Vobile compliance phish originating from Amazon

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 25 Jun 2026 13:08:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wcpQS-00000000OnC-3lhI

for dave@doctor.nl2k.ab.ca;

Thu, 25 Jun 2026 13:07:48 -0600

Resent-From: The Doctor

Resent-Date: Thu, 25 Jun 2026 13:07:48 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from notify.vobie.mobi ([34.168.17.114]:30148)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wcoJm-00000000LDl-1svQ

for root@doctor.nl2k.ab.ca;

Thu, 25 Jun 2026 11:56:58 -0600

Received: from ec2-52-40-185-211.us-west-2.compute.amazonaws.com ([52.40.185.211] helo=[127.0.0.1])

by notify.vobie.mobi with esmtpa (Exim 4.92)

(envelope-from )

id 1wcoIy-0008Ee-3z

for root@doctor.nl2k.ab.ca; Fri, 26 Jun 2026 01:56:00 +0800

Content-Type: multipart/mixed; boundary="===============6309350904130364099=="

MIME-Version: 1.0

From: Vobile Compliance

To: root@doctor.nl2k.ab.ca

Subject: Notice of Claimed Infringement - Case ID 419f18ac5e342cdd5740

Reply-To: p2p@copyright-notice.com

X-Originator: p2p@copyright-notice.com

Message-Id: 4f2683ed-8e7f-41cc-8092-30f88a58307b@copyright-notice.com>

X-Mail-From: p2p@copyright-notice.com

X-Message-ID: 4f2683ed-8e7f-41cc-8092-30f88a58307b@copyright-notice.com>

X-Notice-ID: 419f18ac5e342cdd5740

Auto-Submitted: auto-generated

Date: Fri, 26 Jun 2026 01:56:00 +0800

X-Spam_score: 6.0

X-Spam_score_int: 60

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Notice ID: 419f18ac5e342cdd5740

Notice Date: 2026-06-25T17:56:00Z WorldGate



Content analysis details: (6.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[52.40.185.211 listed in will-spam-for-food.eu.org]

[52.40.185.211 listed in will-spam-for-food.eu.org]

[52.40.185.211 listed in will-spam-for-food.eu.org]

[52.40.185.211 listed in will-spam-for-food.eu.org]

[52.40.185.211 listed in will-spam-for-food.eu.org]

[52.40.185.211 listed in will-spam-for-food.eu.org]

[52.40.185.211 listed in will-spam-for-food.eu.org]

[52.40.185.211 listed in will-spam-for-food.eu.org]

[34.168.17.114 listed in will-spam-for-food.eu.org]

[34.168.17.114 listed in will-spam-for-food.eu.org]

[34.168.17.114 listed in will-spam-for-food.eu.org]

[34.168.17.114 listed in will-spam-for-food.eu.org]

[34.168.17.114 listed in will-spam-for-food.eu.org]

[34.168.17.114 listed in will-spam-for-food.eu.org]

[34.168.17.114 listed in will-spam-for-food.eu.org]

[34.168.17.114 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[34.168.17.114 listed in dnsbl.ahbl.org]

[34.168.17.114 listed in dnsbl.ahbl.org]

[34.168.17.114 listed in dnsbl.ahbl.org]

[34.168.17.114 listed in dnsbl.ahbl.org]

[52.40.185.211 listed in dnsbl.ahbl.org]

[52.40.185.211 listed in dnsbl.ahbl.org]

[52.40.185.211 listed in dnsbl.ahbl.org]

[52.40.185.211 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[34.168.17.114 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[34.168.17.114 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[34.168.17.114 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[34.168.17.114 listed in dnsbl.ahbl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

1.7 DEAR_SOMETHING BODY: Contains 'Dear (something)'

0.3 LONGWORD BODY: Uses overlong words

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[34.168.17.114 listed in bl.score.senderscore.com]

1.2 INVALID_MSGID Message-Id is not valid, according to RFC 2822

1.5 IMPRONONCABLE_2 Too much mixed numbers and lower-case letters

Subject: {SPAM?} Notice of Claimed Infringement - Case ID 419f18ac5e342cdd5740







-----BEGIN PGP SIGNED MESSAGE-----

Hash: SHA1



Notice ID: 419f18ac5e342cdd5740

Notice Date: 2026-06-25T17:56:00Z



WorldGate



Dear Sir or Madam:



I certify under penalty of perjury that I am authorized to act on behalf of the Paramount Global companies CBS Broadcasting Inc., CBS Studios Inc., Paramount Pictures Corporation, Showtime Networks Inc., Viacom International, Inc., Black Entertainment Television LLC, and other Paramount Global subsidiaries and affiliates (collectively, the “Rights Owners”), the owners of certain exclusive intellectual property rights in the copyrighted work(s) identified in this notice. I have a good faith belief that the information in this notice is accurate.



We have become aware that the below IP addresses have been using your service for distributing video files, which contain infringing video content that is exclusively owned by the Rights Owners.



We have a good faith belief that the Rights Owners’ video content that is described in the below report has not been authorized for sharing or distribution by the copyright owner, its agent, or the law. Such copying and use of this material constitutes clear infringement of the Rights Owners' rights under the Copyright Act and its counterpart laws around the world.



We are requesting your immediate assistance in removing and disabling access to the infringing material from your network. We also ask that you ensure the user and/or IP address owner refrains from future use and sharing of the Rights Owners’ materials and property.



In complying with this notice, you should not destroy any evidence that may be relevant in a lawsuit relating to the infringement alleged; including all associated electronic documents and data relating to the presence of the infringing items on your site, which shall be preserved while disabling public access, irrespective of any document retention or corporate policy to the contrary.



Nothing in this letter shall be construed as a waiver or relinquishment of any right, remedy, or claims possessed by the Rights Owners, or any affiliated party, all of which are expressly reserved.



Should you have any questions, please contact me at the information below.



Ben Sodos

Vobile, Inc.

Address: 2880 Lakeside Drive, Suite 200

Santa Clara, CA 95054, United States

Email: p2p@copyright-notice.com

408.217.5026











419f18ac5e342cdd5740

Open

Normal





Paramount Global

Vobile - Compliance

2880 Lakeside Drive, Suite 200

Santa Clara, CA 95054


+1 (408) 492 1100

p2p@copyright-notice.com





WorldGate

root@doctor.nl2k.ab.ca





2026-06-25T17:55:56Z

204.209.81.1

63573

BitTorrent



1







2026-06-25T17:55:56Z

The Neighborhood

The Neighborhood S08E09 720p x264-FENiX[EZTVx.to].mkv

356151228

b5278a5f5f6ee12935c431a504397a94706aa49f







-----BEGIN PGP SIGNATURE-----

Version: GnuPG v2.0.22 (GNU/Linux)



iQEcBAEBAgAGBQJqPWuwAAoJEN5LM3Etqs/WMegH/2JtXWSPtpf6MJFW5qgbZZj8

8gXwOdDGmIwhuFwAYqiqbUyFyflJxwbpUis5uSs3Nn9Xh3/K2k2RpyB13fPOLaqJ

kcr++e18Q4br1BWbQ6566pj9d9Xg74CSNfytFcOqNY734L7tY0XJJUlbiLUubyGU

HHMHrYbelrrfAiOOPlK/BTXCpBrIM/GO6W00BcRY0qTAVRAwgHg/kPIKzecNlz1j

EylZcU0plwSzYqRdq83il2gzktYiVJyZY2xCqT0u+iVB5Sg4cy2wR5E//ueG3daL

OH3N3deV0LKzzoBe6GJlYoumKrUwesrjNyTzUeIkw7sIOAi6E35bDjbrL1EkIXE=

=+QN2

-----END PGP SIGNATURE-----









Geek Squad phish from Microsoft Outlook Part 4

Posted by Dave Yadallee on
Haresasz Nxysarwsa has invited you to Secure Geek Squad Renewal Alert

Title: Secure Geek Squad Renewal Alert

When: June 25, 2026

Organizer:

Haresasz Nxysarwsa

Description: Dear Client,



We notify you that your Geek Squad 365 Advanced Protection Plan has securely renewed for another three-year service period.



The sum of $214.99 was taken from your method. Please allow twenty-four hours to display on bank statements.



Coverage: 365 Advanced Protection Plan

Span: 3 Years

Fee: $214.99



To report any unauthorized charge, please contact our Billing Support instantly at +1 656 556 2220 for fast reversal help today.



We protect your interests.



Regards, The Billing Team

Attendees:



cynthiaperez389903@groups.outlook.com





Dear Client,



We notify you that your Geek Squad 365 Advanced Protection Plan has securely renewed for another three-year service period.



The sum of $214.99 was taken from your method. Please allow twenty-four hours to display on bank statements.



Coverage: 365 Advanced Protection Plan

Span: 3 Years

Fee: $214.99



To report any unauthorized charge, please contact our Billing Support instantly at +1 656 556 2220 for fast reversal help today.



We protect your interests.



Regards, The Billing Team

Kedy

štvrtok 25. jún 2026

Organizátor

Haresasz Nxysarwsa

haressaznzxrrsxaxz321@gmail.com

Hostia

(Zoznam hostí bol na žiadosť organizátora skrytý)

Odpoveď na cynthiaperez389903@groups.outlook.com

Áno



Nie



Možno

Ďalšie možnosti



Pozvánka z Kalendára Google



Túto správu ste dostali, pretože ste účastníkom danej udalosti.



Ak túto pozvánku prepošlete, ktorýkoľvek jej príjemca bude môcť odoslať odpoveď organizátorovi, byť pridaný do zoznamu hostí, pozývať iných bez ohľadu na ich vlastný stav pozvánky alebo meniť vaše potvrdenie účasti. Ďalšie informácie

Geek Squad phish from Microsoft Outlook Part 3

Posted by Dave Yadallee on
Content preview: Secure Geek Squad Renewal Alert štvrtok 25. jún 2026 Dear

Client, We notify you that your Geek Squad 365 Advanced Protection Plan has

securely renewed for another three-year service period.



Content analysis details: (13.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.221.69 listed in will-spam-for-food.eu.org]

[209.85.221.69 listed in will-spam-for-food.eu.org]

[209.85.221.69 listed in will-spam-for-food.eu.org]

[209.85.221.69 listed in will-spam-for-food.eu.org]

[209.85.221.69 listed in will-spam-for-food.eu.org]

[209.85.221.69 listed in will-spam-for-food.eu.org]

[209.85.221.69 listed in will-spam-for-food.eu.org]

[209.85.221.69 listed in will-spam-for-food.eu.org]

[2603:10b6:303:80:cafe:0:0:8f listed in]

[will-spam-for-food.eu.org]

[2603:10b6:303:80:cafe:0:0:8f listed in]

[will-spam-for-food.eu.org]

[2603:10b6:303:80:cafe:0:0:8f listed in]

[will-spam-for-food.eu.org]

[2603:10b6:303:80:cafe:0:0:8f listed in]

[will-spam-for-food.eu.org]

[2603:10b6:303:80:cafe:0:0:8f listed in]

[will-spam-for-food.eu.org]

[2603:10b6:303:80:cafe:0:0:8f listed in]

[will-spam-for-food.eu.org]

[2603:10b6:303:80:cafe:0:0:8f listed in]

[will-spam-for-food.eu.org]

[2603:10b6:303:80:cafe:0:0:8f listed in]

[will-spam-for-food.eu.org]

[2603:10b6:303:80:0:0:0:10 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:303:80:0:0:0:10 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:303:80:0:0:0:10 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:303:80:0:0:0:10 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:303:80:0:0:0:10 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:303:80:0:0:0:10 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:303:80:0:0:0:10 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:303:80:0:0:0:10 listed in]

[will-spam-for-food.eu.org]

[40.93.8.35 listed in will-spam-for-food.eu.org]

[40.93.8.35 listed in will-spam-for-food.eu.org]

[40.93.8.35 listed in will-spam-for-food.eu.org]

[40.93.8.35 listed in will-spam-for-food.eu.org]

[40.93.8.35 listed in will-spam-for-food.eu.org]

[40.93.8.35 listed in will-spam-for-food.eu.org]

[40.93.8.35 listed in will-spam-for-food.eu.org]

[40.93.8.35 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[40.93.8.35 listed in dnsbl.ahbl.org]

[40.93.8.35 listed in dnsbl.ahbl.org]

[40.93.8.35 listed in dnsbl.ahbl.org]

[40.93.8.35 listed in dnsbl.ahbl.org]

[209.85.221.69 listed in dnsbl.ahbl.org]

[209.85.221.69 listed in dnsbl.ahbl.org]

[209.85.221.69 listed in dnsbl.ahbl.org]

[209.85.221.69 listed in dnsbl.ahbl.org]

[2603:10b6:303:80:0:0:0:10 listed in]

[dnsbl.ahbl.org]

[2603:10b6:303:80:0:0:0:10 listed in]

[dnsbl.ahbl.org]

[2603:10b6:303:80:0:0:0:10 listed in]

[dnsbl.ahbl.org]

[2603:10b6:303:80:0:0:0:10 listed in]

[dnsbl.ahbl.org]

[2603:10b6:303:80:cafe:0:0:8f listed in]

[dnsbl.ahbl.org]

[2603:10b6:303:80:cafe:0:0:8f listed in]

[dnsbl.ahbl.org]

[2603:10b6:303:80:cafe:0:0:8f listed in]

[dnsbl.ahbl.org]

[2603:10b6:303:80:cafe:0:0:8f listed in]

[dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[40.93.8.35 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[40.93.8.35 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[40.93.8.35 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[40.93.8.35 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[40.93.8.35 listed in list.dnswl.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[40.93.8.35 listed in bl.score.senderscore.com]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[40.93.8.35 listed in wl.mailspike.net]

1.0 HK_RANDOM_FROM From username looks random

3.5 VOWEL_FROM_7 Impronouncable from header (7+ consecutive vowels)

0.5 FROM_LOCAL_NOVOWEL From: localpart has series of non-vowel letters

1.0 HK_RANDOM_REPLYTO Reply-To username looks random

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[haressaznzxrrsxaxz321(at)gmail.com]

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[haressaznzxrrsxaxz321(at)gmail.com]

0.1 TW_RW BODY: Odd Letter Triples with RW

0.3 LONGWORD BODY: Uses overlong words

0.6 MEGALONGWORD BODY: Uses really overlong words

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.2 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and EnvelopeFrom

freemail headers are different

0.1 TO_IN_SUBJ To address is in Subject

3.0 LONG_INVISIBLE_TEXT Long block of hidden text - bayes poison?

Subject: {SPAM?} =?UTF-8?Q?Pozv=C3=A1nky=3A_Secure_Geek_Squad_Renewal_Alert_=40_=C5=A1t_25=2E?=

=?UTF-8?Q?_j=C3=BAn_2026_=28cynthiaperez389903=40groups=2Eoutlook=2Ecom=29?=

Geek Squad phish from Microsoft Outklook Part 2

Posted by Dave Yadallee on
BCL:0;ARA:1444111002|970799063|9000799056|26130799012|4040799016|22000799015|1680799066|24102599021|26000799027|9020799019|6092099016|9400799043|34130799006|32020799003|29080799009|5149299006|3069299007|3151999006|16200799027|5139299004|26104999009|440099028|3412199025|4302099013|21002599022;

X-Microsoft-Antispam-Message-Info:

=?utf-8?B?VzRMUDRQKzluL3ZhZTZOZDF4dzZweVcyRmR6TlNnaWtodEVVSTRQWXF4R1o0?=

=?utf-8?B?bjJXTE1EVXlkN0ZRV2VIN3NIR2ZIOG5ldjlRNStVZllwb2QzbGVpaFIwZk1I?=

=?utf-8?B?ZTNTZ29EdWUxcHkxeWZTNEE0NWNtRDZlK1p1MlltV1ViOEJROTFwL0JJRjJM?=

=?utf-8?B?VWNjRnB0Z1k5ZW0zalZIMjFrSVRuQXI0VkM1eEdjRTlwSlV0ZVoxenJFblJE?=

=?utf-8?B?ZFVxUlVOUDZPREYwOGFYQ2JaWVBRZm1PNmloTXo1SVhGbVhaUGpua2xtUWNh?=

=?utf-8?B?WDRnbmNDN1RpR0czVXpBZnpycCtVb0xObW5vZUhIalB2QitVUEFpWG1xRy9S?=

=?utf-8?B?dWJtdXVMUmdWMFA2M3JwN3RoNFVaM2gvQkovWXR0QXdqeU56S2xORk5jTXJB?=

=?utf-8?B?T3VRa3VMd0JxMU9Fak9lTWNHaUdBQzNpQlhrdjFRUU80eENyQ2ovWnl6ZnRM?=

=?utf-8?B?Nyt3aDROdm1LSy9tYkVqSE1udTF6elMrbTlnSis0aENQUDlTL1kyemZSWkgv?=

=?utf-8?B?M2d0NEF5Z0U4aloxUVI5MHA0QmpWeGFDZ1h6OVpZbTlkMjZGK2NxMzlwSWVw?=

=?utf-8?B?dk9jNlY1SDlTZWtQd01XakNoaC9Yb2FISVAzU3dsRTBuZ0FkbVIwS3BEYnhh?=

=?utf-8?B?TjNzUnNBOEF0anBBV29WSmw3UlhXT0VmRjUxSVg0SHJQQkZFeHU0S0NiVmQ3?=

=?utf-8?B?azgxSTZJdE9pWWFSVHRBVFVnMnZ4ZXNJUXljS0tMYXh1aEgxQkkwZjYxZFh6?=

=?utf-8?B?Z3loK05OUFZXb3Jsb2JwVUJuTCtIQTUza0lBSk8xejFWbklZQ2JlVTdadVlB?=

=?utf-8?B?QnlRS095cVpYTGp6OXVWcm9tT0NlTHJlUXZFNWJ1ZDJ2S2x2VVdqYUJnSzNG?=

=?utf-8?B?R2FhSlQvc2ltNmJUcFZoYVM2b0RJMXdlVjNPTEZLckdvMFhEalJieDB6WW01?=

=?utf-8?B?ZmQ1TEZzQWNzdmtLcnUyWm5UeXNCdnlHVCtoaDhTaTlJYzFFUnVLb053cGFr?=

=?utf-8?B?WWRYeThTV2E1ZDh5M2ZGYktmbXR6dFhBVkJEWXQvNUd6dG0vM241cG1YeTQr?=

=?utf-8?B?ZFo3K2FWU0lJVkI5Y0xTU0d1czdkOHpFQ0hyUkF2NGorOW5wTmlpRkpSb0tO?=

=?utf-8?B?V2dRak43d0c3cGVLaVowbzczMVlJQUNvb1hrTzJTUEs2UFdETTAzUGl0VEdE?=

=?utf-8?B?S0dkZXZ5a1JON0xkZVd0U1hKcFVFOU9haHY3R3h5YzZSTkFTaUxZanlXTTly?=

=?utf-8?B?NzFLRDR5djNEWW5oR25HejJJUzM2Q1FPeHZ0MWJQUXFBOFJNRDE3YnkzbEdK?=

=?utf-8?B?Um9Vd2FXTTVvakM4Y2RqNU1IWS9Va2oxbkRKK1Z5U2g1NlFJdlRtaGE2SXJY?=

=?utf-8?B?TEtCL2Y5YkdWZFRkQlNJSFNFODZjVzNvWmoxaDNRMWhQQWN5dXFrZzRxQ0M5?=

=?utf-8?B?UTF5ZEIrOWpZRmFOcHdvYlQ1L00rcHUyRDU2M21ZWTdVMmJ2TDF0UFRWWXg2?=

=?utf-8?B?OUhLQlRlajlBdHFmeUJQWmRkNnp5aElzTTR2MklhUDhwYjZJZnY4aGRwV3Bl?=

=?utf-8?B?bzYyVzZTcTR3V3hKSEt0cGh0Nk5NRFdtbHRpSXFLOWhUT1FmQk9MMWpjV2lL?=

=?utf-8?B?RlhUMkFmbGtubEZwNXBLalZNY3BnYXVyeTNjY3Z1WDlieHI4dUw5ekNPY3dH?=

=?utf-8?B?NVlzZ096eUtsdWdLRUovcjZLbW9mbytnTUdyWVhwVkU5OUJISzg4TDV6MU5k?=

=?utf-8?B?dHlEOG9aaXZ2K1NwY0t5ZnBxYVhxaWNmYklBMWlPemZXajFLcjRhTm93M2ZZ?=

=?utf-8?B?YlVPMEZoUlRtY090Mk4zd1A2YVo1eW1zWUxsdWRUdDA1MlY2RkM4T0lBYXM5?=

=?utf-8?B?cnJPWFpFU1NVUWVsbkE5VE9TcEVsVjVMMjhWVk96dFJvNy9ieTdtemVFVE5o?=

=?utf-8?B?ZUlGNDJVaUVEWjRNMlBFMUdORkllQmhXQ3hiMWpHU09pMndVb2xFUUorYkpS?=

=?utf-8?B?R2xGbS9kb1dFVXBxV2NoUi9YU2cwWk1xRmFFQTlZTnM3K1o1S1gwODZ2d1BS?=

=?utf-8?B?Rkk5ejVseDhoT3BYWHZkNDFuY1RDU1A0Wm9zeTM1dXBxNnI5ZGc4R1dGMlA4?=

=?utf-8?B?L1R3ZFMvSXhISUw5c1JHazZ1T1pxV1NwSVhMOTJMOTUrMFE1WkxLT08raXVt?=

=?utf-8?B?MnNCR0VJNFJ2c0JNNDFxSzU0d1N1cXVYRFVqcXdlMC9VUWNuVU9Mek1nMzdz?=

=?utf-8?B?VHRzaXRSN2xqRVJ5NDdodTVuTnZxNitXM1V5Z1ZvUjJteE9HMHhaUE9JWGFE?=

=?utf-8?B?TnR0dVJ0QWhFaEduQkR0MkZnTC9XSWZOYUZvR2NlS3RHY0RBVmQ1QlZPTURP?=

=?utf-8?B?a1NjWnkwendRdmh2aGx3SVIxTEs5aFpNcnJRc0V3UHRlakNtUlp1dnBJOU4x?=

=?utf-8?B?SFNQYU5vaUxmMGlSQ2JlcEFwOU50L2FYbU5LcEIvQlFuRkNWMExMY2JVM1Zv?=

=?utf-8?B?ZjZyV01EV1NzZkVvUDIyYmR1MnUwdHdzRW90SGIvTUhTanZJVzRUUmxWZFR4?=

=?utf-8?B?K3FPTEZuNHV2SHJwZGtrV1hyck1tMWdGcjNKeGtmcUxsRS9WSjJEZFo3Sjli?=

=?utf-8?B?MWVNdE53eXVaVmJJdFNVaWVYaFN6ZDk0QlBhbTFNci80TzFmUDZGaENuSXQ2?=

=?utf-8?B?T2ZIelEwVHQzODl4V3M0eW9XN083b3Ztd1F2OC9aMitzM2Z0bC9QK1pBMWpm?=

=?utf-8?B?WG1OL01LemsxVk9uc05jWmRyZUVRS20xNFJqOXF1RlVPbEhJOGN6aVhmL3Z1?=

=?utf-8?B?MDdlOFpNM3F4M0hqV0liQjFyaU8wL2k3b21Rd0NEQXFNUlRxM1NsSi9VZWJM?=

=?utf-8?B?dTAyMjdoREFNVFM1cnBLYXdLcDYybUt0ZHMxVnpPdys2dkNHRUJWWS9rZHla?=

=?utf-8?B?QkVZZ2s3b0xqUk43TktyUThVV0ZGclB5RDdOZk1CVlJ3VlphOGtBeThjUzZB?=

=?utf-8?B?UWUvNkg2S2RIL29xemthVy9OZzdrUmVzcnNMeloyL2ZZd1lGRDNDTGlDTlNI?=

=?utf-8?B?c1J3K2R3U3FTc1N1OWdnbHdLNld2dTFwNFRYN1hNL0RvL2xVM0Z0SkNuNTFX?=

=?utf-8?B?OUFCajJ6eWRFYUw3OTAzaTdPRHkzVTQ2UWRXY28vNS80UVI3eW9mSDN3dlZa?=

=?utf-8?B?ZHZlSkJhSW94QUZBZU43WHBOQTEyOUZpcm9MbFUvbkVUSzRoM3lyUHFVQVBX?=

=?utf-8?B?VlVvVUlUbm1WWG1CbjBBK1pLdVdBMEZVeDVpWW1CWGdnbE53S1ZNalFZb0F3?=

=?utf-8?B?ZStmcHdNcFdGalVoY0ExM2xidkVVVmF1eGNGcUlEY2FGcGo2MCtHSlhYbndu?=

=?utf-8?Q?DmJJR8FPYgvq5D63VR/Y7?=

X-Auto-Response-Suppress: DR, OOF, AutoReply

X-OriginatorOrg: sct-15-20-9412-4-msonline-outlook-090a5.templateTenant

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 25 Jun 2026 15:19:02.5575

(UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id: 9efdcb59-82c2-48bc-afa2-08ded2cd16ce

X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-AuthSource: MWH0EPF000C6187.namprd02.prod.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: Internet

X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH3PPF960B3E6E3

X-Spam_score: 13.7

X-Spam_score_int: 137

X-Spam_bar: +++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Geek Squad phish from Microsoft Outklook Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 25 Jun 2026 13:07:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wcpPZ-00000000Ojp-2djh

for dave@doctor.nl2k.ab.ca;

Thu, 25 Jun 2026 13:06:53 -0600

Resent-From: The Doctor

Resent-Date: Thu, 25 Jun 2026 13:06:53 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-centralusazlp17010035.outbound.protection.outlook.com ([40.93.8.35]:37329 helo=DM1PR04CU001.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wcls4-00000000CRu-0BfP

for doctor@doctor.nl2k.ab.ca;

Thu, 25 Jun 2026 09:20:19 -0600

Received: from MW4P223CA0005.NAMP223.PROD.OUTLOOK.COM (2603:10b6:303:80::10)

by PH3PPF960B3E6E3.namprd18.prod.outlook.com (2603:10b6:518:1::cb6) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.159.13; Thu, 25 Jun

2026 15:19:02 +0000

Received: from MWH0EPF000C6187.namprd02.prod.outlook.com

(2603:10b6:303:80:cafe::8f) by MW4P223CA0005.outlook.office365.com

(2603:10b6:303:80::10) with Microsoft SMTP Server (version=TLS1_3,

cipher=TLS_AES_256_GCM_SHA384) id 15.21.159.14 via Frontend Transport; Thu,

25 Jun 2026 15:19:02 +0000

Authentication-Results: spf=pass (sender IP is 209.85.221.69)

smtp.mailfrom=gmail.com; dkim=pass (signature was verified)

header.d=google.com;dkim=pass (signature was verified)

header.d=gmail.com;dmarc=pass action=none header.from=gmail.com;compauth=pass

reason=100

Received-SPF: Pass (protection.outlook.com: domain of gmail.com designates

209.85.221.69 as permitted sender) receiver=protection.outlook.com;

client-ip=209.85.221.69; helo=mail-wr1-f69.google.com; pr=C

Received: from mail-wr1-f69.google.com (209.85.221.69) by

MWH0EPF000C6187.mail.protection.outlook.com (10.167.249.119) with Microsoft

SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.181.6

via Frontend Transport; Thu, 25 Jun 2026 15:19:02 +0000

X-IncomingTopHeaderMarker:

OriginalChecksum:F141333EF5E4936557203ED4AAFFA805A6EB1FE6B9579EB1CE82575056632421;UpperCasedChecksum:B4DA9A8DBF763BDC9A17FB2740E971906B2C01EB9441C66D8DB684EE99374928;SizeAsReceived:3379;Count:15

Received: by mail-wr1-f69.google.com with SMTP id ffacd0b85a97d-4625e71d3ccso943137f8f.0

for ; Thu, 25 Jun 2026 08:19:02 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=google.com; s=20251104; t=1782400741; x=1783005541; darn=groups.outlook.com;

h=to:from:subject:date:message-id:sender:reply-to:mime-version:from

:to:cc:subject:date:message-id:reply-to;

bh=tPPb0Oa2/+Ql3OpgPPq6cmObf6tkZUsn4ifL5uC5i8I=;

b=ZI7btDFj9PmlaYlbih+FRMykMho9mIe0mhOD2QuN1Lavd4Cua+l2qdubWyg7InaYGI

m79RIDLChLBLSpunIr4SIoosEV0VRIcD8248TTma2Lq3Rc7iiHIh4akQnLzK5KcAkQwd

nPA3V/6MnvBhdAuKpa3I/M2BnvUNPkwBU2egWORCgzWpQCQZH3kGKR8Y4XbcUTPLvLjB

Qj09uHFidj5ZPLEBGq2TkVeCSbSj6dzC65SJAIZHzIPat4q5z0OjHxXqsalMzg/7W93/

DK/mzQCtzCU+ln66j54Rj5BwSUs2I07T43r9Ix44OlhORLZ9I+b7ijSDdtGvBm1rjktB

uA2w==

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1782400741; x=1783005541; darn=groups.outlook.com;

h=to:from:subject:date:message-id:sender:reply-to:mime-version:from

:to:cc:subject:date:message-id:reply-to;

bh=tPPb0Oa2/+Ql3OpgPPq6cmObf6tkZUsn4ifL5uC5i8I=;

b=MaBc7MO6miswTEVafv/ePfDPyk8hjLDZFOmfbtnygRpgPnkr9NwRQ84FFqKNa/cic0

53Y3IXawsg4mqk6es7QD8Xn6r4/3HF82SjYziLNMEElOD8aVyi1ZPUQdROLnHw+63Dh0

DWazf7xNTHLNvjrct+vHjgOXyoG+nK+CDBE07hFSORHq/n5OMzHDn0z0iGip2rwirWGL

XxD16sVJAieyDaG4Q39rXAFni2xnz56gd/O6SCc08x4maM+FEsywOpz7Q3Q1nujZJm+n

XpmIm+VztkUyxGmXCelPkR5Wp7Rjz4/0trgSSZ2UsP/JA76FaSO1/v+P4yfGI72RxBAA

k0Lw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1782400741; x=1783005541;

h=to:from:subject:date:message-id:sender:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=tPPb0Oa2/+Ql3OpgPPq6cmObf6tkZUsn4ifL5uC5i8I=;

b=RO0fQGaxgTTF/GXgGDRhy4oDacxqU22zf9JwNjAXQGKxpF4P63740n5gDaZzvMfoje

XJOOXOgJ03otfqN02O5KhM1CTUnpNSy0PzGTZVxVJc0tGh1l+j4PmpNxemUt4a+l+aGg

q7iVScCdGxTg7b5kRrhrbzB6/eMeQTuO9iMVtyq02paFKz//o6yXGcUq+HHACAh2fekl

JFViI3K0tqYGKpMIhxgsK5yMsKfsaQtUcmqIp/xO1KTZq/YXhHySUFZoHOREIu+FKe9u

PVZurRQX/fVZIPvnT3B67Nv5uWPAJ+c01rO04uVRUmxXB8Kh19jS/j/ZBqJwgQJS1GZJ

V7aA==

X-Gm-Message-State: AOJu0YzlrmOQkWUQkNoygTZ3rvmg/THUhi6UxAcKhkwnRrzdNitryrvB

E5WcrjGAyFiEwhngq2BuTbCezxREjEXWD2Qy4rAn+zcs+hmyFN7du3f0y+wmKFgYI1TqJyvkIhS

5PVtJ8nL3ln5toTJlYHAWCPt6qI5iMwXCGzo=

MIME-Version: 1.0

X-Received: by 2002:a05:600d:8497:20b0:490:af63:2cb1 with SMTP id

5b1f17b1804b1-492663e5d71mr29794855e9.7.1782400740925; Thu, 25 Jun 2026

08:19:00 -0700 (PDT)

Reply-To: Haresasz Nxysarwsa

Sender: =?UTF-8?Q?Kalend=C3=A1r_Google?=

Message-ID:

Date: Thu, 25 Jun 2026 15:19:00 +0000

Subject: =?UTF-8?Q?Pozv=C3=A1nky=3A_Secure_Geek_Squad_Renewal_Alert_=40_=C5=A1t_25=2E?=

=?UTF-8?Q?_j=C3=BAn_2026_=28cynthiaperez389903=40groups=2Eoutlook=2Ecom=29?=

From: Haresasz Nxysarwsa

To: cynthiaperez389903@groups.outlook.com

Content-Type: multipart/mixed; boundary="00000000000002ce9206551583a3"

X-IncomingHeaderCount: 15

X-EOPAttributedMessage: 0

X-EOPTenantAttributedMessage: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa:0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: MWH0EPF000C6187:EE_|PH3PPF960B3E6E3:EE_

X-MS-Office365-Filtering-Correlation-Id: 9efdcb59-82c2-48bc-afa2-08ded2cd16ce

X-MS-Exchange-EOPDirect: true

X-Sender-IP: 209.85.221.69

X-SID-PRA: HARESSAZNZXRRSXAXZ321@GMAIL.COM

X-SID-Result: PASS

X-MS-Consumer-Group-Expansion-Loop: cynthiaperez389903@groups.outlook.com

X-MS-Exchange-Group-Expansion-Loop: cynthiaperez389903@groups.outlook.com

X-Microsoft-Antispam:

Uber eats PAypal Phish from Google Gmail PArt 3

Posted by Dave Yadallee on
























































































--===============1437407769411554854==--

Uber eats PAypal Phish from Google Gmail PArt 2

Posted by Dave Yadallee on