1;" align=3D"center" border=

=3D"0">=0A=0A=0A
style=3D"margin: 0px; overflow-wrap: break-word; padding: 12px 0px; vertic=

al-align: top; line-height: 20px; border-collapse: collapse;">=0A

=3D"width: 640px; min-width: 640px;">=0A
; border-collapse: collapse; vertical-align: top; text-align: center; paddi=

ng: 0px; width: 640px; margin: 0px auto; float: none;" align=3D"center" bor=

der=3D"0">=0A=0A
-align: left;">=0A=0A

vertical-align: top; text-align: left; font-weight: 400; margin: 0px auto; =

line-height: 20px; width: auto; border-collapse: collapse;">=0A
=3D"border-spacing: 0px; border-collapse: collapse; padding: 0px; vertical-=

align: top; width: 592px;" border=3D"0">=0A=0A
0px; vertical-align: top;">=0A
ody>=0A

0px; vertical-align: top; text-align: left; font-weight: 400; margin: 0px;=

line-height: 20px; border-collapse: collapse;">=0A


ding:0;margin: 0; padding: 0px; margin-right: 0px; margin-left: 0px; color:=

#605e5c; line-height: 16px; font-size: 12px; overflow-wrap: normal;">
yle=3D"color: #605e5c; padding: 0px; line-height: 20px; display: inline-blo=

ck;" href=3D"https://privacy.microsoft.com/en-us/privacystatement" target=

=3D"_blank">Privacy Statement

=0A


in: 8px 0px 12px; padding: 0px; color: #605e5c; line-height: 16px; font-siz=

e: 12px; overflow-wrap: normal;">This email is generated through donnalaymo=

n's use of Microsoft Entra and may contain content that is controlled by yo=

ur IT admin.

=0A


ding: 0px; color: #605e5c; line-height: 16px; font-size: 12px; overflow-wra=

p: normal;">Microsoft Corporation, 
k; word-break: keep-all;">One Microsoft Way, Redmond, WA 98052

=

=0A


: #605e5c; line-height: 16px; font-size: 12px; overflow-wrap: normal;">Faci=

litated by

=0A
94px; max-width: 100%; clear: both; display: block; height: 20px;" title=3D=

"Microsoft" src=3D"https://mail.google.com/mail/u/0?ui=3D2&ik=3D3c67aec=

886&attid=3D0.1&permmsgid=3Dmsg-f:1858682771891726713&th=3D19cb=

5e2220bea979&view=3Dfimg&fur=3Dip&permmsgid=3Dmsg-f:18586827718=

91726713&sz=3Ds0-l75-ft&attbid=3DANGjdJ-fyn9nBfMesA78gP-k-rehvK8_6u=

QsTgq0lkw-ikOL6LqQvKK-4xxRwrbcbQsWEZZknpZlrbdeXQOaxxb7YvBTIEpYfuESxw-6gjjvH=

gd0fL5OD9Iy3MKmvag&disp=3Demb&zw" alt=3D"Microsoft" width=3D"94" he=

ight=3D"20" />
top; text-align: left; font-weight: 400; margin: 0px; line-height: 20px; wi=

dth: 0px; border-collapse: collapse; padding: 0px;"> 
=0A
=0A
=0A=0A=

=0A=0A=0A=0A=0A=0A=0A
=0A
iv>=0A=0A=0A=0A


padding: 0; font-family: arial; font-size: 10pt; overflow-wrap: break-word;=

"> 

=0A


: 10pt; overflow-wrap: break-word;">
-size: small;">



------=_20260303174335000000_78295--



Microsoft Credential Phish Part 2

Posted by Dave Yadallee on

il-gt" style=3D"color: #222222; font-family: 'Google Sans', Roboto, RobotoD=

raft, Helvetica, Arial, sans-serif; font-style: normal; font-variant-ligatu=

res: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: n=

ormal; orphans: 2; text-align: start; text-indent: 0px; text-transform: non=

e; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; white-spac=

e: normal; background-color: #ffffff; text-decoration-thickness: initial; t=

ext-decoration-style: initial; text-decoration-color: initial; direction: l=

tr; margin: 8px 0px 0px; padding: 0px; font-size: 0.875rem; overflow-x: hid=

den;">=0A

7830628" style=3D"direction: ltr; font-variant-numeric: normal; font-varian=

t-east-asian: normal; font-variant-alternates: normal; font-size-adjust: no=

ne; font-language-override: normal; font-kerning: auto; font-optical-sizing=

: auto; font-feature-settings: normal; font-variation-settings: normal; fon=

t-variant-position: normal; font-variant-emoji: normal; font-stretch: norma=

l; font-size: small; line-height: 1.5; font-family: Arial, Helvetica, sans-=

serif; overflow: auto hidden;">=0A
=0A

=3D"ltr">=0A
=0A
ollapse; padding: 0px; vertical-align: top; text-align: inherit; background=

-image: initial; background-position: initial; background-size: initial; ba=

ckground-repeat: initial; background-attachment: initial; background-origin=

: initial; background-clip: initial; width: 640px; margin: 0px auto;" align=

=3D"center" border=3D"0">=0A=0A
lign: top;">=0A=0A=0A

: 0px; vertical-align: top; color: #11100f; font-family: 'Segoe UI', Roboto=

, Arial, sans-serif; line-height: 20px; font-size: 14px; border-collapse: c=

ollapse;">=0A
; padding: 0px; vertical-align: top; width: 640px;" align=3D"center" border=

=3D"0">=0A=0A=0A
style=3D"margin: 0px; overflow-wrap: break-word; padding: 6px 0px 12px; ve=

rtical-align: top; line-height: 20px; border-collapse: collapse;">=0A

tyle=3D"width: 640px; min-width: 640px;">=0A

0px; border-collapse: collapse; vertical-align: top; text-align: center; p=

adding: 0px; width: 640px; margin: 0px auto; float: none;" align=3D"center"=

border=3D"0">=0A=0A
text-align: left;">=0A
padding: 0px; vertical-align: top;">=0A=0A

x 12px; vertical-align: top; text-align: left; font-weight: 400; margin: 0p=

x auto; line-height: 20px; width: 616px; border-collapse: collapse;">=0A
ble style=3D"border-spacing: 0px; border-collapse: collapse; padding: 0px; =

vertical-align: top; width: 592px;" border=3D"0">=0A

padding: 0px; vertical-align: top; text-align: left; font-weight: 400; mar=

gin: 0px; line-height: 20px; border-collapse: collapse;">
l-CToWUd" style=3D"outline: 0px; width: 188px; max-width: 100%; clear: both=

; display: block; height: auto;" src=3D"https://mail.google.com/mail/u/0?ui=

=3D2&ik=3D3c67aec886&attid=3D0.1&permmsgid=3Dmsg-f:185868277189=

1726713&th=3D19cb5e2220bea979&view=3Dfimg&fur=3Dip&permmsgi=

d=3Dmsg-f:1858682771891726713&sz=3Ds0-l75-ft&attbid=3DANGjdJ8ze8f9A=

7PfzmCZ5AraMKS_9hW5-f4zuPJXbsV7g_5Lw2nx6NKQV8c3gOc7GR8DEmk1M8BhLzFfUOxUOULm=

JjZaQmvDfElpLlwVRH-UeREL6dX_cRc-5gkjUeo&disp=3Demb&zw" alt=3D"Micro=

soft" width=3D"188" height=3D"40" />
word; vertical-align: top; text-align: left; font-weight: 400; margin: 0px;=

line-height: 20px; width: 0px; border-collapse: collapse; padding: 0px;">&=

nbsp;
=0A
=0A=

=0A=0A=0A=0A=0A=0A=0A=0A<=

/table>=0A
adding: 0px; vertical-align: top; text-align: inherit; background-image: in=

itial; background-position: initial; background-size: initial; background-r=

epeat: initial; background-attachment: initial; background-origin: initial;=

background-clip: initial; width: 640px; margin: 0px auto;" align=3D"center=

" border=3D"0">=0A=0A
">=0A=0A
tr>=0A=0A

tical-align: top; color: #11100f; font-family: 'Segoe UI', Roboto, Arial, s=

ans-serif; line-height: 20px; font-size: 14px; border-collapse: collapse;">=

=0A
0px; vertical-align: top; width: 640px;" align=3D"center" border=3D"0">=0A=

=0A=0A=0A=0A=0A

margin: 0px; overflow-wrap: break-word; padding: 6px 0px 12px; vertical-ali=

gn: top; line-height: 20px; border-collapse: collapse;">=0A

dth: 640px; min-width: 640px;">=0A
er-collapse: collapse; vertical-align: top; text-align: center; padding: 0p=

x; width: 640px; margin: 0px auto; float: none;" align=3D"center" border=3D=

"0">=0A=0A
: left;">=0A
ody>=0A

rtical-align: top; text-align: left; font-weight: 400; margin: 0px auto; li=

ne-height: 20px; width: 616px; border-collapse: collapse;">=0A
=3D"color: #000000; font-family: Arial, Helvetica, sans-serif; font-size: s=

mall; background-color: rgba(0, 0, 0, 0); border-collapse: collapse; border=

-color: #000000;" border=3D"0" cellspacing=3D"0" cellpadding=3D"0" width=3D=

"100%">=0A
#000000;">=0A
: #000000;">=0A=0A=0A
=3D"background-color: rgba(0, 0, 0, 0); border-color: #000000;">=0A=0A=0A
ackground-color: rgba(0, 0, 0, 0); border-color: #000000;">=0A=0A=0A
; border-color: #000000;">=0A=0A=0A
a(0, 0, 0, 0); border-color: #000000;">=0A=0A=0A=0A

ze: 14px; line-height: 22px; font-family: sqmarket, 'helvetica neue', helve=

tica, sans-serif; padding: 0px 0px 16px; background-color: rgba(0, 0, 0, 0)=

; border-color: #5f6a7c; color: #5f6a7c;">Hello,

e=3D"margin: 0px; border-collapse: collapse; font-size: 14px; line-height: =

22px; font-family: sqmarket, 'helvetica neue', helvetica, sans-serif; paddi=

ng: 0px 0px 16px; background-color: rgba(0, 0, 0, 0); border-color: #5f6a7c=

; color: #5f6a7c;">Your password has expired.

margin: 0px; border-collapse: collapse; font-size: 14px; line-height: 22px;=

font-family: sqmarket, 'helvetica neue', helvetica, sans-serif; padding: 0=

px 0px 16px; background-color: rgba(0, 0, 0, 0); border-color: #5f6a7c; col=

or: #5f6a7c;">You will need to reset your password before logging in to&nbs=

p;Microsoft.

lapse; font-size: 14px; line-height: 22px; font-family: sqmarket, 'helvetic=

a neue', helvetica, sans-serif; padding: 0px 0px 16px; background-color: rg=

ba(0, 0, 0, 0); border-color: #5f6a7c; color: #5f6a7c;">=0A

Microsoft Credential Phish Part 3

Posted by Dave Yadallee on
border-collapse: collapse; width: inherit; background-color: rgba(0, 0, 0, =

0); border-color: #5f6a7c;" border=3D"0" cellspacing=3D"0" cellpadding=3D"0=

">=0A

a7c;">=0A
6a7c;">=0A=0A=

=0A=0A

olor: rgba(0, 0, 0, 0); border-color: #5f6a7c;">=0A
ollapse: collapse; background-color: rgba(0, 0, 0, 0); border-color: #5f6a7=

c;" border=3D"0" cellspacing=3D"0" cellpadding=3D"0">=0A
kground-color: rgba(0, 0, 0, 0); border-color: #5f6a7c;">=0A
ckground-color: rgba(0, 0, 0, 0); border-color: #5f6a7c;">=0A=0A=0A=0A

argin: 0px; border-collapse: collapse; text-align: center; font-family: sqm=

arket-bold, helvetica, sans-serif; font-weight: bold; border-radius: 4px; f=

ont-size: 11px; line-height: 15px; text-transform: uppercase; letter-spacin=

g: 1px; background-color: #006aff; border-color: #5f6a7c;" align=3D"center"=

bgcolor=3D"#006AFF">
y: inline-block; padding: 13px 28px; border: 1px solid #006aff; background-=

color: rgba(0, 0, 0, 0);" href=3D"https://edureviews.com/l/" target=3D"_bla=

nk">UPDATE PASSWORD
=0A
=0A

collapse: collapse; font-size: 14px; line-height: 22px; font-family: sqmark=

et, 'helvetica neue', helvetica, sans-serif; padding: 0px 0px 16px; backgro=

und-color: rgba(0, 0, 0, 0); border-color: #5f6a7c; color: #5f6a7c;">Visit =

the outlook Center for more information on 
6a7c; background-color: rgba(0, 0, 0, 0); border-color: #5f6a7c;" href=3D"h=

ttps://edureviews.com/l/" target=3D"_blank">
: rgba(0, 0, 0, 0); border-color: #27a6e1; color: #27a6e1;">resetting your =

password.
=0A
=0A
=0A
=0A
=0A
lapse: collapse; padding: 0px; vertical-align: top; text-align: inherit; ba=

ckground-image: initial; background-position: initial; background-size: ini=

tial; background-repeat: initial; background-attachment: initial; backgroun=

d-origin: initial; background-clip: initial; width: 640px; margin: 0px auto=

;" align=3D"center" border=3D"0">=0A=0A
rtical-align: top;">=0A=0A
ody>=0A

padding: 0px; vertical-align: top; color: #11100f; font-family: 'Segoe UI'=

, Roboto, Arial, sans-serif; line-height: 20px; font-size: 14px; border-col=

lapse: collapse;">=0A
collapse; padding: 0px; vertical-align: top; width: 640px;" align=3D"center=

" border=3D"0">=0A=0A
">=0A=0A=0A=0A

12px; vertical-align: top; line-height: 20px; border-collapse: collapse;">=

=0A
=0A
-spacing: 0px; border-collapse: collapse; vertical-align: top; text-align: =

center; padding: 0px; width: 640px; margin: 0px auto; float: none;" align=

=3D"center" border=3D"0">=0A=0A
lign: top; text-align: left;">=0A

ng: 12px 24px; vertical-align: top; text-align: left; font-weight: 400; mar=

gin: 0px auto; line-height: 20px; width: 616px; border-collapse: collapse;"=

>=0A
: 0px; vertical-align: top; width: 592px;" border=3D"0">=0A=0A
yle=3D"padding: 0px; vertical-align: top;">=0A=0A<=

/table>=0A=0A=0A

k-word; padding: 0px; vertical-align: top; text-align: left; font-weight: 4=

00; margin: 0px; line-height: 20px; border-collapse: collapse;">=0A


=3D"margin:0;padding:0;margin: 0; padding: 0px; margin-right: 0px; margin-l=

eft: 0px; line-height: 22px; font-size: 16px; overflow-wrap: normal;">
ng>Do not allow users to grant consent to unreliable applications<=

/p>=0A


t-align: left; font-weight: 400; margin: 0px; line-height: 20px; width: 0px=

; border-collapse: collapse; padding: 0px;"> 
=0A
: 0px; border-collapse: collapse; vertical-align: top; text-align: center; =

padding: 0px; width: 640px; margin: 0px auto; float: none;" align=3D"center=

" border=3D"0">=0A=0A
text-align: left;">=0A=0A

4px; vertical-align: top; text-align: left; font-weight: 400; margin: 0px a=

uto; line-height: 20px; width: 616px; border-collapse: collapse;"> 
h>
=0A
-collapse: collapse; vertical-align: top; text-align: center; padding: 0px;=

width: 640px; margin: 0px auto; float: none;" align=3D"center" border=3D"0=

">=0A=0A
left;">=0A=0A

-align: top; text-align: left; font-weight: 400; margin: 0px auto; line-hei=

ght: 20px; width: 616px; border-collapse: collapse;">=0A
der-spacing: 0px; border-collapse: collapse; padding: 0px; vertical-align: =

top; width: 592px;" border=3D"0">=0A=0A
rtical-align: top;">=0A<=

/tbody>=0A

ertical-align: top; text-align: left; font-weight: 400; margin: 0px; line-h=

eight: 20px; border-collapse: collapse;">=0A


margin: 0; padding: 0px; margin-right: 0px; margin-left: 0px; line-height: =

22px; font-size: 16px; overflow-wrap: normal;">To stop getting notification=

s for Microsoft Entra recommendations, see 
text-decoration-line: none; padding: 0px; line-height: 20px; margin: inher=

it;" href=3D"https://edureviews.com/l/" target=3D"_blank">
xt-decoration: underline;">how to update your email notification settings
span>.

=0A
n: top; text-align: left; font-weight: 400; margin: 0px; line-height: 20px;=

width: 0px; border-collapse: collapse; padding: 0px;"> 
=0A
=0A=0A=0A
tr>=0A
=0A
=0A
yle=3D"border-spacing: 0px; border-collapse: collapse; padding: 0px; vertic=

al-align: top; text-align: inherit; background-image: initial; background-p=

osition: initial; background-size: initial; background-repeat: initial; bac=

kground-attachment: initial; background-origin: initial; background-clip: i=

nitial; width: 640px; margin: 0px auto;" align=3D"center" border=3D"0">=0A<=

tbody>=0A=0A=0A=0A
a(0, 0, 0, 0); border-color: #000000;">=0A=0A=0A=0A

argin: 0px; overflow-wrap: break-word; padding: 0px; vertical-align: top; c=

olor: #11100f; font-family: 'Segoe UI', Roboto, Arial, sans-serif; line-hei=

ght: 20px; font-size: 14px; border-collapse: collapse;">=0A

Microsoft Credential Phish Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 03 Mar 2026 21:31:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vxdsf-000000002i7-1k4v

for dave@doctor.nl2k.ab.ca;

Tue, 03 Mar 2026 21:30:41 -0700

Resent-From: The Doctor

Resent-Date: Tue, 3 Mar 2026 21:30:41 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from smtp120.iad3a.emailsrvr.com ([173.203.187.120]:53042)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vxZPd-00000000LP2-1ZQi

for games@nl2k.ab.ca;

Tue, 03 Mar 2026 16:44:36 -0700

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=g001.emailsrvr.com;

s=feedback; t=1772581416;

bh=gDvWnPQMJnvWmUJ2bNnL7JZflmVsjDHg+MviEERiT8E=;

h=Date:Subject:From:From;

b=oByoqXAh0tG0uU2r23svNjFqmEBbhz+QEPg6m7Zj4v4edlkMLt/i5hc6DTAx375Pf

s5DcXTbPyTFQKMhsnuJAjd6OXof5lEcOXVwDDdrWOx9puOmg+Epwekhp2ElKLltRQU

Z70qqT1sNAMu8f91zFam7ZO8VrWHPrGtB5peb8FM=

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=reagan.com;

s=20161101; t=1772581416;

bh=gDvWnPQMJnvWmUJ2bNnL7JZflmVsjDHg+MviEERiT8E=;

h=Date:Subject:From:From;

b=YlU/aQGrBX5WW5Zfn2lWLMcBlqT2UcpzwspTakFi7t9NhvPYgzYBnviyReiEgjzXu

D6ctl9jrQNdkVO2ARf1YfbJ7H5ElXfbDC2dFHBiRhCLdtMA96gYATEGytpZ/Qog/Wj

p93i/Ysh/yzQDvN8eFGgpeeexvMb92Lbw3qAW1Rk=

Received: from app7.wa-webapps.iad3a (relay-webapps.rsapps.net [172.27.255.140])

by smtp16.relay.iad3a.emailsrvr.com (SMTP Server) with ESMTP id 17F056352;

Tue, 3 Mar 2026 18:43:36 -0500 (EST)

Received: from reagan.com (localhost.localdomain [127.0.0.1])

by app7.wa-webapps.iad3a (Postfix) with ESMTP id E17616003F;

Tue, 3 Mar 2026 18:43:35 -0500 (EST)

Received: by webmail.reagan.com

(Authenticated sender: rickshawn99980@reagan.com, from: rickshawn99980@reagan.com)

with HTTP; Tue, 3 Mar 2026 17:43:35 -0600 (CST)

X-Auth-ID: rickshawn99980@reagan.com

Date: Tue, 3 Mar 2026 17:43:35 -0600 (CST)

Subject: CANCELLATION OF ACCOUNT***FINAL WARNING

From: "Outlook"

Reply-To: nj@ccc.me

MIME-Version: 1.0

Content-Type: multipart/alternative;boundary="----=_20260303174335000000_78295"

Importance: Normal

X-Priority: 3 (Normal)

X-Type: html

X-Client-IP: 149.22.80.60

Message-ID: <1772581415.917228582@webmail.reagan.com>

X-Mailer: webmail/19.0.28-RC

X-Classification-ID: 84967e7c-9b35-4110-8146-b6175fc564ec-1-1

X-Spam_score: 24.8

X-Spam_score_int: 248

X-Spam_bar: ++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hello, Your password has expired. You will need to reset

your password before logging in to Microsoft. [ UPDATE PASSWORD ]( https://edureviews.com/l/

) Visit the outlook Center for more information on [ resetting your password

]( https://edureviews.com/l/ ).



Content analysis details: (24.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[173.203.187.120 listed in will-spam-for-food.eu.org]

[173.203.187.120 listed in will-spam-for-food.eu.org]

[173.203.187.120 listed in will-spam-for-food.eu.org]

[173.203.187.120 listed in will-spam-for-food.eu.org]

[173.203.187.120 listed in will-spam-for-food.eu.org]

[173.203.187.120 listed in will-spam-for-food.eu.org]

[173.203.187.120 listed in will-spam-for-food.eu.org]

[173.203.187.120 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[173.203.187.120 listed in dnsbl.ahbl.org]

[173.203.187.120 listed in dnsbl.ahbl.org]

[173.203.187.120 listed in dnsbl.ahbl.org]

[173.203.187.120 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[173.203.187.120 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[173.203.187.120 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[173.203.187.120 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[173.203.187.120 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[173.203.187.120 listed in list.dnswl.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[173.203.187.120 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

15 GR_DOMAIN_EMASRV1 Received contains spammer id (emasrv)

1.6 SUBJ_ALL_CAPS Subject is all capitals

1.2 MISSING_HEADERS Missing To: header

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.9 REPLYTO_WITHOUT_TO_CC No description available.

Subject: {SPAM?} CANCELLATION OF ACCOUNT***FINAL WARNING



------=_20260303174335000000_78295

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



=0A=0A=0A=0A=0A=0A=0A=0A=0A=0A=0A=0A=0A=0A =0A=0A=0A=0A=0A=0A=0A=0A=0AHello=

,=0AYour password has expired.=0AYou will need to reset your password befor=

e logging in to Microsoft.=0A=0A=0A=0A=0A[ UPDATE PASSWORD ]( https://edure=

views.com/l/ )=0AVisit the outlook Center for more information on [ resetti=

ng your password ]( https://edureviews.com/l/ ).=0A=0A=0A=0A=0A=0A=0A=0A=0A=

=0ADo not allow users to grant consent to unreliable applications =0A=0A =

=0A=0A=0A=0A=0ATo stop getting notifications for Microsoft Entra recommenda=

tions, see [ how to update your email notification settings ]( https://edur=

eviews.com/l/ ). =0A=0A=0A=0A=0A=0A=0A=0A=0A=0A[ Privacy Statement ]( https=

://privacy.microsoft.com/en-us/privacystatement )=0AThis email is generated=

through donnalaymon's use of Microsoft Entra and may contain content that =

is controlled by your IT admin.=0AMicrosoft Corporation, One Microsoft Way,=

Redmond, WA 98052=0AFacilitated by =0A =0A

------=_20260303174335000000_78295

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable

Microsoft Credential Phish Part 3

Posted by Dave Yadallee on
border-collapse: collapse; width: inherit; background-color: rgba(0, 0, 0, =

0); border-color: #5f6a7c;" border=3D"0" cellspacing=3D"0" cellpadding=3D"0=

">=0A

a7c;">=0A
6a7c;">=0A=0A=

=0A=0A

olor: rgba(0, 0, 0, 0); border-color: #5f6a7c;">=0A
ollapse: collapse; background-color: rgba(0, 0, 0, 0); border-color: #5f6a7=

c;" border=3D"0" cellspacing=3D"0" cellpadding=3D"0">=0A
kground-color: rgba(0, 0, 0, 0); border-color: #5f6a7c;">=0A
ckground-color: rgba(0, 0, 0, 0); border-color: #5f6a7c;">=0A=0A=0A=0A

argin: 0px; border-collapse: collapse; text-align: center; font-family: sqm=

arket-bold, helvetica, sans-serif; font-weight: bold; border-radius: 4px; f=

ont-size: 11px; line-height: 15px; text-transform: uppercase; letter-spacin=

g: 1px; background-color: #006aff; border-color: #5f6a7c;" align=3D"center"=

bgcolor=3D"#006AFF">
y: inline-block; padding: 13px 28px; border: 1px solid #006aff; background-=

color: rgba(0, 0, 0, 0);" href=3D"https://edureviews.com/l/" target=3D"_bla=

nk">UPDATE PASSWORD
=0A
=0A

collapse: collapse; font-size: 14px; line-height: 22px; font-family: sqmark=

et, 'helvetica neue', helvetica, sans-serif; padding: 0px 0px 16px; backgro=

und-color: rgba(0, 0, 0, 0); border-color: #5f6a7c; color: #5f6a7c;">Visit =

the outlook Center for more information on 
6a7c; background-color: rgba(0, 0, 0, 0); border-color: #5f6a7c;" href=3D"h=

ttps://edureviews.com/l/" target=3D"_blank">
: rgba(0, 0, 0, 0); border-color: #27a6e1; color: #27a6e1;">resetting your =

password.
=0A
=0A
=0A=0A=0A=0A=0A=0A
tr>=0A=0A=0A
lapse: collapse; padding: 0px; vertical-align: top; text-align: inherit; ba=

ckground-image: initial; background-position: initial; background-size: ini=

tial; background-repeat: initial; background-attachment: initial; backgroun=

d-origin: initial; background-clip: initial; width: 640px; margin: 0px auto=

;" align=3D"center" border=3D"0">=0A=0A
rtical-align: top;">=0A=0A=0A=0A

padding: 0px; vertical-align: top; color: #11100f; font-family: 'Segoe UI'=

, Roboto, Arial, sans-serif; line-height: 20px; font-size: 14px; border-col=

lapse: collapse;">=0A
collapse; padding: 0px; vertical-align: top; width: 640px;" align=3D"center=

" border=3D"0">=0A=0A
">=0A=0A=0A=0A

12px; vertical-align: top; line-height: 20px; border-collapse: collapse;">=

=0A
=0A
-spacing: 0px; border-collapse: collapse; vertical-align: top; text-align: =

center; padding: 0px; width: 640px; margin: 0px auto; float: none;" align=

=3D"center" border=3D"0">=0A=0A
lign: top; text-align: left;">=0A

ng: 12px 24px; vertical-align: top; text-align: left; font-weight: 400; mar=

gin: 0px auto; line-height: 20px; width: 616px; border-collapse: collapse;"=

>=0A
: 0px; vertical-align: top; width: 592px;" border=3D"0">=0A=0A
yle=3D"padding: 0px; vertical-align: top;">=0A=0A<=

/table>=0A=0A=0A

k-word; padding: 0px; vertical-align: top; text-align: left; font-weight: 4=

00; margin: 0px; line-height: 20px; border-collapse: collapse;">=0A


=3D"margin:0;padding:0;margin: 0; padding: 0px; margin-right: 0px; margin-l=

eft: 0px; line-height: 22px; font-size: 16px; overflow-wrap: normal;">
ng>Do not allow users to grant consent to unreliable applications<=

/p>=0A


t-align: left; font-weight: 400; margin: 0px; line-height: 20px; width: 0px=

; border-collapse: collapse; padding: 0px;"> 
=0A
: 0px; border-collapse: collapse; vertical-align: top; text-align: center; =

padding: 0px; width: 640px; margin: 0px auto; float: none;" align=3D"center=

" border=3D"0">=0A=0A
text-align: left;">=0A=0A

4px; vertical-align: top; text-align: left; font-weight: 400; margin: 0px a=

uto; line-height: 20px; width: 616px; border-collapse: collapse;"> 
h>
=0A
-collapse: collapse; vertical-align: top; text-align: center; padding: 0px;=

width: 640px; margin: 0px auto; float: none;" align=3D"center" border=3D"0=

">=0A=0A
left;">=0A=0A

-align: top; text-align: left; font-weight: 400; margin: 0px auto; line-hei=

ght: 20px; width: 616px; border-collapse: collapse;">=0A
der-spacing: 0px; border-collapse: collapse; padding: 0px; vertical-align: =

top; width: 592px;" border=3D"0">=0A=0A
rtical-align: top;">=0A<=

/tbody>=0A

ertical-align: top; text-align: left; font-weight: 400; margin: 0px; line-h=

eight: 20px; border-collapse: collapse;">=0A


margin: 0; padding: 0px; margin-right: 0px; margin-left: 0px; line-height: =

22px; font-size: 16px; overflow-wrap: normal;">To stop getting notification=

s for Microsoft Entra recommendations, see 
text-decoration-line: none; padding: 0px; line-height: 20px; margin: inher=

it;" href=3D"https://edureviews.com/l/" target=3D"_blank">
xt-decoration: underline;">how to update your email notification settings
span>.

=0A
n: top; text-align: left; font-weight: 400; margin: 0px; line-height: 20px;=

width: 0px; border-collapse: collapse; padding: 0px;"> 
=0A
=0A=0A=0A
tr>=0A
=0A
=0A
yle=3D"border-spacing: 0px; border-collapse: collapse; padding: 0px; vertic=

al-align: top; text-align: inherit; background-image: initial; background-p=

osition: initial; background-size: initial; background-repeat: initial; bac=

kground-attachment: initial; background-origin: initial; background-clip: i=

nitial; width: 640px; margin: 0px auto;" align=3D"center" border=3D"0">=0A<=

tbody>=0A=0A=0A=

=0A=0A

argin: 0px; overflow-wrap: break-word; padding: 0px; vertical-align: top; c=

olor: #11100f; font-family: 'Segoe UI', Roboto, Arial, sans-serif; line-hei=

ght: 20px; font-size: 14px; border-collapse: collapse;">=0A

Microsoft Credential Phish Part 4

Posted by Dave Yadallee on
border-spacing: 0px; border-collapse: collapse; padding: 0px; vertical-alig=

n: top; width: 640px; background-color: #f3f2f1;" align=3D"center" border=

=3D"0">=0A
=0A=0A
style=3D"margin: 0px; overflow-wrap: break-word; padding: 12px 0px; vertic=

al-align: top; line-height: 20px; border-collapse: collapse;">=0A

=3D"width: 640px; min-width: 640px;">=0A

; border-collapse: collapse; vertical-align: top; text-align: center; paddi=

ng: 0px; width: 640px; margin: 0px auto; float: none;" align=3D"center" bor=

der=3D"0">=0A=0A
-align: left;">=0A=0A

vertical-align: top; text-align: left; font-weight: 400; margin: 0px auto; =

line-height: 20px; width: auto; border-collapse: collapse;">=0A
=3D"border-spacing: 0px; border-collapse: collapse; padding: 0px; vertical-=

align: top; width: 592px;" border=3D"0">=0A=0A
0px; vertical-align: top;">=0A
ody>=0A

0px; vertical-align: top; text-align: left; font-weight: 400; margin: 0px;=

line-height: 20px; border-collapse: collapse;">=0A


ding:0;margin: 0; padding: 0px; margin-right: 0px; margin-left: 0px; color:=

#605e5c; line-height: 16px; font-size: 12px; overflow-wrap: normal;">
yle=3D"color: #605e5c; padding: 0px; line-height: 20px; display: inline-blo=

ck;" href=3D"https://privacy.microsoft.com/en-us/privacystatement" target=

=3D"_blank">Privacy Statement

=0A


in: 8px 0px 12px; padding: 0px; color: #605e5c; line-height: 16px; font-siz=

e: 12px; overflow-wrap: normal;">This email is generated through donnalaymo=

n's use of Microsoft Entra and may contain content that is controlled by yo=

ur IT admin.

=0A


ding: 0px; color: #605e5c; line-height: 16px; font-size: 12px; overflow-wra=

p: normal;">Microsoft Corporation, 
k; word-break: keep-all;">One Microsoft Way, Redmond, WA 98052

=

=0A


: #605e5c; line-height: 16px; font-size: 12px; overflow-wrap: normal;">Faci=

litated by

=0A
94px; max-width: 100%; clear: both; display: block; height: 20px;" title=3D=

"Microsoft" src=3D"https://mail.google.com/mail/u/0?ui=3D2&ik=3D3c67aec=

886&attid=3D0.1&permmsgid=3Dmsg-f:1858682771891726713&th=3D19cb=

5e2220bea979&view=3Dfimg&fur=3Dip&permmsgid=3Dmsg-f:18586827718=

91726713&sz=3Ds0-l75-ft&attbid=3DANGjdJ-fyn9nBfMesA78gP-k-rehvK8_6u=

QsTgq0lkw-ikOL6LqQvKK-4xxRwrbcbQsWEZZknpZlrbdeXQOaxxb7YvBTIEpYfuESxw-6gjjvH=

gd0fL5OD9Iy3MKmvag&disp=3Demb&zw" alt=3D"Microsoft" width=3D"94" he=

ight=3D"20" />
top; text-align: left; font-weight: 400; margin: 0px; line-height: 20px; wi=

dth: 0px; border-collapse: collapse; padding: 0px;"> 
=0A
=0A=0A
=0A
=0A
=0A
iv>=0A
=0A
=0A
=0A


padding: 0; font-family: arial; font-size: 10pt; overflow-wrap: break-word;=

"> 

=0A


: 10pt; overflow-wrap: break-word;">
-size: small;">



------=_20260303174335000000_78295--



Microsoft Credential Phish Part 2

Posted by Dave Yadallee on

il-gt" style=3D"color: #222222; font-family: 'Google Sans', Roboto, RobotoD=

raft, Helvetica, Arial, sans-serif; font-style: normal; font-variant-ligatu=

res: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: n=

ormal; orphans: 2; text-align: start; text-indent: 0px; text-transform: non=

e; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; white-spac=

e: normal; background-color: #ffffff; text-decoration-thickness: initial; t=

ext-decoration-style: initial; text-decoration-color: initial; direction: l=

tr; margin: 8px 0px 0px; padding: 0px; font-size: 0.875rem; overflow-x: hid=

den;">=0A

7830628" style=3D"direction: ltr; font-variant-numeric: normal; font-varian=

t-east-asian: normal; font-variant-alternates: normal; font-size-adjust: no=

ne; font-language-override: normal; font-kerning: auto; font-optical-sizing=

: auto; font-feature-settings: normal; font-variation-settings: normal; fon=

t-variant-position: normal; font-variant-emoji: normal; font-stretch: norma=

l; font-size: small; line-height: 1.5; font-family: Arial, Helvetica, sans-=

serif; overflow: auto hidden;">=0A
=0A

=3D"ltr">=0A
=0A
ollapse; padding: 0px; vertical-align: top; text-align: inherit; background=

-image: initial; background-position: initial; background-size: initial; ba=

ckground-repeat: initial; background-attachment: initial; background-origin=

: initial; background-clip: initial; width: 640px; margin: 0px auto;" align=

=3D"center" border=3D"0">=0A=0A
lign: top;">=0A=0A=0A

: 0px; vertical-align: top; color: #11100f; font-family: 'Segoe UI', Roboto=

, Arial, sans-serif; line-height: 20px; font-size: 14px; border-collapse: c=

ollapse;">=0A
; padding: 0px; vertical-align: top; width: 640px;" align=3D"center" border=

=3D"0">=0A=0A=0A
style=3D"margin: 0px; overflow-wrap: break-word; padding: 6px 0px 12px; ve=

rtical-align: top; line-height: 20px; border-collapse: collapse;">=0A

tyle=3D"width: 640px; min-width: 640px;">=0A

0px; border-collapse: collapse; vertical-align: top; text-align: center; p=

adding: 0px; width: 640px; margin: 0px auto; float: none;" align=3D"center"=

border=3D"0">=0A=0A
text-align: left;">=0A
padding: 0px; vertical-align: top;">=0A=0A

x 12px; vertical-align: top; text-align: left; font-weight: 400; margin: 0p=

x auto; line-height: 20px; width: 616px; border-collapse: collapse;">=0A
ble style=3D"border-spacing: 0px; border-collapse: collapse; padding: 0px; =

vertical-align: top; width: 592px;" border=3D"0">=0A

padding: 0px; vertical-align: top; text-align: left; font-weight: 400; mar=

gin: 0px; line-height: 20px; border-collapse: collapse;">
l-CToWUd" style=3D"outline: 0px; width: 188px; max-width: 100%; clear: both=

; display: block; height: auto;" src=3D"https://mail.google.com/mail/u/0?ui=

=3D2&ik=3D3c67aec886&attid=3D0.1&permmsgid=3Dmsg-f:185868277189=

1726713&th=3D19cb5e2220bea979&view=3Dfimg&fur=3Dip&permmsgi=

d=3Dmsg-f:1858682771891726713&sz=3Ds0-l75-ft&attbid=3DANGjdJ8ze8f9A=

7PfzmCZ5AraMKS_9hW5-f4zuPJXbsV7g_5Lw2nx6NKQV8c3gOc7GR8DEmk1M8BhLzFfUOxUOULm=

JjZaQmvDfElpLlwVRH-UeREL6dX_cRc-5gkjUeo&disp=3Demb&zw" alt=3D"Micro=

soft" width=3D"188" height=3D"40" />
word; vertical-align: top; text-align: left; font-weight: 400; margin: 0px;=

line-height: 20px; width: 0px; border-collapse: collapse; padding: 0px;">&=

nbsp;
=0A
=0A=

=0A=0A=0A=0A=0A=0A=0A=0A<=

/table>=0A
adding: 0px; vertical-align: top; text-align: inherit; background-image: in=

itial; background-position: initial; background-size: initial; background-r=

epeat: initial; background-attachment: initial; background-origin: initial;=

background-clip: initial; width: 640px; margin: 0px auto;" align=3D"center=

" border=3D"0">=0A=0A
">=0A=0A=0A
a(0, 0, 0, 0); border-color: #000000;">=0A=0A=0A=0A

tical-align: top; color: #11100f; font-family: 'Segoe UI', Roboto, Arial, s=

ans-serif; line-height: 20px; font-size: 14px; border-collapse: collapse;">=

=0A
0px; vertical-align: top; width: 640px;" align=3D"center" border=3D"0">=0A=

=0A=0A
a7c;">=0A
6a7c;">=0A=0A=

=0A=0A

margin: 0px; overflow-wrap: break-word; padding: 6px 0px 12px; vertical-ali=

gn: top; line-height: 20px; border-collapse: collapse;">=0A

dth: 640px; min-width: 640px;">=0A
er-collapse: collapse; vertical-align: top; text-align: center; padding: 0p=

x; width: 640px; margin: 0px auto; float: none;" align=3D"center" border=3D=

"0">=0A=0A
: left;">=0A=0A

rtical-align: top; text-align: left; font-weight: 400; margin: 0px auto; li=

ne-height: 20px; width: 616px; border-collapse: collapse;">=0A
=3D"color: #000000; font-family: Arial, Helvetica, sans-serif; font-size: s=

mall; background-color: rgba(0, 0, 0, 0); border-collapse: collapse; border=

-color: #000000;" border=3D"0" cellspacing=3D"0" cellpadding=3D"0" width=3D=

"100%">=0A
#000000;">=0A
: #000000;">=0A=0A=0A
=3D"background-color: rgba(0, 0, 0, 0); border-color: #000000;">=0A=0A=0A
ackground-color: rgba(0, 0, 0, 0); border-color: #000000;">=0A=0A=0A
; border-color: #000000;">=0A=0A=

=0A=0A

ze: 14px; line-height: 22px; font-family: sqmarket, 'helvetica neue', helve=

tica, sans-serif; padding: 0px 0px 16px; background-color: rgba(0, 0, 0, 0)=

; border-color: #5f6a7c; color: #5f6a7c;">Hello,

e=3D"margin: 0px; border-collapse: collapse; font-size: 14px; line-height: =

22px; font-family: sqmarket, 'helvetica neue', helvetica, sans-serif; paddi=

ng: 0px 0px 16px; background-color: rgba(0, 0, 0, 0); border-color: #5f6a7c=

; color: #5f6a7c;">Your password has expired.

margin: 0px; border-collapse: collapse; font-size: 14px; line-height: 22px;=

font-family: sqmarket, 'helvetica neue', helvetica, sans-serif; padding: 0=

px 0px 16px; background-color: rgba(0, 0, 0, 0); border-color: #5f6a7c; col=

or: #5f6a7c;">You will need to reset your password before logging in to&nbs=

p;Microsoft.

lapse; font-size: 14px; line-height: 22px; font-family: sqmarket, 'helvetic=

a neue', helvetica, sans-serif; padding: 0px 0px 16px; background-color: rg=

ba(0, 0, 0, 0); border-color: #5f6a7c; color: #5f6a7c;">=0A

Microsoft Credential Phish Part 4

Posted by Dave Yadallee on
border-spacing: 0px; border-collapse: collapse; padding: 0px; vertical-alig=

n: top; width: 640px; background-color: #f3f2f1;" align=3D"center" border=

=3D"0">=0A
=0A=0A
style=3D"margin: 0px; overflow-wrap: break-word; padding: 12px 0px; vertic=

al-align: top; line-height: 20px; border-collapse: collapse;">=0A

=3D"width: 640px; min-width: 640px;">=0A

; border-collapse: collapse; vertical-align: top; text-align: center; paddi=

ng: 0px; width: 640px; margin: 0px auto; float: none;" align=3D"center" bor=

der=3D"0">=0A=0A
-align: left;">=0A=0A

vertical-align: top; text-align: left; font-weight: 400; margin: 0px auto; =

line-height: 20px; width: auto; border-collapse: collapse;">=0A
=3D"border-spacing: 0px; border-collapse: collapse; padding: 0px; vertical-=

align: top; width: 592px;" border=3D"0">=0A=0A
0px; vertical-align: top;">=0A
ody>=0A

0px; vertical-align: top; text-align: left; font-weight: 400; margin: 0px;=

line-height: 20px; border-collapse: collapse;">=0A


ding:0;margin: 0; padding: 0px; margin-right: 0px; margin-left: 0px; color:=

#605e5c; line-height: 16px; font-size: 12px; overflow-wrap: normal;">
yle=3D"color: #605e5c; padding: 0px; line-height: 20px; display: inline-blo=

ck;" href=3D"https://privacy.microsoft.com/en-us/privacystatement" target=

=3D"_blank">Privacy Statement

=0A


in: 8px 0px 12px; padding: 0px; color: #605e5c; line-height: 16px; font-siz=

e: 12px; overflow-wrap: normal;">This email is generated through donnalaymo=

n's use of Microsoft Entra and may contain content that is controlled by yo=

ur IT admin.

=0A


ding: 0px; color: #605e5c; line-height: 16px; font-size: 12px; overflow-wra=

p: normal;">Microsoft Corporation, 
k; word-break: keep-all;">One Microsoft Way, Redmond, WA 98052

=

=0A


: #605e5c; line-height: 16px; font-size: 12px; overflow-wrap: normal;">Faci=

litated by

=0A
94px; max-width: 100%; clear: both; display: block; height: 20px;" title=3D=

"Microsoft" src=3D"https://mail.google.com/mail/u/0?ui=3D2&ik=3D3c67aec=

886&attid=3D0.1&permmsgid=3Dmsg-f:1858682771891726713&th=3D19cb=

5e2220bea979&view=3Dfimg&fur=3Dip&permmsgid=3Dmsg-f:18586827718=

91726713&sz=3Ds0-l75-ft&attbid=3DANGjdJ-fyn9nBfMesA78gP-k-rehvK8_6u=

QsTgq0lkw-ikOL6LqQvKK-4xxRwrbcbQsWEZZknpZlrbdeXQOaxxb7YvBTIEpYfuESxw-6gjjvH=

gd0fL5OD9Iy3MKmvag&disp=3Demb&zw" alt=3D"Microsoft" width=3D"94" he=

ight=3D"20" />
top; text-align: left; font-weight: 400; margin: 0px; line-height: 20px; wi=

dth: 0px; border-collapse: collapse; padding: 0px;"> 
=0A
=0A=0A
=0A=0A
=0A
=0A
iv>=0A=0A=0A=0A


padding: 0; font-family: arial; font-size: 10pt; overflow-wrap: break-word;=

"> 

=0A


: 10pt; overflow-wrap: break-word;">
-size: small;">



------=_20260303174335000000_78295--



Microsoft Credential Phish Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 03 Mar 2026 21:31:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vxdsb-000000002hw-3PYA

for dave@doctor.nl2k.ab.ca;

Tue, 03 Mar 2026 21:30:37 -0700

Resent-From: The Doctor

Resent-Date: Tue, 3 Mar 2026 21:30:37 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from smtp124.iad3a.emailsrvr.com ([173.203.187.124]:33122)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vxZPd-00000000LOy-1YjL

for sales@nk.ca;

Tue, 03 Mar 2026 16:44:39 -0700

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=g001.emailsrvr.com;

s=feedback; t=1772581416;

bh=gDvWnPQMJnvWmUJ2bNnL7JZflmVsjDHg+MviEERiT8E=;

h=Date:Subject:From:From;

b=oByoqXAh0tG0uU2r23svNjFqmEBbhz+QEPg6m7Zj4v4edlkMLt/i5hc6DTAx375Pf

s5DcXTbPyTFQKMhsnuJAjd6OXof5lEcOXVwDDdrWOx9puOmg+Epwekhp2ElKLltRQU

Z70qqT1sNAMu8f91zFam7ZO8VrWHPrGtB5peb8FM=

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=reagan.com;

s=20161101; t=1772581416;

bh=gDvWnPQMJnvWmUJ2bNnL7JZflmVsjDHg+MviEERiT8E=;

h=Date:Subject:From:From;

b=YlU/aQGrBX5WW5Zfn2lWLMcBlqT2UcpzwspTakFi7t9NhvPYgzYBnviyReiEgjzXu

D6ctl9jrQNdkVO2ARf1YfbJ7H5ElXfbDC2dFHBiRhCLdtMA96gYATEGytpZ/Qog/Wj

p93i/Ysh/yzQDvN8eFGgpeeexvMb92Lbw3qAW1Rk=

Received: from app7.wa-webapps.iad3a (relay-webapps.rsapps.net [172.27.255.140])

by smtp16.relay.iad3a.emailsrvr.com (SMTP Server) with ESMTP id 17F056352;

Tue, 3 Mar 2026 18:43:36 -0500 (EST)

Received: from reagan.com (localhost.localdomain [127.0.0.1])

by app7.wa-webapps.iad3a (Postfix) with ESMTP id E17616003F;

Tue, 3 Mar 2026 18:43:35 -0500 (EST)

Received: by webmail.reagan.com

(Authenticated sender: rickshawn99980@reagan.com, from: rickshawn99980@reagan.com)

with HTTP; Tue, 3 Mar 2026 17:43:35 -0600 (CST)

X-Auth-ID: rickshawn99980@reagan.com

Date: Tue, 3 Mar 2026 17:43:35 -0600 (CST)

Subject: CANCELLATION OF ACCOUNT***FINAL WARNING

From: "Outlook"

Reply-To: nj@ccc.me

MIME-Version: 1.0

Content-Type: multipart/alternative;boundary="----=_20260303174335000000_78295"

Importance: Normal

X-Priority: 3 (Normal)

X-Type: html

X-Client-IP: 149.22.80.60

Message-ID: <1772581415.917228582@webmail.reagan.com>

X-Mailer: webmail/19.0.28-RC

X-Classification-ID: 84967e7c-9b35-4110-8146-b6175fc564ec-1-1

X-Spam_score: 24.8

X-Spam_score_int: 248

X-Spam_bar: ++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hello, Your password has expired. You will need to reset

your password before logging in to Microsoft. [ UPDATE PASSWORD ]( https://edureviews.com/l/

) Visit the outlook Center for more information on [ resetting your password

]( https://edureviews.com/l/ ).



Content analysis details: (24.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[173.203.187.124 listed in will-spam-for-food.eu.org]

[173.203.187.124 listed in will-spam-for-food.eu.org]

[173.203.187.124 listed in will-spam-for-food.eu.org]

[173.203.187.124 listed in will-spam-for-food.eu.org]

[173.203.187.124 listed in will-spam-for-food.eu.org]

[173.203.187.124 listed in will-spam-for-food.eu.org]

[173.203.187.124 listed in will-spam-for-food.eu.org]

[173.203.187.124 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[173.203.187.124 listed in dnsbl.ahbl.org]

[173.203.187.124 listed in dnsbl.ahbl.org]

[173.203.187.124 listed in dnsbl.ahbl.org]

[173.203.187.124 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[173.203.187.124 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[173.203.187.124 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[173.203.187.124 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[173.203.187.124 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[173.203.187.124 listed in list.dnswl.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[173.203.187.124 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

15 GR_DOMAIN_EMASRV1 Received contains spammer id (emasrv)

1.6 SUBJ_ALL_CAPS Subject is all capitals

1.2 MISSING_HEADERS Missing To: header

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

1.9 REPLYTO_WITHOUT_TO_CC No description available.

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} CANCELLATION OF ACCOUNT***FINAL WARNING



------=_20260303174335000000_78295

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



=0A=0A=0A=0A=0A=0A=0A=0A=0A=0A=0A=0A=0A=0A =0A=0A=0A=0A=0A=0A=0A=0A=0AHello=

,=0AYour password has expired.=0AYou will need to reset your password befor=

e logging in to Microsoft.=0A=0A=0A=0A=0A[ UPDATE PASSWORD ]( https://edure=

views.com/l/ )=0AVisit the outlook Center for more information on [ resetti=

ng your password ]( https://edureviews.com/l/ ).=0A=0A=0A=0A=0A=0A=0A=0A=0A=

=0ADo not allow users to grant consent to unreliable applications =0A=0A =

=0A=0A=0A=0A=0ATo stop getting notifications for Microsoft Entra recommenda=

tions, see [ how to update your email notification settings ]( https://edur=

eviews.com/l/ ). =0A=0A=0A=0A=0A=0A=0A=0A=0A=0A[ Privacy Statement ]( https=

://privacy.microsoft.com/en-us/privacystatement )=0AThis email is generated=

through donnalaymon's use of Microsoft Entra and may contain content that =

is controlled by your IT admin.=0AMicrosoft Corporation, One Microsoft Way,=

Redmond, WA 98052=0AFacilitated by =0A =0A

------=_20260303174335000000_78295

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable

Microsoft Credential Phish Part 3

Posted by Dave Yadallee on
border-collapse: collapse; width: inherit; background-color: rgba(0, 0, 0, =

0); border-color: #5f6a7c;" border=3D"0" cellspacing=3D"0" cellpadding=3D"0=

">=0A

olor: rgba(0, 0, 0, 0); border-color: #5f6a7c;">=0A
ollapse: collapse; background-color: rgba(0, 0, 0, 0); border-color: #5f6a7=

c;" border=3D"0" cellspacing=3D"0" cellpadding=3D"0">=0A
kground-color: rgba(0, 0, 0, 0); border-color: #5f6a7c;">=0A
ckground-color: rgba(0, 0, 0, 0); border-color: #5f6a7c;">=0A=0A=0A=0A

argin: 0px; border-collapse: collapse; text-align: center; font-family: sqm=

arket-bold, helvetica, sans-serif; font-weight: bold; border-radius: 4px; f=

ont-size: 11px; line-height: 15px; text-transform: uppercase; letter-spacin=

g: 1px; background-color: #006aff; border-color: #5f6a7c;" align=3D"center"=

bgcolor=3D"#006AFF">
y: inline-block; padding: 13px 28px; border: 1px solid #006aff; background-=

color: rgba(0, 0, 0, 0);" href=3D"https://edureviews.com/l/" target=3D"_bla=

nk">UPDATE PASSWORD
=0A
=0A

collapse: collapse; font-size: 14px; line-height: 22px; font-family: sqmark=

et, 'helvetica neue', helvetica, sans-serif; padding: 0px 0px 16px; backgro=

und-color: rgba(0, 0, 0, 0); border-color: #5f6a7c; color: #5f6a7c;">Visit =

the outlook Center for more information on 
6a7c; background-color: rgba(0, 0, 0, 0); border-color: #5f6a7c;" href=3D"h=

ttps://edureviews.com/l/" target=3D"_blank">
: rgba(0, 0, 0, 0); border-color: #27a6e1; color: #27a6e1;">resetting your =

password.
=0A=0A
ody>=0A=0A
=0A=0A=0A=0A=0A=0A
tr>=0A=0A=0A
lapse: collapse; padding: 0px; vertical-align: top; text-align: inherit; ba=

ckground-image: initial; background-position: initial; background-size: ini=

tial; background-repeat: initial; background-attachment: initial; backgroun=

d-origin: initial; background-clip: initial; width: 640px; margin: 0px auto=

;" align=3D"center" border=3D"0">=0A=0A
rtical-align: top;">=0A=0A=0A=0A<=

/table>=0A

padding: 0px; vertical-align: top; color: #11100f; font-family: 'Segoe UI'=

, Roboto, Arial, sans-serif; line-height: 20px; font-size: 14px; border-col=

lapse: collapse;">=0A
collapse; padding: 0px; vertical-align: top; width: 640px;" align=3D"center=

" border=3D"0">=0A=0A
">=0A=0A=0A=0A

12px; vertical-align: top; line-height: 20px; border-collapse: collapse;">=

=0A
=0A
-spacing: 0px; border-collapse: collapse; vertical-align: top; text-align: =

center; padding: 0px; width: 640px; margin: 0px auto; float: none;" align=

=3D"center" border=3D"0">=0A=0A
lign: top; text-align: left;">=0A

ng: 12px 24px; vertical-align: top; text-align: left; font-weight: 400; mar=

gin: 0px auto; line-height: 20px; width: 616px; border-collapse: collapse;"=

>=0A
: 0px; vertical-align: top; width: 592px;" border=3D"0">=0A=0A
yle=3D"padding: 0px; vertical-align: top;">=0A=0A<=

/table>=0A=0A=0A

k-word; padding: 0px; vertical-align: top; text-align: left; font-weight: 4=

00; margin: 0px; line-height: 20px; border-collapse: collapse;">=0A


=3D"margin:0;padding:0;margin: 0; padding: 0px; margin-right: 0px; margin-l=

eft: 0px; line-height: 22px; font-size: 16px; overflow-wrap: normal;">
ng>Do not allow users to grant consent to unreliable applications<=

/p>=0A


t-align: left; font-weight: 400; margin: 0px; line-height: 20px; width: 0px=

; border-collapse: collapse; padding: 0px;"> 
=0A
: 0px; border-collapse: collapse; vertical-align: top; text-align: center; =

padding: 0px; width: 640px; margin: 0px auto; float: none;" align=3D"center=

" border=3D"0">=0A=0A
text-align: left;">=0A=0A

4px; vertical-align: top; text-align: left; font-weight: 400; margin: 0px a=

uto; line-height: 20px; width: 616px; border-collapse: collapse;"> 
h>
=0A
-collapse: collapse; vertical-align: top; text-align: center; padding: 0px;=

width: 640px; margin: 0px auto; float: none;" align=3D"center" border=3D"0=

">=0A=0A
left;">=0A=0A

-align: top; text-align: left; font-weight: 400; margin: 0px auto; line-hei=

ght: 20px; width: 616px; border-collapse: collapse;">=0A
der-spacing: 0px; border-collapse: collapse; padding: 0px; vertical-align: =

top; width: 592px;" border=3D"0">=0A=0A
rtical-align: top;">=0A<=

/tbody>=0A

ertical-align: top; text-align: left; font-weight: 400; margin: 0px; line-h=

eight: 20px; border-collapse: collapse;">=0A


margin: 0; padding: 0px; margin-right: 0px; margin-left: 0px; line-height: =

22px; font-size: 16px; overflow-wrap: normal;">To stop getting notification=

s for Microsoft Entra recommendations, see 
text-decoration-line: none; padding: 0px; line-height: 20px; margin: inher=

it;" href=3D"https://edureviews.com/l/" target=3D"_blank">
xt-decoration: underline;">how to update your email notification settings
span>.

=0A
n: top; text-align: left; font-weight: 400; margin: 0px; line-height: 20px;=

width: 0px; border-collapse: collapse; padding: 0px;"> 
=0A
=0A=0A=0A
tr>=0A
=0A
=0A
yle=3D"border-spacing: 0px; border-collapse: collapse; padding: 0px; vertic=

al-align: top; text-align: inherit; background-image: initial; background-p=

osition: initial; background-size: initial; background-repeat: initial; bac=

kground-attachment: initial; background-origin: initial; background-clip: i=

nitial; width: 640px; margin: 0px auto;" align=3D"center" border=3D"0">=0A<=

tbody>=0A=0A=0A=0A=0A

argin: 0px; overflow-wrap: break-word; padding: 0px; vertical-align: top; c=

olor: #11100f; font-family: 'Segoe UI', Roboto, Arial, sans-serif; line-hei=

ght: 20px; font-size: 14px; border-collapse: collapse;">=0A

Microsoft Credential Phish Part 2

Posted by Dave Yadallee on

il-gt" style=3D"color: #222222; font-family: 'Google Sans', Roboto, RobotoD=

raft, Helvetica, Arial, sans-serif; font-style: normal; font-variant-ligatu=

res: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: n=

ormal; orphans: 2; text-align: start; text-indent: 0px; text-transform: non=

e; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; white-spac=

e: normal; background-color: #ffffff; text-decoration-thickness: initial; t=

ext-decoration-style: initial; text-decoration-color: initial; direction: l=

tr; margin: 8px 0px 0px; padding: 0px; font-size: 0.875rem; overflow-x: hid=

den;">=0A

7830628" style=3D"direction: ltr; font-variant-numeric: normal; font-varian=

t-east-asian: normal; font-variant-alternates: normal; font-size-adjust: no=

ne; font-language-override: normal; font-kerning: auto; font-optical-sizing=

: auto; font-feature-settings: normal; font-variation-settings: normal; fon=

t-variant-position: normal; font-variant-emoji: normal; font-stretch: norma=

l; font-size: small; line-height: 1.5; font-family: Arial, Helvetica, sans-=

serif; overflow: auto hidden;">=0A
=0A

=3D"ltr">=0A
=0A

ollapse; padding: 0px; vertical-align: top; text-align: inherit; background=

-image: initial; background-position: initial; background-size: initial; ba=

ckground-repeat: initial; background-attachment: initial; background-origin=

: initial; background-clip: initial; width: 640px; margin: 0px auto;" align=

=3D"center" border=3D"0">=0A=0A
lign: top;">=0A=0A=0A

: 0px; vertical-align: top; color: #11100f; font-family: 'Segoe UI', Roboto=

, Arial, sans-serif; line-height: 20px; font-size: 14px; border-collapse: c=

ollapse;">=0A
; padding: 0px; vertical-align: top; width: 640px;" align=3D"center" border=

=3D"0">=0A=0A=0A
style=3D"margin: 0px; overflow-wrap: break-word; padding: 6px 0px 12px; ve=

rtical-align: top; line-height: 20px; border-collapse: collapse;">=0A

tyle=3D"width: 640px; min-width: 640px;">=0A

0px; border-collapse: collapse; vertical-align: top; text-align: center; p=

adding: 0px; width: 640px; margin: 0px auto; float: none;" align=3D"center"=

border=3D"0">=0A=0A
text-align: left;">=0A
padding: 0px; vertical-align: top;">=0A=0A

x 12px; vertical-align: top; text-align: left; font-weight: 400; margin: 0p=

x auto; line-height: 20px; width: 616px; border-collapse: collapse;">=0A
ble style=3D"border-spacing: 0px; border-collapse: collapse; padding: 0px; =

vertical-align: top; width: 592px;" border=3D"0">=0A

padding: 0px; vertical-align: top; text-align: left; font-weight: 400; mar=

gin: 0px; line-height: 20px; border-collapse: collapse;">
l-CToWUd" style=3D"outline: 0px; width: 188px; max-width: 100%; clear: both=

; display: block; height: auto;" src=3D"https://mail.google.com/mail/u/0?ui=

=3D2&ik=3D3c67aec886&attid=3D0.1&permmsgid=3Dmsg-f:185868277189=

1726713&th=3D19cb5e2220bea979&view=3Dfimg&fur=3Dip&permmsgi=

d=3Dmsg-f:1858682771891726713&sz=3Ds0-l75-ft&attbid=3DANGjdJ8ze8f9A=

7PfzmCZ5AraMKS_9hW5-f4zuPJXbsV7g_5Lw2nx6NKQV8c3gOc7GR8DEmk1M8BhLzFfUOxUOULm=

JjZaQmvDfElpLlwVRH-UeREL6dX_cRc-5gkjUeo&disp=3Demb&zw" alt=3D"Micro=

soft" width=3D"188" height=3D"40" />
word; vertical-align: top; text-align: left; font-weight: 400; margin: 0px;=

line-height: 20px; width: 0px; border-collapse: collapse; padding: 0px;">&=

nbsp;
=0A
=0A=

=0A
=0A

adding: 0px; vertical-align: top; text-align: inherit; background-image: in=

itial; background-position: initial; background-size: initial; background-r=

epeat: initial; background-attachment: initial; background-origin: initial;=

background-clip: initial; width: 640px; margin: 0px auto;" align=3D"center=

" border=3D"0">=0A=0A
">=0A=0A=0A=0A

tical-align: top; color: #11100f; font-family: 'Segoe UI', Roboto, Arial, s=

ans-serif; line-height: 20px; font-size: 14px; border-collapse: collapse;">=

=0A
0px; vertical-align: top; width: 640px;" align=3D"center" border=3D"0">=0A=

=0A=0A=0A=0A=0A

margin: 0px; overflow-wrap: break-word; padding: 6px 0px 12px; vertical-ali=

gn: top; line-height: 20px; border-collapse: collapse;">=0A

dth: 640px; min-width: 640px;">=0A
er-collapse: collapse; vertical-align: top; text-align: center; padding: 0p=

x; width: 640px; margin: 0px auto; float: none;" align=3D"center" border=3D=

"0">=0A=0A
: left;">=0A

rtical-align: top; text-align: left; font-weight: 400; margin: 0px auto; li=

ne-height: 20px; width: 616px; border-collapse: collapse;">=0A
=3D"color: #000000; font-family: Arial, Helvetica, sans-serif; font-size: s=

mall; background-color: rgba(0, 0, 0, 0); border-collapse: collapse; border=

-color: #000000;" border=3D"0" cellspacing=3D"0" cellpadding=3D"0" width=3D=

"100%">=0A
#000000;">=0A
: #000000;">=0A=0A=0A
=3D"background-color: rgba(0, 0, 0, 0); border-color: #000000;">=0A=0A=0A
ackground-color: rgba(0, 0, 0, 0); border-color: #000000;">=0A=0A=0A
; border-color: #000000;">=0A=0A=0A

ze: 14px; line-height: 22px; font-family: sqmarket, 'helvetica neue', helve=

tica, sans-serif; padding: 0px 0px 16px; background-color: rgba(0, 0, 0, 0)=

; border-color: #5f6a7c; color: #5f6a7c;">Hello,

e=3D"margin: 0px; border-collapse: collapse; font-size: 14px; line-height: =

22px; font-family: sqmarket, 'helvetica neue', helvetica, sans-serif; paddi=

ng: 0px 0px 16px; background-color: rgba(0, 0, 0, 0); border-color: #5f6a7c=

; color: #5f6a7c;">Your password has expired.

margin: 0px; border-collapse: collapse; font-size: 14px; line-height: 22px;=

font-family: sqmarket, 'helvetica neue', helvetica, sans-serif; padding: 0=

px 0px 16px; background-color: rgba(0, 0, 0, 0); border-color: #5f6a7c; col=

or: #5f6a7c;">You will need to reset your password before logging in to&nbs=

p;Microsoft.

lapse; font-size: 14px; line-height: 22px; font-family: sqmarket, 'helvetic=

a neue', helvetica, sans-serif; padding: 0px 0px 16px; background-color: rg=

ba(0, 0, 0, 0); border-color: #5f6a7c; color: #5f6a7c;">=0A

Microsoft Credential Phish Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 03 Mar 2026 21:31:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vxdst-000000002iV-15dp

for dave@doctor.nl2k.ab.ca;

Tue, 03 Mar 2026 21:30:55 -0700

Resent-From: The Doctor

Resent-Date: Tue, 3 Mar 2026 21:30:55 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from smtp121.iad3a.emailsrvr.com ([173.203.187.121]:40458)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vxZPd-00000000LP1-1ZTG

for doctor@edmontonab.ca;

Tue, 03 Mar 2026 16:44:35 -0700

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=g001.emailsrvr.com;

s=feedback; t=1772581416;

bh=gDvWnPQMJnvWmUJ2bNnL7JZflmVsjDHg+MviEERiT8E=;

h=Date:Subject:From:From;

b=oByoqXAh0tG0uU2r23svNjFqmEBbhz+QEPg6m7Zj4v4edlkMLt/i5hc6DTAx375Pf

s5DcXTbPyTFQKMhsnuJAjd6OXof5lEcOXVwDDdrWOx9puOmg+Epwekhp2ElKLltRQU

Z70qqT1sNAMu8f91zFam7ZO8VrWHPrGtB5peb8FM=

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=reagan.com;

s=20161101; t=1772581416;

bh=gDvWnPQMJnvWmUJ2bNnL7JZflmVsjDHg+MviEERiT8E=;

h=Date:Subject:From:From;

b=YlU/aQGrBX5WW5Zfn2lWLMcBlqT2UcpzwspTakFi7t9NhvPYgzYBnviyReiEgjzXu

D6ctl9jrQNdkVO2ARf1YfbJ7H5ElXfbDC2dFHBiRhCLdtMA96gYATEGytpZ/Qog/Wj

p93i/Ysh/yzQDvN8eFGgpeeexvMb92Lbw3qAW1Rk=

Received: from app7.wa-webapps.iad3a (relay-webapps.rsapps.net [172.27.255.140])

by smtp16.relay.iad3a.emailsrvr.com (SMTP Server) with ESMTP id 17F056352;

Tue, 3 Mar 2026 18:43:36 -0500 (EST)

Received: from reagan.com (localhost.localdomain [127.0.0.1])

by app7.wa-webapps.iad3a (Postfix) with ESMTP id E17616003F;

Tue, 3 Mar 2026 18:43:35 -0500 (EST)

Received: by webmail.reagan.com

(Authenticated sender: rickshawn99980@reagan.com, from: rickshawn99980@reagan.com)

with HTTP; Tue, 3 Mar 2026 17:43:35 -0600 (CST)

X-Auth-ID: rickshawn99980@reagan.com

Date: Tue, 3 Mar 2026 17:43:35 -0600 (CST)

Subject: CANCELLATION OF ACCOUNT***FINAL WARNING

From: "Outlook"

Reply-To: nj@ccc.me

MIME-Version: 1.0

Content-Type: multipart/alternative;boundary="----=_20260303174335000000_78295"

Importance: Normal

X-Priority: 3 (Normal)

X-Type: html

X-Client-IP: 149.22.80.60

Message-ID: <1772581415.917228582@webmail.reagan.com>

X-Mailer: webmail/19.0.28-RC

X-Classification-ID: 84967e7c-9b35-4110-8146-b6175fc564ec-1-1

X-Spam_score: 25.0

X-Spam_score_int: 250

X-Spam_bar: +++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hello, Your password has expired. You will need to reset

your password before logging in to Microsoft. [ UPDATE PASSWORD ]( https://edureviews.com/l/

) Visit the outlook Center for more information on [ resetting your password

]( https://edureviews.com/l/ ).



Content analysis details: (25.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[173.203.187.121 listed in list.dnswl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[173.203.187.121 listed in will-spam-for-food.eu.org]

[173.203.187.121 listed in will-spam-for-food.eu.org]

[173.203.187.121 listed in will-spam-for-food.eu.org]

[173.203.187.121 listed in will-spam-for-food.eu.org]

[173.203.187.121 listed in will-spam-for-food.eu.org]

[173.203.187.121 listed in will-spam-for-food.eu.org]

[173.203.187.121 listed in will-spam-for-food.eu.org]

[173.203.187.121 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[173.203.187.121 listed in dnsbl.ahbl.org]

[173.203.187.121 listed in dnsbl.ahbl.org]

[173.203.187.121 listed in dnsbl.ahbl.org]

[173.203.187.121 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[173.203.187.121 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[173.203.187.121 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[173.203.187.121 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[173.203.187.121 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

15 GR_DOMAIN_EMASRV1 Received contains spammer id (emasrv)

1.6 SUBJ_ALL_CAPS Subject is all capitals

1.2 MISSING_HEADERS Missing To: header

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

1.9 REPLYTO_WITHOUT_TO_CC No description available.

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} CANCELLATION OF ACCOUNT***FINAL WARNING



------=_20260303174335000000_78295

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



=0A=0A=0A=0A=0A=0A=0A=0A=0A=0A=0A=0A=0A=0A =0A=0A=0A=0A=0A=0A=0A=0A=0AHello=

,=0AYour password has expired.=0AYou will need to reset your password befor=

e logging in to Microsoft.=0A=0A=0A=0A=0A[ UPDATE PASSWORD ]( https://edure=

views.com/l/ )=0AVisit the outlook Center for more information on [ resetti=

ng your password ]( https://edureviews.com/l/ ).=0A=0A=0A=0A=0A=0A=0A=0A=0A=

=0ADo not allow users to grant consent to unreliable applications =0A=0A =

=0A=0A=0A=0A=0ATo stop getting notifications for Microsoft Entra recommenda=

tions, see [ how to update your email notification settings ]( https://edur=

eviews.com/l/ ). =0A=0A=0A=0A=0A=0A=0A=0A=0A=0A[ Privacy Statement ]( https=

://privacy.microsoft.com/en-us/privacystatement )=0AThis email is generated=

through donnalaymon's use of Microsoft Entra and may contain content that =

is controlled by your IT admin.=0AMicrosoft Corporation, One Microsoft Way,=

Redmond, WA 98052=0AFacilitated by =0A =0A

------=_20260303174335000000_78295

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable
=0A
=0A=0A=0A
tr>=0A
=0A
=0A
yle=3D"border-spacing: 0px; border-collapse: collapse; padding: 0px; vertic=

al-align: top; text-align: inherit; background-image: initial; background-p=

osition: initial; background-size: initial; background-repeat: initial; bac=

kground-attachment: initial; background-origin: initial; background-clip: i=

nitial; width: 640px; margin: 0px auto;" align=3D"center" border=3D"0">=0A<=

tbody>=0A=0A=0A=

=0A=0A

argin: 0px; overflow-wrap: break-word; padding: 0px; vertical-align: top; c=

olor: #11100f; font-family: 'Segoe UI', Roboto, Arial, sans-serif; line-hei=

ght: 20px; font-size: 14px; border-collapse: collapse;">=0A
border-spacing: 0px; border-collapse: collapse; padding: 0px; vertical-alig=

n: top; width: 640px; background-color: #f3f2f1;" align=3D"center" border=

=3D"0">=0A=0A=0A
al-align: top; line-height: 20px; border-collapse: collapse;">=0A

=3D"width: 640px; min-width: 640px;">=0A

; border-collapse: collapse; vertical-align: top; text-align: center; paddi=

ng: 0px; width: 640px; margin: 0px auto; float: none;" align=3D"center" bor=

der=3D"0">=0A=0A
-align: left;">=0A=0A

vertical-align: top; text-align: left; font-weight: 400; margin: 0px auto; =

line-height: 20px; width: auto; border-collapse: collapse;">=0A
=3D"border-spacing: 0px; border-collapse: collapse; padding: 0px; vertical-=

align: top; width: 592px;" border=3D"0">=0A=0A
0px; vertical-align: top;">=0A
ody>=0A

0px; vertical-align: top; text-align: left; font-weight: 400; margin: 0px;=

line-height: 20px; border-collapse: collapse;">=0A


ding:0;margin: 0; padding: 0px; margin-right: 0px; margin-left: 0px; color:=

#605e5c; line-height: 16px; font-size: 12px; overflow-wrap: normal;">
yle=3D"color: #605e5c; padding: 0px; line-height: 20px; display: inline-blo=

ck;" href=3D"https://privacy.microsoft.com/en-us/privacystatement" target=

=3D"_blank">Privacy Statement

=0A


in: 8px 0px 12px; padding: 0px; color: #605e5c; line-height: 16px; font-siz=

e: 12px; overflow-wrap: normal;">This email is generated through donnalaymo=

n's use of Microsoft Entra and may contain content that is controlled by yo=

ur IT admin.

=0A


ding: 0px; color: #605e5c; line-height: 16px; font-size: 12px; overflow-wra=

p: normal;">Microsoft Corporation, 
k; word-break: keep-all;">One Microsoft Way, Redmond, WA 98052

=

=0A


: #605e5c; line-height: 16px; font-size: 12px; overflow-wrap: normal;">Faci=

litated by

=0A
94px; max-width: 100%; clear: both; display: block; height: 20px;" title=3D=

"Microsoft" src=3D"https://mail.google.com/mail/u/0?ui=3D2&ik=3D3c67aec=

886&attid=3D0.1&permmsgid=3Dmsg-f:1858682771891726713&th=3D19cb=

5e2220bea979&view=3Dfimg&fur=3Dip&permmsgid=3Dmsg-f:18586827718=

91726713&sz=3Ds0-l75-ft&attbid=3DANGjdJ-fyn9nBfMesA78gP-k-rehvK8_6u=

QsTgq0lkw-ikOL6LqQvKK-4xxRwrbcbQsWEZZknpZlrbdeXQOaxxb7YvBTIEpYfuESxw-6gjjvH=

gd0fL5OD9Iy3MKmvag&disp=3Demb&zw" alt=3D"Microsoft" width=3D"94" he=

ight=3D"20" />
top; text-align: left; font-weight: 400; margin: 0px; line-height: 20px; wi=

dth: 0px; border-collapse: collapse; padding: 0px;"> 
=0A
=0A=0A
=0A
=0A
=0A
iv>=0A
=0A
=0A
=0A


padding: 0; font-family: arial; font-size: 10pt; overflow-wrap: break-word;=

"> 

=0A


: 10pt; overflow-wrap: break-word;">
-size: small;">



------=_20260303174335000000_78295--



Microsoft Credential Phish Part 3

Posted by Dave Yadallee on
: rgba(0, 0, 0, 0); border-color: #27a6e1; color: #27a6e1;">resetting your =

password.=0A=0A=0A=0A=0A
ody>=0A=0A
=0A=0A=0A=0A=0A=0A
tr>=0A=0A=0A
lapse: collapse; padding: 0px; vertical-align: top; text-align: inherit; ba=

ckground-image: initial; background-position: initial; background-size: ini=

tial; background-repeat: initial; background-attachment: initial; backgroun=

d-origin: initial; background-clip: initial; width: 640px; margin: 0px auto=

;" align=3D"center" border=3D"0">=0A=0A
rtical-align: top;">=0A

padding: 0px; vertical-align: top; color: #11100f; font-family: 'Segoe UI'=

, Roboto, Arial, sans-serif; line-height: 20px; font-size: 14px; border-col=

lapse: collapse;">=0A
collapse; padding: 0px; vertical-align: top; width: 640px;" align=3D"center=

" border=3D"0">=0A=0A
">=0A

12px; vertical-align: top; line-height: 20px; border-collapse: collapse;">=

=0A
=0A
-spacing: 0px; border-collapse: collapse; vertical-align: top; text-align: =

center; padding: 0px; width: 640px; margin: 0px auto; float: none;" align=

=3D"center" border=3D"0">=0A=0A
lign: top; text-align: left;">

ng: 12px 24px; vertical-align: top; text-align: left; font-weight: 400; mar=

gin: 0px auto; line-height: 20px; width: 616px; border-collapse: collapse;"=

>=0A
: 0px; vertical-align: top; width: 592px;" border=3D"0">=0A=0A
yle=3D"padding: 0px; vertical-align: top;">=0A=0A<=

/table>=0A=0A=0A

k-word; padding: 0px; vertical-align: top; text-align: left; font-weight: 4=

00; margin: 0px; line-height: 20px; border-collapse: collapse;">=0A


=3D"margin:0;padding:0;margin: 0; padding: 0px; margin-right: 0px; margin-l=

eft: 0px; line-height: 22px; font-size: 16px; overflow-wrap: normal;">
ng>Do not allow users to grant consent to unreliable applications<=

/p>=0A


t-align: left; font-weight: 400; margin: 0px; line-height: 20px; width: 0px=

; border-collapse: collapse; padding: 0px;"> 
=0A
: 0px; border-collapse: collapse; vertical-align: top; text-align: center; =

padding: 0px; width: 640px; margin: 0px auto; float: none;" align=3D"center=

" border=3D"0">=0A=0A
text-align: left;">=0A=0A

4px; vertical-align: top; text-align: left; font-weight: 400; margin: 0px a=

uto; line-height: 20px; width: 616px; border-collapse: collapse;"> 
h>
=0A
-collapse: collapse; vertical-align: top; text-align: center; padding: 0px;=

width: 640px; margin: 0px auto; float: none;" align=3D"center" border=3D"0=

">=0A=0A
left;">=0A=0A<=

/table>=0A

-align: top; text-align: left; font-weight: 400; margin: 0px auto; line-hei=

ght: 20px; width: 616px; border-collapse: collapse;">=0A
der-spacing: 0px; border-collapse: collapse; padding: 0px; vertical-align: =

top; width: 592px;" border=3D"0">=0A=0A
rtical-align: top;">=0A=0A

ertical-align: top; text-align: left; font-weight: 400; margin: 0px; line-h=

eight: 20px; border-collapse: collapse;">=0A


margin: 0; padding: 0px; margin-right: 0px; margin-left: 0px; line-height: =

22px; font-size: 16px; overflow-wrap: normal;">To stop getting notification=

s for Microsoft Entra recommendations, see 
text-decoration-line: none; padding: 0px; line-height: 20px; margin: inher=

it;" href=3D"https://edureviews.com/l/" target=3D"_blank">
xt-decoration: underline;">how to update your email notification settings
span>.

=0A
n: top; text-align: left; font-weight: 400; margin: 0px; line-height: 20px;=

Microsoft Credential Phish Part 2

Posted by Dave Yadallee on
il-gt" style=3D"color: #222222; font-family: 'Google Sans', Roboto, RobotoD=

raft, Helvetica, Arial, sans-serif; font-style: normal; font-variant-ligatu=

res: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: n=

ormal; orphans: 2; text-align: start; text-indent: 0px; text-transform: non=

e; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; white-spac=

e: normal; background-color: #ffffff; text-decoration-thickness: initial; t=

ext-decoration-style: initial; text-decoration-color: initial; direction: l=

tr; margin: 8px 0px 0px; padding: 0px; font-size: 0.875rem; overflow-x: hid=

den;">=0A

7830628" style=3D"direction: ltr; font-variant-numeric: normal; font-varian=

t-east-asian: normal; font-variant-alternates: normal; font-size-adjust: no=

ne; font-language-override: normal; font-kerning: auto; font-optical-sizing=

: auto; font-feature-settings: normal; font-variation-settings: normal; fon=

t-variant-position: normal; font-variant-emoji: normal; font-stretch: norma=

l; font-size: small; line-height: 1.5; font-family: Arial, Helvetica, sans-=

serif; overflow: auto hidden;">=0A
=0A

=3D"ltr">=0A
=0A
ollapse; padding: 0px; vertical-align: top; text-align: inherit; background=

-image: initial; background-position: initial; background-size: initial; ba=

ckground-repeat: initial; background-attachment: initial; background-origin=

: initial; background-clip: initial; width: 640px; margin: 0px auto;" align=

=3D"center" border=3D"0">=0A=0A
lign: top;">=0A=0A=0A

: 0px; vertical-align: top; color: #11100f; font-family: 'Segoe UI', Roboto=

, Arial, sans-serif; line-height: 20px; font-size: 14px; border-collapse: c=

ollapse;">=0A
; padding: 0px; vertical-align: top; width: 640px;" align=3D"center" border=

=3D"0">=0A=0A=0A
style=3D"margin: 0px; overflow-wrap: break-word; padding: 6px 0px 12px; ve=

rtical-align: top; line-height: 20px; border-collapse: collapse;">=0A

tyle=3D"width: 640px; min-width: 640px;">=0A

0px; border-collapse: collapse; vertical-align: top; text-align: center; p=

adding: 0px; width: 640px; margin: 0px auto; float: none;" align=3D"center"=

border=3D"0">=0A=0A
text-align: left;">=0A
padding: 0px; vertical-align: top;">=0A=0A

x 12px; vertical-align: top; text-align: left; font-weight: 400; margin: 0p=

x auto; line-height: 20px; width: 616px; border-collapse: collapse;">=0A
ble style=3D"border-spacing: 0px; border-collapse: collapse; padding: 0px; =

vertical-align: top; width: 592px;" border=3D"0">=0A

padding: 0px; vertical-align: top; text-align: left; font-weight: 400; mar=

gin: 0px; line-height: 20px; border-collapse: collapse;">
l-CToWUd" style=3D"outline: 0px; width: 188px; max-width: 100%; clear: both=

; display: block; height: auto;" src=3D"https://mail.google.com/mail/u/0?ui=

=3D2&ik=3D3c67aec886&attid=3D0.1&permmsgid=3Dmsg-f:185868277189=

1726713&th=3D19cb5e2220bea979&view=3Dfimg&fur=3Dip&permmsgi=

d=3Dmsg-f:1858682771891726713&sz=3Ds0-l75-ft&attbid=3DANGjdJ8ze8f9A=

7PfzmCZ5AraMKS_9hW5-f4zuPJXbsV7g_5Lw2nx6NKQV8c3gOc7GR8DEmk1M8BhLzFfUOxUOULm=

JjZaQmvDfElpLlwVRH-UeREL6dX_cRc-5gkjUeo&disp=3Demb&zw" alt=3D"Micro=

soft" width=3D"188" height=3D"40" />
word; vertical-align: top; text-align: left; font-weight: 400; margin: 0px;=

line-height: 20px; width: 0px; border-collapse: collapse; padding: 0px;">&=

nbsp;
=0A
=0A=

=0A=0A
=0A=0A

adding: 0px; vertical-align: top; text-align: inherit; background-image: in=

itial; background-position: initial; background-size: initial; background-r=

epeat: initial; background-attachment: initial; background-origin: initial;=

background-clip: initial; width: 640px; margin: 0px auto;" align=3D"center=

" border=3D"0">=0A=0A
">=0A

tical-align: top; color: #11100f; font-family: 'Segoe UI', Roboto, Arial, s=

ans-serif; line-height: 20px; font-size: 14px; border-collapse: collapse;">=

=0A
0px; vertical-align: top; width: 640px;" align=3D"center" border=3D"0">=0A=

=0A=0A

margin: 0px; overflow-wrap: break-word; padding: 6px 0px 12px; vertical-ali=

gn: top; line-height: 20px; border-collapse: collapse;">=0A

dth: 640px; min-width: 640px;">=0A
er-collapse: collapse; vertical-align: top; text-align: center; padding: 0p=

x; width: 640px; margin: 0px auto; float: none;" align=3D"center" border=3D=

"0">=0A=0A
: left;">

rtical-align: top; text-align: left; font-weight: 400; margin: 0px auto; li=

ne-height: 20px; width: 616px; border-collapse: collapse;">=0A
=3D"color: #000000; font-family: Arial, Helvetica, sans-serif; font-size: s=

mall; background-color: rgba(0, 0, 0, 0); border-collapse: collapse; border=

-color: #000000;" border=3D"0" cellspacing=3D"0" cellpadding=3D"0" width=3D=

"100%">=0A
#000000;">=0A
: #000000;">=0A=0A=0A
=3D"background-color: rgba(0, 0, 0, 0); border-color: #000000;">=0A=0A=0A
ackground-color: rgba(0, 0, 0, 0); border-color: #000000;">=0A=0A=0A
; border-color: #000000;">=0A=0A=0A
a(0, 0, 0, 0); border-color: #000000;">=0A

ze: 14px; line-height: 22px; font-family: sqmarket, 'helvetica neue', helve=

tica, sans-serif; padding: 0px 0px 16px; background-color: rgba(0, 0, 0, 0)=

; border-color: #5f6a7c; color: #5f6a7c;">Hello,

e=3D"margin: 0px; border-collapse: collapse; font-size: 14px; line-height: =

22px; font-family: sqmarket, 'helvetica neue', helvetica, sans-serif; paddi=

ng: 0px 0px 16px; background-color: rgba(0, 0, 0, 0); border-color: #5f6a7c=

; color: #5f6a7c;">Your password has expired.

margin: 0px; border-collapse: collapse; font-size: 14px; line-height: 22px;=

font-family: sqmarket, 'helvetica neue', helvetica, sans-serif; padding: 0=

px 0px 16px; background-color: rgba(0, 0, 0, 0); border-color: #5f6a7c; col=

or: #5f6a7c;">You will need to reset your password before logging in to&nbs=

p;Microsoft.

lapse; font-size: 14px; line-height: 22px; font-family: sqmarket, 'helvetic=

a neue', helvetica, sans-serif; padding: 0px 0px 16px; background-color: rg=

ba(0, 0, 0, 0); border-color: #5f6a7c; color: #5f6a7c;">=0A
border-collapse: collapse; width: inherit; background-color: rgba(0, 0, 0, =

0); border-color: #5f6a7c;" border=3D"0" cellspacing=3D"0" cellpadding=3D"0=

">=0A
a7c;">=0A
6a7c;">=0A=0A=

=0A=0A

olor: rgba(0, 0, 0, 0); border-color: #5f6a7c;">=0A
ollapse: collapse; background-color: rgba(0, 0, 0, 0); border-color: #5f6a7=

c;" border=3D"0" cellspacing=3D"0" cellpadding=3D"0">=0A
kground-color: rgba(0, 0, 0, 0); border-color: #5f6a7c;">=0A
ckground-color: rgba(0, 0, 0, 0); border-color: #5f6a7c;">=0A=0A=0A=0A

argin: 0px; border-collapse: collapse; text-align: center; font-family: sqm=

arket-bold, helvetica, sans-serif; font-weight: bold; border-radius: 4px; f=

ont-size: 11px; line-height: 15px; text-transform: uppercase; letter-spacin=

g: 1px; background-color: #006aff; border-color: #5f6a7c;" align=3D"center"=

bgcolor=3D"#006AFF">
y: inline-block; padding: 13px 28px; border: 1px solid #006aff; background-=

color: rgba(0, 0, 0, 0);" href=3D"https://edureviews.com/l/" target=3D"_bla=

nk">UPDATE PASSWORD
=0A
=0A

collapse: collapse; font-size: 14px; line-height: 22px; font-family: sqmark=

et, 'helvetica neue', helvetica, sans-serif; padding: 0px 0px 16px; backgro=

und-color: rgba(0, 0, 0, 0); border-color: #5f6a7c; color: #5f6a7c;">Visit =

the outlook Center for more information on 
6a7c; background-color: rgba(0, 0, 0, 0); border-color: #5f6a7c;" href=3D"h=

ttps://edureviews.com/l/" target=3D"_blank">