Cabela's Phishing Part 4

Posted by Dave Yadallee on






































































Click here to see in your browser, or you can unsubscribe from all future emails.












































Â
























Cabela's Phishing Part 3

Posted by Dave Yadallee on












Preview - Welcome to Coded Mails






































Â


























































































Cabela's Phishing Part 2

Posted by Dave Yadallee on


[2603:10b6:208:238:cafe:0:0:ec listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:238:cafe:0:0:ec listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:238:cafe:0:0:ec listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:238:cafe:0:0:ec listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:238:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:238:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:238:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:238:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:238:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:238:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:238:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:238:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[52.102.146.17 listed in will-spam-for-food.eu.org]

[52.102.146.17 listed in will-spam-for-food.eu.org]

[52.102.146.17 listed in will-spam-for-food.eu.org]

[52.102.146.17 listed in will-spam-for-food.eu.org]

[52.102.146.17 listed in will-spam-for-food.eu.org]

[52.102.146.17 listed in will-spam-for-food.eu.org]

[52.102.146.17 listed in will-spam-for-food.eu.org]

[52.102.146.17 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[52.102.146.17 listed in dnsbl.ahbl.org]

[52.102.146.17 listed in dnsbl.ahbl.org]

[52.102.146.17 listed in dnsbl.ahbl.org]

[52.102.146.17 listed in dnsbl.ahbl.org]

[51.158.242.221 listed in dnsbl.ahbl.org]

[51.158.242.221 listed in dnsbl.ahbl.org]

[51.158.242.221 listed in dnsbl.ahbl.org]

[51.158.242.221 listed in dnsbl.ahbl.org]

[2603:10b6:208:238:0:0:0:7 listed in]

[dnsbl.ahbl.org]

[2603:10b6:208:238:0:0:0:7 listed in]

[dnsbl.ahbl.org]

[2603:10b6:208:238:0:0:0:7 listed in]

[dnsbl.ahbl.org]

[2603:10b6:208:238:0:0:0:7 listed in]

[dnsbl.ahbl.org]

[2603:10b6:208:238:cafe:0:0:ec listed in]

[dnsbl.ahbl.org]

[2603:10b6:208:238:cafe:0:0:ec listed in]

[dnsbl.ahbl.org]

[2603:10b6:208:238:cafe:0:0:ec listed in]

[dnsbl.ahbl.org]

[2603:10b6:208:238:cafe:0:0:ec listed in]

[dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[52.102.146.17 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[52.102.146.17 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[52.102.146.17 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[52.102.146.17 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The

query to Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[52.102.146.17 listed in sa-trusted.bondedsender.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[52.102.146.17 listed in sa-accredit.habeas.com]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[52.102.146.17 listed in list.dnswl.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[52.102.146.17 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[52.102.146.17 listed in bl.score.senderscore.com]

0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[52.102.146.17 listed in bl.score.senderscore.com]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.0 ARC_SIGNED Message has a ARC signature

0.0 ARC_VALID Message has a valid ARC signature

0.0 AXB_X_FF_SEZ_S Forefront sez this is spam

0.0 FROM_LOCAL_DIGITS From: localpart has long digit sequence

0.3 FROM_LOCAL_HEX From: localpart has long hexadecimal sequence

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.8 HTML_IMAGE_RATIO_02 BODY: HTML has a low ratio of text to image area

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

1.0 MR_DIFF_MID No description available.

1.0 FORGED_SPF_HELO No description available.

Subject: {SPAM?} Fwd: Thank You for Being a Cabela's Customer: Free Gift





Welcome to [Coded Mails]























Cabela's Phishing Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 15 Dec 2025 22:11:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vVNKt-000000004ma-1pLD

for dave@doctor.nl2k.ab.ca;

Mon, 15 Dec 2025 22:10:59 -0700

Resent-From: The Doctor

Resent-Date: Mon, 15 Dec 2025 22:10:59 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-northcentralusazhn15010017.outbound.protection.outlook.com ([52.102.146.17]:18771 helo=CH1PR05CU001.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from <2041223559565902130653366591019938794796@cfbjibs.temptingfragrances.com>)

id 1vVH0g-00000000NFG-1wyO

for doctor@nl2k.ab.ca;

Mon, 15 Dec 2025 15:25:51 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=Y9379QnFza87s3HIEov7FwbicfYqLCWmMfitURlGeFqCe6QNe//jhaJrdEAERuTiB8U46G32oC7OCHhK30aFPi5KAGy2mqqkQ/hk6CgrHxBFV3CMxX6MtPW0QrG4wCgiiTN6YdoiOgnIh5JnPkGFkY4Sbkbwa2jJe5mIQ3ukYEuTkuSMG6BFziyQzuBwEKEOCFGN8MRRmQz06xoN2JSEnpTB5+g0v8/Cq5F8lM2ltgRUq6wBzHgc7zAbvr4feizZUH+8BTswsAKVtp9AVJvaV6byr7mQgmCkwE38wouLZBHESMf28UleWht4vR1SrLnB8gTjLPth1hNZhCV/NtcqeA==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=Ed/38i5EXPqaw8C7qFluMCYn42wkof531Q9ntxnbR7I=;

b=OXoPhqJ0uBQWPxQPFrqR6e0Ctc1lGOWMHORLmCazlNB6kND+/lM+udXAtAL9RzX3bmCsTKGSBUDGzs/wQqS9K0xnSnR+aa2pOZxjj1P8+z9f1oYLOw/RAthzgFIjUyvt/p9xJ3mosaIPYmvqHAAYhGc4malpGIBd5zoj0gvpuALBeFtDTiSkb7hIwFh5g/TjuK++kNUCev0RUJfHUj0nMY+GRHCYVFVAZrrfs4s29YZRdt0VHr6SVT+mFTdQSTi+KEms+kw+K+tZUxHYj2VFUgAVgh4ItY2uv/JxaMeI7RHHyEPgr4uwd/nkA/HSXOH9wzvIxG+r7q6sSHCWsR+k+g==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none (sender ip is

51.158.242.221) smtp.rcpttodomain=nl2k.ab.ca

smtp.mailfrom=cfbjibs.temptingfragrances.com; dmarc=none action=none

header.from=cfbjibs.temptingfragrances.com; dkim=none (message not signed);

arc=none (0)

Received: from MN2PR22CA0002.namprd22.prod.outlook.com (2603:10b6:208:238::7)

by SA1PR16MB6059.namprd16.prod.outlook.com (2603:10b6:806:3b3::11) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9412.13; Mon, 15 Dec

2025 22:24:48 +0000

Received: from BL6PEPF0001AB71.namprd02.prod.outlook.com

(2603:10b6:208:238:cafe::ec) by MN2PR22CA0002.outlook.office365.com

(2603:10b6:208:238::7) with Microsoft SMTP Server (version=TLS1_3,

cipher=TLS_AES_256_GCM_SHA384) id 15.20.9412.13 via Frontend Transport; Mon,

15 Dec 2025 22:24:08 +0000

X-MS-Exchange-Authentication-Results: spf=none (sender IP is 51.158.242.221)

smtp.mailfrom=cfbjibs.temptingfragrances.com; dkim=none (message not signed)

header.d=none;dmarc=none action=none

header.from=cfbjibs.temptingfragrances.com;

Received-SPF: None (protection.outlook.com: cfbjibs.temptingfragrances.com

does not designate permitted sender hosts)

Received: from unical.it (51.158.242.221) by

BL6PEPF0001AB71.mail.protection.outlook.com (10.167.242.164) with Microsoft

SMTP Server id 15.20.9434.6 via Frontend Transport; Mon, 15 Dec 2025 22:24:47

+0000

From: Cabela's Team <668428458261290799973@cfbjibs.temptingfragrances.com>

To: doctor@nl2k.ab.ca

Subject: Fwd: Thank You for Being a Cabela's Customer: Free Gift

Message-ID: <5682682283.szby.4306800099701@urbanmindset.co>

MIME-Version: 1.0

Date: Mon, 15 Dec 2025 22:24:29 +0000

Content-Type: text/html; charset=utf-8

X-SES-Outgoing: Mon, 15 Dec 2025 22:24:29 +0000-51.158.242.221

In-Reply-To:

Errors-To: abuse@FwXEPsR16T.google.com

List-Unsubscribe:

References: <3ywv39wrz0xml2pehqnwfz@robotguidess.com>

X-EOPAttributedMessage: 0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: BL6PEPF0001AB71:EE_|SA1PR16MB6059:EE_

X-MS-Office365-Filtering-Correlation-Id: 6719e998-83dc-444c-4cde-08de3c28c1aa

X-MS-Exchange-SenderADCheck: 1

X-MS-Exchange-AntiSpam-Relay: 0

X-Microsoft-Antispam:

BCL:0;ARA:13230040|61400799027|1032899013|82310400026|4022899009|376014|36860700013|69100299015|41320700013|34020700016|2066899003|8096899003|4076899003|13003099007|16110700003;

X-Microsoft-Antispam-Message-Info:

=?utf-8?B?RFhsNDVpYzV1ZVBFVW9WM3kweFdlcGd4OGthQ3FVcUlhbUNIN2xhYU91emNS?=

=?utf-8?B?RW1tMG1vdkhyczZuU0pPeXpsRlpDN0llNkpjZDRUN2N6WWxoTk14aU9QQ1BH?=

=?utf-8?B?bWdaNUJrQmJJb3NHSldMV2hCQTVrMjYwQnlSWWp5S2xZM0hpWDAxZnNhazAy?=

=?utf-8?B?OWhzdlRJMG9FMWwzbE94WmVmNmJkejB0bk1VQnY5QnZwS0FGSFFTd1N1Mk1B?=

=?utf-8?B?TXBRSzV5RDZyYXZ6MVYrOUs3WFdUSW5Qd3I4V3dUMkNrdStNVkJsYXZNenky?=

=?utf-8?B?NDlrdHJYVklEMmMxTlBUMXlUTVVDMXA5TVFGQVRaQW5SYWdYY3FzQ2thNnRV?=

=?utf-8?B?T3AzcnErREFxQ0JMOXl6YWZJRUpqSXFSNmRDWUQrWXcrckZCY1F4U0h1andj?=

=?utf-8?B?WGtKQmd6UHl6ZnM0K1V3MW9jbm4vczIyMzdKTlZGOWVITVBTUFQ4VU9TblZV?=

=?utf-8?B?QVIwb3dZTFcwSURmZ3RqSWcxRStHdjJBMUxaOTJpcnRDZmpKNkpJYkdrMFZt?=

=?utf-8?B?WnNvVzlqRXdpWXJ5N1pOL3BBQ2UvdTluYUpzM3NNY3VYUEJmZG1NNDZITmQv?=

=?utf-8?B?NzRGSU4rdFRDd0FNU2x3K2F3UmEzaHZ1QXhrb1E2TWh5N2dXc0t6ak5BMDZy?=

=?utf-8?B?VUl2WnJTeXZmb1pwcThaWXRlUmhYYmV0dlljbWVhNzdSNU9iYktkbVB0OExY?=

=?utf-8?B?Q1o1dHNIcEFIS2lqRWRIS243WU1BK09uM05GYS9BMFUxYjBHMEk5WXBSSW1P?=

=?utf-8?B?eTZwTTcyN3VsaE9tcDVjb2xxRnEyVG9PdFV1UEltc0ZURkZOT1ZYVHlYcWlU?=

=?utf-8?B?elRhT2lTRlp2V2RlNHhjdk1HczEyRGtWY2xrdmZYd0ttbkgxVzRNbmdFeUxB?=

=?utf-8?B?Q0E2WTRKS1ptYmJieHpiZElKaVMwTXhKUS83YXduZDdDRHRRUWdMK0tCMDR6?=

=?utf-8?B?QUN2VkxSa2xmQUZhNm1FUVJic1BmRW8waUQwbStyM3pNdzBnT3oxOVRtZFdi?=

=?utf-8?B?K0tKOE9MdVJsUzRqaUdxRTYySE5ZMzQwdVhHaVhsbE53Vk1ybDhEYnNGa29H?=

=?utf-8?B?NUhOV3R4NUhkcjU0dUNvVHVVYVNiRmozOVNsRFkzbDFGOHRMY3NZU2V4VHB4?=

=?utf-8?B?MGxpZ2NCWGNxaVdDMU5pQ1ZtdTJ5NWZKeEFiRE1MMlhMNHk2UkdreHdyL1Zw?=

=?utf-8?B?ZTl1Njk5UXQrZHp3NkFMWm1FS2YzM1RUWmttOXgrakRKMHl4WDR5bDMyNVl4?=

=?utf-8?B?TlFzOWhPeDhHSitNTkZYNzdHRm1GV1VVblA5ZEVRbGdXZzJtTFk2bmxITjhP?=

=?utf-8?B?NDYwTG5iYk1nYnVmcDlKSXRhV0lWYmVQYjdCQXlQQnBzeU5COG4rK2xNN1NN?=

=?utf-8?B?eFZBcG1YNENrVThrK3NVR0hTZ1lqMG5OS0J4M1dKV1BObTJ4Ri91Sk9saGJi?=

=?utf-8?B?TGo2QXAwVWU5WXptS2srUUIwN1d5Y3VIaGR3ZHZjenpRY2ZtSm00MGpKb2Q3?=

=?utf-8?B?bjBiSk81Y253MThvL2NGbnVtb3doV3o0dVlKd2c4Z2hkK2dKeGtxNVNnMmNR?=

=?utf-8?B?dFI2QWxIK0w3WENNeWl2WWdqajgrbjUwSGd0ZFNna2ZxVVpyVE5GS2Q1UlIv?=

=?utf-8?B?NjBOWkV1VFhQYzRKdEpJZXhaMUxOd2VaRWovMENXVzhKYjdOeW5MNWYxVFZC?=

=?utf-8?B?YmJlLzRLblQ0MzFwdFk4OGVSdWFLSVBXdjBma0VReVA5T1FoaVluYndnMG1K?=

=?utf-8?B?RS9EajNNNncvTldIZ2RZdFlKdUhteW1xWXZ2ZzU2c29RWkZFam5pQ1FmTmNY?=

=?utf-8?B?WkZtMlRjd2hwd0QwcFBGOHpyRWd0bnpXR2wyQnJPbVJtdVJycGlUY1l5cFY2?=

=?utf-8?B?UEFNVU4xaUE4bG42VWdObzJYNWVvR3FKT2pBdHVpT0lJc0o1SWdmOGVGUVJq?=

=?utf-8?B?TC83NEdqNHVJV0dsSzFnTjhwUDNXQWRLUmRMYTV4K0VxZTdlOXQyWHZsdEhD?=

=?utf-8?B?dVBUMFByL3lpYlFUVmRxbGNqMHlsOUIzNFM1TTFQeVhENTFMR2VINkcvVWQ3?=

=?utf-8?B?NmtObnc0b0hYUWU2emV3eXloUW9EV0hlUVBrTk5DejllY2U4ejZnS0pxRlhj?=

=?utf-8?B?cjQrUEdwOE1Pdk83VkoxQ0piMzl2KzBtdjlQT1laRWJ3UEpDS29GZUw5SE8r?=

=?utf-8?B?VjBpZHdkNU1GemtjYVVrR3QycERkVlUrUjJGTUJDVytBYldlcFgzckc0eHJF?=

=?utf-8?B?T3kvNkRBdFhsQ29yWkd1ZC9YVkxSWjJNdHc3ektnd2pJZk43cG5jdklCN3dN?=

=?utf-8?B?VmdBcGVRYmR3M3JSd1NoL0dPK1hLSWZHVDBYUzhRbVpvNDlublFneEdaWGtB?=

=?utf-8?B?QWNMcHVBNHpURWFiVXFaaWQyblUweHlIVjhYSTRxSS9HZ3I1OVViQlJEMCto?=

=?utf-8?B?cUVsU2F6VnF0Nkd0czNkendBVzZNUitlbjFQS2FaUlB2Zm9kd1VPT24zQlNM?=

=?utf-8?B?MFh0SCtzRXdhVkx2L3BsVXRPZG13YVUzSTNNNDQrNS90aXN2cmpCR25lcFBh?=

=?utf-8?B?dUk0WmRXTHRtVGpBc3ExR0lBODVqZFhGOERpRS8rK1J6ZjRLMFpRU0FqcGQ0?=

=?utf-8?B?dGFiWVltRXdvcmN2WHNlenBSa0dkS2VRSURUR0trVUNtUjBxQ1ljakowUlh5?=

=?utf-8?B?eW9WR0JQOENmeXZ5RHZrakpTUGRtSW00cHc9PQ==?=

X-Forefront-Antispam-Report:

CIP:51.158.242.221;CTRY:NL;LANG:en;SCL:5;SRV:;IPV:NLI;SFV:SPM;H:unical.it;PTR:221-242-158-51.instances.scw.cloud;CAT:OSPM;SFS:(13230040)(61400799027)(1032899013)(82310400026)(4022899009)(376014)(36860700013)(69100299015)(41320700013)(34020700016)(2066899003)(8096899003)(4076899003)(13003099007)(16110700003);DIR:OUT;SFP:1501;

X-OriginatorOrg: cfbjibs.temptingfragrances.com

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 15 Dec 2025 22:24:47.6616

(UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id: 6719e998-83dc-444c-4cde-08de3c28c1aa

X-MS-Exchange-CrossTenant-Id: a56ba61c-afa1-4cb0-a86d-f691f8c4bec4

X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=a56ba61c-afa1-4cb0-a86d-f691f8c4bec4;Ip=[51.158.242.221];Helo=[unical.it]

X-MS-Exchange-CrossTenant-AuthSource:

BL6PEPF0001AB71.namprd02.prod.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem

X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA1PR16MB6059

X-Spam_score: 5.3

X-Spam_score_int: 53

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Welcome to [Coded Mails] Preview - Welcome to Coded Mails





Content analysis details: (5.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[51.158.242.221 listed in will-spam-for-food.eu.org]

[51.158.242.221 listed in will-spam-for-food.eu.org]

[51.158.242.221 listed in will-spam-for-food.eu.org]

[51.158.242.221 listed in will-spam-for-food.eu.org]

[51.158.242.221 listed in will-spam-for-food.eu.org]

[51.158.242.221 listed in will-spam-for-food.eu.org]

[51.158.242.221 listed in will-spam-for-food.eu.org]

[51.158.242.221 listed in will-spam-for-food.eu.org]

[2603:10b6:208:238:cafe:0:0:ec listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:238:cafe:0:0:ec listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:238:cafe:0:0:ec listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:238:cafe:0:0:ec listed in]

[will-spam-for-food.eu.org]

Cabela Phishing Part 4

Posted by Dave Yadallee on





class="" style="vertical-align:top;width:580px;"

>

























































Click here to see in your browser, or you can unsubscribe from all future emails.












































Â
























Cabela Phishing Part 3

Posted by Dave Yadallee on






Preview - Welcome to Coded Mails






































Â
















































































































Cabela Phishing Part 2

Posted by Dave Yadallee on


[2603:10b6:610:118:cafe:0:0:dc listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:118:cafe:0:0:dc listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:118:cafe:0:0:dc listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:118:cafe:0:0:dc listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:118:cafe:0:0:dc listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:118:cafe:0:0:dc listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:118:0:0:0:14 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:118:0:0:0:14 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:118:0:0:0:14 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:118:0:0:0:14 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:118:0:0:0:14 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:118:0:0:0:14 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:118:0:0:0:14 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:118:0:0:0:14 listed in]

[will-spam-for-food.eu.org]

[52.102.128.43 listed in will-spam-for-food.eu.org]

[52.102.128.43 listed in will-spam-for-food.eu.org]

[52.102.128.43 listed in will-spam-for-food.eu.org]

[52.102.128.43 listed in will-spam-for-food.eu.org]

[52.102.128.43 listed in will-spam-for-food.eu.org]

[52.102.128.43 listed in will-spam-for-food.eu.org]

[52.102.128.43 listed in will-spam-for-food.eu.org]

[52.102.128.43 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[52.102.128.43 listed in dnsbl.ahbl.org]

[52.102.128.43 listed in dnsbl.ahbl.org]

[52.102.128.43 listed in dnsbl.ahbl.org]

[52.102.128.43 listed in dnsbl.ahbl.org]

[51.158.238.185 listed in dnsbl.ahbl.org]

[51.158.238.185 listed in dnsbl.ahbl.org]

[51.158.238.185 listed in dnsbl.ahbl.org]

[51.158.238.185 listed in dnsbl.ahbl.org]

[2603:10b6:610:118:cafe:0:0:dc listed in]

[dnsbl.ahbl.org]

[2603:10b6:610:118:cafe:0:0:dc listed in]

[dnsbl.ahbl.org]

[2603:10b6:610:118:cafe:0:0:dc listed in]

[dnsbl.ahbl.org]

[2603:10b6:610:118:cafe:0:0:dc listed in]

[dnsbl.ahbl.org]

[2603:10b6:610:118:0:0:0:14 listed in]

[dnsbl.ahbl.org]

[2603:10b6:610:118:0:0:0:14 listed in]

[dnsbl.ahbl.org]

[2603:10b6:610:118:0:0:0:14 listed in]

[dnsbl.ahbl.org]

[2603:10b6:610:118:0:0:0:14 listed in]

[dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[52.102.128.43 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[52.102.128.43 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[52.102.128.43 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[52.102.128.43 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[52.102.128.43 listed in list.dnswl.org]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.0 ARC_SIGNED Message has a ARC signature

0.0 ARC_VALID Message has a valid ARC signature

0.0 AXB_X_FF_SEZ_S Forefront sez this is spam

0.0 FROM_LOCAL_DIGITS From: localpart has long digit sequence

0.3 FROM_LOCAL_HEX From: localpart has long hexadecimal sequence

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[52.102.128.43 listed in wl.mailspike.net]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.8 HTML_IMAGE_RATIO_02 BODY: HTML has a low ratio of text to image area

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

1.0 FORGED_SPF_HELO No description available.

1.0 MR_DIFF_MID No description available.

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

Subject: {SPAM?} Fwd: Your Input Needed: Earn a Free Yeti Outdoor Bundle





Welcome to [Coded Mails]





























Cabela Phishing Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 15 Dec 2025 22:11:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vVNKl-000000004m3-1q7W

for dave@doctor.nl2k.ab.ca;

Mon, 15 Dec 2025 22:10:51 -0700

Resent-From: The Doctor

Resent-Date: Mon, 15 Dec 2025 22:10:51 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-westusazhn15012043.outbound.protection.outlook.com ([52.102.128.43]:23035 helo=SJ2PR03CU001.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from <5506879422713878072699002120745806614045@cfbjibs.temptingfragrances.com>)

id 1vVH4D-00000000NQz-1snZ

for root@nk.ca;

Mon, 15 Dec 2025 15:29:30 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=tHXDKVQyCcwVc9FL7FOMJuF3R4k2opbKvT6OPCW7abhiVCzwBrS7feAYu3fvRUOfE7PCXnxjPl6GRpYQKzekecEuCMMAoVzydUnT1iKytGzQ1MfWl95ubrPGVxXsYFTpfG51cVPfLEJPIkzs02xSQLanSStPXspvaf5kYOs6zj+7vRGTCtJHQQlW+RzFajPV9nm3npWpsJTZqNdu/HkkA4PJEZl1YaJFyVV1YnHI4DyhIWYlixgMeX6QCopem+YReRbRRA6Q5QhIDq3IfT3HjYdKdVxncuNCnixzn1U4U1h78OffJR/x8giUhHvAgapIOGFHPmLZmt3SpvwJPrWxOw==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=IgtuY08MpbC9KnUsiuGlKeQZ1TABpxbyhNRAv3yLs+Q=;

b=VzBg/aWc3CvMNubfK1SQFNUMbQKnGPfYlEsoF5eMEpGhsOmqXegTaiEHzWl7wpGbklqZYowuivn54ZEUV7ljnUJIb96wvL+6r7mrE9fLodoh8fAICBj4gu1OHdUP8EMPpfRlsQxbffzRkTC0VwEPplW8/HSemHpeSfIXK78vnlxj/fsHHGM61lHVtvC8aAyqSathsZsyKCw5Re9VdXMzxDvhRvN8rEi5Tmczn63ndMt+YshgWReQBfA4HUcgZOye40+qvMyfzPgRb+uHoayakE+bvltd0X9Zgpyrw2uRowm0+W2UG8nwi2fJEJXKImJw8NoW8jaHIAbMOt8QGCVspw==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none (sender ip is

51.158.238.185) smtp.rcpttodomain=nk.ca

smtp.mailfrom=cfbjibs.temptingfragrances.com; dmarc=none action=none

header.from=cfbjibs.temptingfragrances.com; dkim=none (message not signed);

arc=none (0)

Received: from CH0PR03CA0328.namprd03.prod.outlook.com (2603:10b6:610:118::14)

by PH0PR16MB4735.namprd16.prod.outlook.com (2603:10b6:510:144::17) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9412.13; Mon, 15 Dec

2025 22:28:28 +0000

Received: from CH3PEPF00000011.namprd21.prod.outlook.com

(2603:10b6:610:118:cafe::dc) by CH0PR03CA0328.outlook.office365.com

(2603:10b6:610:118::14) with Microsoft SMTP Server (version=TLS1_3,

cipher=TLS_AES_256_GCM_SHA384) id 15.20.9412.13 via Frontend Transport; Mon,

15 Dec 2025 22:28:28 +0000

X-MS-Exchange-Authentication-Results: spf=none (sender IP is 51.158.238.185)

smtp.mailfrom=cfbjibs.temptingfragrances.com; dkim=none (message not signed)

header.d=none;dmarc=none action=none

header.from=cfbjibs.temptingfragrances.com;

Received-SPF: None (protection.outlook.com: cfbjibs.temptingfragrances.com

does not designate permitted sender hosts)

Received: from unical.it (51.158.238.185) by

CH3PEPF00000011.mail.protection.outlook.com (10.167.244.116) with Microsoft

SMTP Server id 15.20.9456.0 via Frontend Transport; Mon, 15 Dec 2025 22:28:27

+0000

From: Cabela's Special Offer <3658666603780218298437@cfbjibs.temptingfragrances.com>

To: root@nk.ca

Subject: Fwd: Your Input Needed: Earn a Free Yeti Outdoor Bundle

Message-ID: <2917299711.5cpt.6937884175113@urbanmindset.co>

MIME-Version: 1.0

Date: Mon, 15 Dec 2025 22:24:24 +0000

Content-Type: text/html; charset=utf-8

X-SES-Outgoing: Mon, 15 Dec 2025 22:24:24 +0000-51.158.238.185

In-Reply-To:

Errors-To: abuse@CEaxkAqqxN.google.com

List-Unsubscribe:

References: <68x7llcifnfl8narhnorw3@robotguidess.com>

X-EOPAttributedMessage: 0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: CH3PEPF00000011:EE_|PH0PR16MB4735:EE_

X-MS-Office365-Filtering-Correlation-Id: 4a6c78ed-7685-4efd-833f-08de3c2944fa

X-MS-Exchange-SenderADCheck: 1

X-MS-Exchange-AntiSpam-Relay: 0

X-Microsoft-Antispam:

BCL:0;ARA:13230040|34020700016|376014|41320700013|36860700013|61400799027|1032899013|4022899009|82310400026|69100299015|2066899003|4076899003|8096899003|13003099007|16110700003;

X-Microsoft-Antispam-Message-Info:

=?utf-8?B?UjBSOE5sSjg3VHN0ODQ2UTRtYlRpWW53MlFIVTF6Q3R3SEt1UHoxUmh1NFdy?=

=?utf-8?B?aGt3YzBrYkNTZEF5NXIvUHVnRytpdXJpYjFHbzZNcTJObUIxcjA3cWFhdlo4?=

=?utf-8?B?YVBuY1dLY2U5RUJudW9kQ3JuRUUvYjR1V01uVFVuYWIwa0FlTDZDNUV6ZVNM?=

=?utf-8?B?bnU5eDU3VEZXamZvNS9BUkpJQkNIVVcrcEtHV0hBQUkrK0VuNUhJUUpRUHRz?=

=?utf-8?B?Slptd1Z5QzF1ZzRpOHpDcVhWN3ZoT0pSOE9US2hoUis1U0thM0M4T0xzbWN0?=

=?utf-8?B?ZW55dURQVXZURTlsVC9NUzMvT3N0QTlZMmNxQVhnbW5IWmViUUtKdXdZRUNP?=

=?utf-8?B?SHJGUEIvS3pyQnVhS1ZmOHJwalMrUGZWZElzVlUwS1VZS2h1bXR0bEFwcUZz?=

=?utf-8?B?VWhna0h4SU02bHZUZDhGTGhiRGs0TDFuS05FcDI5eXRRRlBqb0hMTjBpTCtO?=

=?utf-8?B?SWV0TDhxWWRzUWxmalRaUkhpNEswTkY1Q25mVEdUQTh0cDFVVk5HSWRnV2J3?=

=?utf-8?B?a2xMU2FROVNKdHp4ci8wZll4S0d5dWRET3oycDF1S2VUMnhZazBENGxycWVu?=

=?utf-8?B?ZEhuR24xN2QrcVFjVExWOENQNmZld3FhT3F3d2xOandIY1l4dW5TUC9VSFpQ?=

=?utf-8?B?dlRlRFAzMDJnbk9QSDVaeEJ4N2FZQVRhb1BPUlM1Vys1SDlJWHFhOENJUnVI?=

=?utf-8?B?R0taL0c3OUJla0MzWEZ0NlZEelE0c2Q0NkFIVVBnK3czcEk0UWZVaXIzZ1Fx?=

=?utf-8?B?c09QNklkekVFL1h1ZjlPOUNzUHNURWlBVVpmc1BPaGRVeHhsR1BFQjFxME9R?=

=?utf-8?B?MFpvcnpmN1BETFc4d1BkZFR2Q2JCZUZUMnNtcEpUK2Q4YVh3aWZ1b3VJUC8x?=

=?utf-8?B?d1lwZ2ZXUG1uV2twQXRWeVA1TDBHd1IzRWZDNmY0VU9XdTBTeXo3SVFDb3Jm?=

=?utf-8?B?YmtVeWN4ZG9wNkNpUU5ZcTlZK2tsY2JLSTdkLytSOXBncEdXdUs0cnNhUjlT?=

=?utf-8?B?ckZKdUNidHNkNE52QXJIWEduY0tXT3BxVDVpd0ZnNy96NVk4RldMaVRsRlU3?=

=?utf-8?B?dDBIVDM5bHpnVmFKZkV2RE42SXhKOXBJWFZBbHlmZXJTTVU5SHd5dDhWd0Zn?=

=?utf-8?B?bk9rd0dkYnBYR3E1aCtsRjFwbmdNYTFkeHNlSU9pNTQ1TU1Qd3pzbXhqZUpl?=

=?utf-8?B?b1hZb0sxbURIQmdrVzlWelZkbnZsaEZCbWFMaStTc2RveWRaNk1oOW9CeEFH?=

=?utf-8?B?dE5JMWpsMzYva2hOWEJZRlA3M2JyRXQ0eVJsYkF4T25RY3VjQUc1dmZMME9Y?=

=?utf-8?B?ckQwTXRWSTVjbHYxOU9NNURQSDNna293L0N2d0R5TjQwbGdQbldUQ2hLUHpG?=

=?utf-8?B?aWlCL3F5RWcxK3JiT0p2RWczMmVnbCtQSDVmcnNkTVBnZ2VhbE91NzFJcitz?=

=?utf-8?B?VGRNeWNZWkY0cWFoa0N4TFArSVlHcnYwVExER3VVZVh0UzUzV2xOZVppVlRQ?=

=?utf-8?B?STdyc2tzUFh3TkdqTWVCbTNwTFpBMHhmQk9PeklsbGMzUG5jQy9iV05OcnB3?=

=?utf-8?B?Y1p4YmluNWQzRndDcWpmWitjRVhYQVZmWWtvSFpzaWcvYnMxanBPZXIvcXdr?=

=?utf-8?B?SG96UWRCTUhIbzA0TEhIdWxPTS93amxBeUZ1a1NQZUhNYmdEdDF5WDd3c3dj?=

=?utf-8?B?ZGgrUSt0UFJpUlBlZEt1OEtyeHRUdit5dWtSdS94d2Vtd0dZdllLaUJZanJh?=

=?utf-8?B?WWFSR1dZb0VKcVh4dlFQTndvQ3A5R0lMMzZhS1U0LzY3bEhnODUvQWd6WUVY?=

=?utf-8?B?alRPOUdpUnNVNjZ0VTNZaHFzTjNubVRTNE9Hay8vMEcwMFRPUUZHMWNhYnpx?=

=?utf-8?B?UGpyNnAwK25QM05FcHR4VG05bHNYb2VtTUZ5QllOTmpIZ3ZlZysxUEVrbldn?=

=?utf-8?B?L2k0cUxjS2NBTzVTS2NkWkE4dDN0Z2t3eG5GVEdsVUNDUm16ZVVncUt2cmVW?=

=?utf-8?B?dHZKUmN0WVArRkRjeTJmVG8xOThvdWhVejhvTEVQZjluVGM3VjFNUmpVdi90?=

=?utf-8?B?UktWaytacnM3b1BpYnE3WnY4T08zVzVsN0VyYlV0b1BYZitvQTIzeUNjODcx?=

=?utf-8?B?ZndDKzlqdHdMem9rNzlWRjVBNzY4YnJxaFV3bGRybkcrUUVkVFpmZVhIRWlQ?=

=?utf-8?B?UUpqZkRsVjY2c3NNUGNMTy8rN3BqNCtQK0wwKy9IMDUrTkhuSmpQME9yUEdR?=

=?utf-8?B?L0F3QitmRTVhNGFPSjM4L09kL2J1SXpDV1FYNTFFK3FwYVNaRGhxam9mNGZZ?=

=?utf-8?B?bW9zVFBFaXFyTWRCcEJlNXcyWEdYOHRjZjZ4MzFLSXFlMzVLRVlvdHM0ZW9h?=

=?utf-8?B?blo0ZVhjM1daTW80MVR2a2ROUGxwQUFleWZxVXlLNkxQRXdITk10bnpyMVBh?=

=?utf-8?B?d3hxMTZaRURISE5FblN3MzVjcGI4VXVTbjFoZFgwN1czSUNrNE9sUW5zeU1s?=

=?utf-8?B?djY2VERMNzQ2ZWMwZkVaaHlJaEpkdFBzQnI1dmQ3ZkZmNEFrTS8zMEhsS3Z5?=

=?utf-8?B?MVRsV3NkS1hqajVBVFpZZW1QUUFaczc0VzZhMS80SE9yUTZIWjJtMzFUVTZr?=

=?utf-8?B?dmMzUkxvbytsT05CNXhzS09VYlcwb0UvY2RaT0p6YnBZL0UvZ2pDWTNaZ29C?=

=?utf-8?B?cmlxbnZIazBkK1YyUVMwM0twRDgyajVXU0E9PQ==?=

X-Forefront-Antispam-Report:

CIP:51.158.238.185;CTRY:NL;LANG:en;SCL:5;SRV:;IPV:NLI;SFV:SPM;H:unical.it;PTR:185-238-158-51.instances.scw.cloud;CAT:OSPM;SFS:(13230040)(34020700016)(376014)(41320700013)(36860700013)(61400799027)(1032899013)(4022899009)(82310400026)(69100299015)(2066899003)(4076899003)(8096899003)(13003099007)(16110700003);DIR:OUT;SFP:1501;

X-OriginatorOrg: cfbjibs.temptingfragrances.com

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 15 Dec 2025 22:28:27.9264

(UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id: 4a6c78ed-7685-4efd-833f-08de3c2944fa

X-MS-Exchange-CrossTenant-Id: a56ba61c-afa1-4cb0-a86d-f691f8c4bec4

X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=a56ba61c-afa1-4cb0-a86d-f691f8c4bec4;Ip=[51.158.238.185];Helo=[unical.it]

X-MS-Exchange-CrossTenant-AuthSource:

CH3PEPF00000011.namprd21.prod.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem

X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH0PR16MB4735

X-Spam_score: 9.8

X-Spam_score_int: 98

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Welcome to [Coded Mails] Preview - Welcome to Coded Mails





Content analysis details: (9.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[51.158.238.185 listed in will-spam-for-food.eu.org]

[51.158.238.185 listed in will-spam-for-food.eu.org]

[51.158.238.185 listed in will-spam-for-food.eu.org]

[51.158.238.185 listed in will-spam-for-food.eu.org]

[51.158.238.185 listed in will-spam-for-food.eu.org]

[51.158.238.185 listed in will-spam-for-food.eu.org]

[51.158.238.185 listed in will-spam-for-food.eu.org]

[51.158.238.185 listed in will-spam-for-food.eu.org]

[2603:10b6:610:118:cafe:0:0:dc listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:118:cafe:0:0:dc listed in]

[will-spam-for-food.eu.org]

Credential phishing

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 15 Dec 2025 22:09:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vVNIb-000000004ab-2voJ

for dave@doctor.nl2k.ab.ca;

Mon, 15 Dec 2025 22:08:37 -0700

Resent-From: The Doctor

Resent-Date: Mon, 15 Dec 2025 22:08:37 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from web6.fvds.ru ([83.136.232.195]:51586)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vVC7J-000000006Gr-2amF

for doctor@netknow.ca;

Mon, 15 Dec 2025 10:12:21 -0700

Received: from hotlider by web6.fvds.ru with local (Exim 4.92)

(envelope-from )

id 1vVC6Z-000mbV-3V

for doctor@netknow.ca; Mon, 15 Dec 2025 20:11:27 +0300

To: doctor@netknow.ca

Subject: InMail: You have 11 messages on hold 12/15/2025 08:11:27 pm.

Date: Mon, 15 Dec 2025 20:11:27 +0300

From: =?UTF-8?B?QWRtaW5pc3RyYXRvciDinKo=?=

Message-ID: <8106416f46e0dfc7193515579b10341b@hotlider.ru>

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="b1_8106416f46e0dfc7193515579b10341b"

Content-Transfer-Encoding: 8bit

X-Spam_score: 8.8

X-Spam_score_int: 88

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: e�-�A�l�e�r�t Ti�ck�e�t N�o�tiϲ�

(#33511398550537980147742) Message Restriction P�o�r�t�a�l



Content analysis details: (8.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[83.136.232.195 listed in will-spam-for-food.eu.org]

[83.136.232.195 listed in will-spam-for-food.eu.org]

[83.136.232.195 listed in will-spam-for-food.eu.org]

[83.136.232.195 listed in will-spam-for-food.eu.org]

[83.136.232.195 listed in will-spam-for-food.eu.org]

[83.136.232.195 listed in will-spam-for-food.eu.org]

[83.136.232.195 listed in will-spam-for-food.eu.org]

[83.136.232.195 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[83.136.232.195 listed in dnsbl.ahbl.org]

[83.136.232.195 listed in dnsbl.ahbl.org]

[83.136.232.195 listed in dnsbl.ahbl.org]

[83.136.232.195 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[83.136.232.195 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[83.136.232.195 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[83.136.232.195 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[83.136.232.195 listed in dnsbl.ahbl.org]

0.1 URIBL_SBL_A Contains URL's A record listed in the SBL blocklist

[URI: ec46.ru/62.109.1.44]

0.1 URIBL_CSS_A Contains URL's A record listed in the Spamhaus CSS

blocklist

[URI: ec46.ru/62.109.1.44]

1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)

0.0 FROM_LOCAL_DIGITS From: localpart has long digit sequence

0.3 FROM_LOCAL_HEX From: localpart has long hexadecimal sequence

2.3 MANGLED_LOW BODY: mangled low

0.0 T_MXG_EMAIL_FRAG BODY: URI with email in fragment

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_IMAGE_ONLY_32 BODY: HTML: images with 2800-3200 bytes of words

0.0 HTML_MESSAGE BODY: HTML included in message

Subject: {SPAM?} InMail: You have 11 messages on hold 12/15/2025 08:11:27 pm.



This is a multi-part message in MIME format.



--b1_8106416f46e0dfc7193515579b10341b

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit

























e­-­A­l­e­r­t Ti­ck­e­t N­o­tiϲå (#33511398550537980147742)



Message Restriction P­o­r­t­a­l



11 nåw måssàgås hàvå båån put on hold from gåtting to your doctor@netknow.ca inbox .



Uså thå T­A­B bål­o­w t­o rålåàså thåm to your inbox.















Release Messages



Thanks,



Administrator.Legal Disclaimer: This e-mail message and any attachments

may contain legally privileged, confidential or proprietary

information. If you are not the intended recipient(s), or the employee

or agent responsible for delivery of this message to the intended

recipient(s), you are hereby notified that any dissemination,

distribution or copying of this e-mail message is strictly prohibited.

If you have received this message in error, please immediately notify

the sender and delete this e-mail message

from your computer.









--b1_8106416f46e0dfc7193515579b10341b

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: 8bit

















































e­-­A­l­e­r­t Ti­ck­e­t N­o­tiϲå (#4463642824358856110)
Message Restriction P­o­r­t­a­l
11 nåw måssàgås hàvå båån put on hold from gåtting to your doctor@netknow.ca inbox .
Uså thå T­A­B bål­o­w t­o rålåàså thåm to your inbox.












Release Messages
Thanks,
Administrator.

Legal Disclaimer: This e-mail message and any attachments

may contain legally privileged, confidential or proprietary

information. If you are not the intended recipient(s), or the employee

or agent responsible for delivery of this message to the intended

recipient(s), you are hereby notified that any dissemination,

distribution or copying of this e-mail message is strictly prohibited.

If you have received this message in error, please immediately notify

the sender and delete this e-mail message

from your computer.














--b1_8106416f46e0dfc7193515579b10341b--



Credential phishing from Russia

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 15 Dec 2025 22:09:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vVNIW-000000004aP-24Sz

for dave@doctor.nl2k.ab.ca;

Mon, 15 Dec 2025 22:08:32 -0700

Resent-From: The Doctor

Resent-Date: Mon, 15 Dec 2025 22:08:32 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from web6.fvds.ru ([83.136.232.195]:42010)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vVC6g-000000006CU-0b5j

for www@nl2k.ab.ca;

Mon, 15 Dec 2025 10:11:42 -0700

Received: from hotlider by web6.fvds.ru with local (Exim 4.92)

(envelope-from )

id 1vVC5u-000kYH-8w

for www@nl2k.ab.ca; Mon, 15 Dec 2025 20:10:46 +0300

To: www@nl2k.ab.ca

Subject: InMail: You have 11 messages on hold 12/15/2025 08:10:46 pm.

Date: Mon, 15 Dec 2025 20:10:46 +0300

From: =?UTF-8?B?QWRtaW5pc3RyYXRvciDinKo=?=

Message-ID: <0aee53b17cb0a1d5b505994c82c80cea@hotlider.ru>

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="b1_0aee53b17cb0a1d5b505994c82c80cea"

Content-Transfer-Encoding: 8bit

X-Spam_score: 8.8

X-Spam_score_int: 88

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: e�-�A�l�e�r�t Ti�ck�e�t N�o�tiϲ�

(#55561601618125061157221) Message Restriction P�o�r�t�a�l



Content analysis details: (8.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[83.136.232.195 listed in will-spam-for-food.eu.org]

[83.136.232.195 listed in will-spam-for-food.eu.org]

[83.136.232.195 listed in will-spam-for-food.eu.org]

[83.136.232.195 listed in will-spam-for-food.eu.org]

[83.136.232.195 listed in will-spam-for-food.eu.org]

[83.136.232.195 listed in will-spam-for-food.eu.org]

[83.136.232.195 listed in will-spam-for-food.eu.org]

[83.136.232.195 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[83.136.232.195 listed in dnsbl.ahbl.org]

[83.136.232.195 listed in dnsbl.ahbl.org]

[83.136.232.195 listed in dnsbl.ahbl.org]

[83.136.232.195 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[83.136.232.195 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[83.136.232.195 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[83.136.232.195 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[83.136.232.195 listed in dnsbl.ahbl.org]

0.1 URIBL_SBL_A Contains URL's A record listed in the SBL blocklist

[URI: ec46.ru/62.109.1.44]

0.1 URIBL_CSS_A Contains URL's A record listed in the Spamhaus CSS

blocklist

[URI: ec46.ru/62.109.1.44]

1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)

0.0 FROM_LOCAL_DIGITS From: localpart has long digit sequence

0.3 FROM_LOCAL_HEX From: localpart has long hexadecimal sequence

2.3 MANGLED_LOW BODY: mangled low

0.0 T_MXG_EMAIL_FRAG BODY: URI with email in fragment

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_IMAGE_ONLY_32 BODY: HTML: images with 2800-3200 bytes of words

0.0 HTML_MESSAGE BODY: HTML included in message

Subject: {SPAM?} InMail: You have 11 messages on hold 12/15/2025 08:10:46 pm.



This is a multi-part message in MIME format.



--b1_0aee53b17cb0a1d5b505994c82c80cea

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit

























e­-­A­l­e­r­t Ti­ck­e­t N­o­tiϲå (#55561601618125061157221)



Message Restriction P­o­r­t­a­l



11 nåw måssàgås hàvå båån put on hold from gåtting to your www@nl2k.ab.ca inbox .



Uså thå T­A­B bål­o­w t­o rålåàså thåm to your inbox.















Release Messages



Thanks,



Administrator.Legal Disclaimer: This e-mail message and any attachments

may contain legally privileged, confidential or proprietary

information. If you are not the intended recipient(s), or the employee

or agent responsible for delivery of this message to the intended

recipient(s), you are hereby notified that any dissemination,

distribution or copying of this e-mail message is strictly prohibited.

If you have received this message in error, please immediately notify

the sender and delete this e-mail message

from your computer.









--b1_0aee53b17cb0a1d5b505994c82c80cea

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: 8bit

















































e­-­A­l­e­r­t Ti­ck­e­t N­o­tiϲå (#297528221767615560037452)
Message Restriction P­o­r­t­a­l
11 nåw måssàgås hàvå båån put on hold from gåtting to your www@nl2k.ab.ca inbox .
Uså thå T­A­B bål­o­w t­o rålåàså thåm to your inbox.












Release Messages
Thanks,
Administrator.

Legal Disclaimer: This e-mail message and any attachments

may contain legally privileged, confidential or proprietary

information. If you are not the intended recipient(s), or the employee

or agent responsible for delivery of this message to the intended

recipient(s), you are hereby notified that any dissemination,

distribution or copying of this e-mail message is strictly prohibited.

If you have received this message in error, please immediately notify

the sender and delete this e-mail message

from your computer.














--b1_0aee53b17cb0a1d5b505994c82c80cea--






































Yeti Outdoor phish from Microsoft Outlook Part 2

Posted by Dave Yadallee on
Content analysis details: (9.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[51.158.242.221 listed in will-spam-for-food.eu.org]

[51.158.242.221 listed in will-spam-for-food.eu.org]

[51.158.242.221 listed in will-spam-for-food.eu.org]

[51.158.242.221 listed in will-spam-for-food.eu.org]

[51.158.242.221 listed in will-spam-for-food.eu.org]

[51.158.242.221 listed in will-spam-for-food.eu.org]

[51.158.242.221 listed in will-spam-for-food.eu.org]

[51.158.242.221 listed in will-spam-for-food.eu.org]

[2603:10b6:208:91:cafe:0:0:a2 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:91:cafe:0:0:a2 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:91:cafe:0:0:a2 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:91:cafe:0:0:a2 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:91:cafe:0:0:a2 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:91:cafe:0:0:a2 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:91:cafe:0:0:a2 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:91:cafe:0:0:a2 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:91:0:0:0:12 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:91:0:0:0:12 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:91:0:0:0:12 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:91:0:0:0:12 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:91:0:0:0:12 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:91:0:0:0:12 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:91:0:0:0:12 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:91:0:0:0:12 listed in]

[will-spam-for-food.eu.org]

[52.102.139.20 listed in will-spam-for-food.eu.org]

[52.102.139.20 listed in will-spam-for-food.eu.org]

[52.102.139.20 listed in will-spam-for-food.eu.org]

[52.102.139.20 listed in will-spam-for-food.eu.org]

[52.102.139.20 listed in will-spam-for-food.eu.org]

[52.102.139.20 listed in will-spam-for-food.eu.org]

[52.102.139.20 listed in will-spam-for-food.eu.org]

[52.102.139.20 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[51.158.242.221 listed in dnsbl.ahbl.org]

[51.158.242.221 listed in dnsbl.ahbl.org]

[51.158.242.221 listed in dnsbl.ahbl.org]

[51.158.242.221 listed in dnsbl.ahbl.org]

[52.102.139.20 listed in dnsbl.ahbl.org]

[52.102.139.20 listed in dnsbl.ahbl.org]

[52.102.139.20 listed in dnsbl.ahbl.org]

[52.102.139.20 listed in dnsbl.ahbl.org]

[2603:10b6:208:91:cafe:0:0:a2 listed in]

[dnsbl.ahbl.org]

[2603:10b6:208:91:cafe:0:0:a2 listed in]

[dnsbl.ahbl.org]

[2603:10b6:208:91:cafe:0:0:a2 listed in]

[dnsbl.ahbl.org]

[2603:10b6:208:91:cafe:0:0:a2 listed in]

[dnsbl.ahbl.org]

[2603:10b6:208:91:0:0:0:12 listed in]

[dnsbl.ahbl.org]

[2603:10b6:208:91:0:0:0:12 listed in]

[dnsbl.ahbl.org]

[2603:10b6:208:91:0:0:0:12 listed in]

[dnsbl.ahbl.org]

[2603:10b6:208:91:0:0:0:12 listed in]

[dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[51.158.242.221 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[51.158.242.221 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[51.158.242.221 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[51.158.242.221 listed in dnsbl.ahbl.org]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.0 ARC_SIGNED Message has a ARC signature

0.0 ARC_VALID Message has a valid ARC signature

0.0 AXB_X_FF_SEZ_S Forefront sez this is spam

0.0 FROM_LOCAL_DIGITS From: localpart has long digit sequence

0.3 FROM_LOCAL_HEX From: localpart has long hexadecimal sequence

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[52.102.139.20 listed in list.dnswl.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[52.102.139.20 listed in wl.mailspike.net]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.8 HTML_IMAGE_RATIO_02 BODY: HTML has a low ratio of text to image area

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

1.0 FORGED_SPF_HELO No description available.

1.0 MR_DIFF_MID No description available.

Subject: {SPAM?} Fwd: Your Chance to Get a Free Yeti Outdoor Bundle





Welcome to [Coded Mails]





































Preview - Welcome to Coded Mails






































Â














Yeti Outdoor phish from Microsoft Outlook Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path: <5476569651558950566674166203320084343297@cfbjibs.temptingfragrances.com>

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 15 Dec 2025 15:26:58 -0700

Received: from mail-centralusazhn15011020.outbound.protection.outlook.com ([52.102.139.20]:32402 helo=DM5PR21CU001.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from <5476569651558950566674166203320084343297@cfbjibs.temptingfragrances.com>)

id 1vVH1g-00000000NHp-2lKW

for dave@doctor.nl2k.ab.ca;

Mon, 15 Dec 2025 15:26:53 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=FQFXrLw92mj3OqIJusABA9lv7k7Wfc4NdznQITiuCUGrPTFR03wEaYBcyDQQkIuIVJY3gFmW47V25qHbL7so2lOp8/WMpcU1i5KG6latFDZ+Xd33bv6KuMCuqp41BLeBeXCXG+4KjHpZdv5gzk4zY18eQVBbDU23tXZtjLR/uN8KULrvf1nze3AMsRg1GAkeRwPWn98AMIBe0qcq+OIDPcOTBAFBf8ZHqXs+q+XSyVBFCAOlUjTH3vPjz7g4UyE8h1R2C6/F/tApfVH6qLNkc+quLGUpXHe4k0VDyJUV+x8U0/BpsYDZSqOzyJhOLbgxjRDQGQxHOU5YMpN52hq5Wg==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=OLAyeekT9ZtN/Cn6zu3qPSXB5OlEh0l5XNPu8KUGylc=;

b=nY01b4bLCTOI+SBURXyWfx1gS62q/FT6XHKRrMlYpB3B219Y5AjcJds7hlVENp9pEBY5vIIzrcCrtbO5uPL71+pf8ouqhd9cOigNz+gOwa+Ao8DZ3dR37LLowgDvCyQhPdmt0sPWe3Pwfxk50msl7JAIYEOSW+3Ao/SWtyNdnoV4dltM7RwMFueN6kxF3Um4DhnvOOMuzM904uvFh/sh7yvzAOVhLbzwlTyJoGVz9BfG89zvOMP8JJ9GRl0+vyZglaoKu6H7DU82aM9QglOShgfuKU903ROPiLqfvTxkR4OPsMwDZdlF+s7Ops4ieK9YDtHal1eJWayRBiE9QoBF5g==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none (sender ip is

51.158.242.221) smtp.rcpttodomain=doctor.nl2k.ab.ca

smtp.mailfrom=cfbjibs.temptingfragrances.com; dmarc=none action=none

header.from=cfbjibs.temptingfragrances.com; dkim=none (message not signed);

arc=none (0)

Received: from BL0PR05CA0002.namprd05.prod.outlook.com (2603:10b6:208:91::12)

by LV8PR16MB6672.namprd16.prod.outlook.com (2603:10b6:408:265::16) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9412.13; Mon, 15 Dec

2025 22:25:50 +0000

Received: from BL6PEPF0001AB76.namprd02.prod.outlook.com

(2603:10b6:208:91:cafe::a2) by BL0PR05CA0002.outlook.office365.com

(2603:10b6:208:91::12) with Microsoft SMTP Server (version=TLS1_3,

cipher=TLS_AES_256_GCM_SHA384) id 15.20.9434.6 via Frontend Transport; Mon,

15 Dec 2025 22:25:50 +0000

X-MS-Exchange-Authentication-Results: spf=none (sender IP is 51.158.242.221)

smtp.mailfrom=cfbjibs.temptingfragrances.com; dkim=none (message not signed)

header.d=none;dmarc=none action=none

header.from=cfbjibs.temptingfragrances.com;

Received-SPF: None (protection.outlook.com: cfbjibs.temptingfragrances.com

does not designate permitted sender hosts)

Received: from unical.it (51.158.242.221) by

BL6PEPF0001AB76.mail.protection.outlook.com (10.167.242.169) with Microsoft

SMTP Server id 15.20.9434.6 via Frontend Transport; Mon, 15 Dec 2025 22:25:49

+0000

From: Cabela's Survey Invitation <661946083528476614@cfbjibs.temptingfragrances.com>

To: dave@doctor.nl2k.ab.ca

Subject: Fwd: Your Chance to Get a Free Yeti Outdoor Bundle

Message-ID: <6141335350.cdrr.3937905777293@urbanmindset.co>

MIME-Version: 1.0

Date: Mon, 15 Dec 2025 22:24:35 +0000

Content-Type: text/html; charset=utf-8

X-SES-Outgoing: Mon, 15 Dec 2025 22:24:35 +0000-51.158.242.221

In-Reply-To:

Errors-To: abuse@qYS0rmDscs.google.com

List-Unsubscribe:

References:

X-EOPAttributedMessage: 0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: BL6PEPF0001AB76:EE_|LV8PR16MB6672:EE_

X-MS-Office365-Filtering-Correlation-Id: d38049e7-5359-43d4-197f-08de3c28e6a9

X-MS-Exchange-SenderADCheck: 1

X-MS-Exchange-AntiSpam-Relay: 0

X-Microsoft-Antispam:

BCL:0;ARA:13230040|36860700013|41320700013|34020700016|376014|4022899009|61400799027|1032899013|82310400026|69100299015|4076899003|2066899003|8096899003|13003099007|16110700003;

X-Microsoft-Antispam-Message-Info:

=?utf-8?B?U014UHhYRkhoakQ4WktQWEFHakV4c3phTm4xYTV1bkhKZnRTdUxwZWFucktK?=

=?utf-8?B?OUdNYTAvMnFVMWxzVzFLdEVzL1VKdHIrbW1FV3J3d01PTElYdC9iV3o4OEV6?=

=?utf-8?B?bkx6bGJCbXZPNmZwZitwU09tdFNyVjVlUzVnRHV4bzVoQXNrTkxUV213Zmwv?=

=?utf-8?B?bVBzN1Z5U1JYSnMxeExaRWV5QklWRkdsbmRROUs3SnRsaWNRTkJiazZBQlE3?=

=?utf-8?B?akxtZFJ0eE90WEdCbjhtSlU4c254Ym1IcmlxVVFKL25JNFZ6ZHgzbEtpT3A1?=

=?utf-8?B?SVNLM09IVXQ2M3U2ekprbUJFVC9FMll1OE9JeWRaNkE3eFlXTERUbzhNTE5l?=

=?utf-8?B?S2x1cjRKS28ycS9RdnpvZll6YVVwYVJQWEZ4bUFWRkgrancvYW1iVmZaTENv?=

=?utf-8?B?WndMV1BZWVFJeVpjcnl6RWdUTHYrOGFzK1cxaWdYdjcwQ2JsSkcyZ1d3OXFB?=

=?utf-8?B?RnJkOU5kUldtWG1NZUlZVmJTRjRoZzJTdVZDaU1mUXNsdEJySzF1eXhGMWM2?=

=?utf-8?B?TlByZjBXcTZLZU1mSG9xb3V5b2VIdWQ4cDNjeXNpOXhYSjE0QmZsb2F3TDd0?=

=?utf-8?B?dG5YUUw5Z1B2M3UwU044ZDFkd09iTnlPcmo1TGdjK0FEWGZIZWtTT3BmZlBC?=

=?utf-8?B?V3A0UTFIVGdGdzZCNDFWalZYVVcybFZSUm5mbE9TSmY2QnFNaUpXK3RjQXh3?=

=?utf-8?B?N0JnbkRTK0ZmV0tveXUvZkp0eHVHODBHR290WEQ2eHlEZitzTlh1eXc5bTlU?=

=?utf-8?B?VUFEKzZxR1JxeEpzSFA5WTZETjlSWWx0aVdVM2t4MDR3V1BkUzAxQ3FRMWlj?=

=?utf-8?B?ZGZtWWsvSUJkVmk0cCtjcGpWVFNSTEUvb1ArVmFrWWtFckUyVU4wU05vK0lB?=

=?utf-8?B?UVdSMXVRT3ZaOEk4MW1kUXhRdVdOOFY5alVYSDl0bDBHL2pmQjdaYndGRHJt?=

=?utf-8?B?bGo1RWhyNmptQ2o2THdSc2ZCUlBhQnVTeDVYZHF2bXBGQVN6V0hMUTQzY2ht?=

=?utf-8?B?c1lKd2JWdVh2M1RXOXFmaGdUbkFIRnhNOHc1OFdVclAwRENtaTNPMXFVY0xr?=

=?utf-8?B?Zld3dlREL2Jta1pKMHZqdkJyVmhUS2lCcDVUMUx6cXNuVE5jNmxBNjdzNUh4?=

=?utf-8?B?VGtJeDI0WmFVaGZLaEw5WkpneDRKMDNYVlJ4Z29QQjNWS2F6WnVkM1QvUG9S?=

=?utf-8?B?ZmtBaE9iN0ZUUGw2Vk5IcnV0ZlQ5U0NYRy9ubGhuSlhBbW9XajZpY2dQdG4r?=

=?utf-8?B?R3BnRnNjRU1hY2VxMnNPVG1EZ2VVWnFJVzJkV2V0MVhyMFQyUmllYldCUFFz?=

=?utf-8?B?a0tnVU8xblQxSXVmRHdJU01aSUhsU0RjbVhma2JSMmw4Rm8rVjFFU2pxK1c4?=

=?utf-8?B?bTFmNStSL2lWTEMzeW5KUk9VL25pV0RsMkRXNE1NRWI1eTgxb1pPR3pTT3o4?=

=?utf-8?B?VDQyQUFUbzVrenF1RUh0OElQWThoWEdzOXlILzZDaUZ4ODY2enhnamNoaEtL?=

=?utf-8?B?Q2R2eVlpWmVYTXFwdGxtaHFaKytkN1hFK2dWMlhtOEV4Y29PZThmcjBTL2w3?=

=?utf-8?B?NTR3TzFRSHZGWFJBbjV2ckJsNW5qeEdUY00wb1NkL2JhTE1YNHhoNjVTaFcr?=

=?utf-8?B?d1JxV2dEeXVnS0NYSzBNb3VPN3JJZEtmWTRWWFZlTlRtN0pqYlJSVnBaL1hV?=

=?utf-8?B?TkREaUx3WjhUUkNYZmFtZi9Pc0JvZ0JRRW9kUGx4ZThIL2ZjVE5ZYkwwb2pF?=

=?utf-8?B?SkdPamFmbzlsNkVWVkhaSnpOM0JpcDNJZFpMbDN5cStoUEhWSzZnL3dtYzFm?=

=?utf-8?B?TFlLV211U0NiVzhuT2NUTS9abkJ4WC91ZW5GTUNZbWhsRFNmck8xRXZ4ZTl5?=

=?utf-8?B?U1RKTjVjSUU5d0VPbkxKcy9GWlNEVTVKSUVjTXR4Q21yV1hsSTVyY3lEcWtn?=

=?utf-8?B?cGZ5RFRvQkJZblhVRjZ6SEJSTHhhNFVqOXdSMTQ0T2krZGdONEVlSVBqa2k3?=

=?utf-8?B?KzZ1ZDhnU2pzVjA4V09uZmpUaDhQKzBjTW5JZVdZamN4ME9nS0VoUGlkOHlC?=

=?utf-8?B?SmU3MkJ4d1pXV3FnMnNGNFRxVDVXT0dvM2ZYQmFaVkxwRjJPcmJKWFVXOEUv?=

=?utf-8?B?YXNXUmo2L24xVVFZT3VmMit3WStHVzBXYUJnTWtnNSt4R2dZV0RzWGxwUUlt?=

=?utf-8?B?enBNUUdQa0dIaWNxY1R2c3RkTjNsTTUyMmx6YmN6NVpZK29tNXM3VnljZjd6?=

=?utf-8?B?cktXSVVNMFNOZmNDWXZaeXU2bnRMU255N1owV040RDF6dzMrd08yTTMrYXpG?=

=?utf-8?B?ekFseG51VmZsK2NiczlQeHNkM3dQM1NHTXBWYjdQVUN3alhlQnNNZ3owbm5N?=

=?utf-8?B?alZlS0tNTWNEVnV5NnpaVXRDU3VBMnIxWXhYTTAxdjBUNjBkODNNY1l0WUt6?=

=?utf-8?B?dlhmUmJxN1QxdUZpU1ExeXFUSWxQVmIzMlBSWWVUVkc1enF0bkF5Q3RBblVl?=

=?utf-8?B?V2E4MTZyYlloV21pZlNqbThTcW0vVDVBSGxGalhOQjZIQlhOWWVLbHBTNUlP?=

=?utf-8?B?Z2paT3JhVHh4VUt4YklkeFRFYVdKbVMyUG1qVjViNy9TWGdYZnRPR0M1bnNl?=

=?utf-8?B?Z0hkL0JzMUtMVmxmQ2xkOVhzRVV5bzNRdStsZkFiY3d4YytSMDZuZ1NrN3hn?=

=?utf-8?B?RWlMejBUVzh4UlZVbWR5Z2NkNWR5UFNOS1E9PQ==?=

X-Forefront-Antispam-Report:

CIP:51.158.242.221;CTRY:NL;LANG:en;SCL:5;SRV:;IPV:NLI;SFV:SPM;H:unical.it;PTR:221-242-158-51.instances.scw.cloud;CAT:OSPM;SFS:(13230040)(36860700013)(41320700013)(34020700016)(376014)(4022899009)(61400799027)(1032899013)(82310400026)(69100299015)(4076899003)(2066899003)(8096899003)(13003099007)(16110700003);DIR:OUT;SFP:1501;

X-OriginatorOrg: cfbjibs.temptingfragrances.com

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 15 Dec 2025 22:25:49.7203

(UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id: d38049e7-5359-43d4-197f-08de3c28e6a9

X-MS-Exchange-CrossTenant-Id: a56ba61c-afa1-4cb0-a86d-f691f8c4bec4

X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=a56ba61c-afa1-4cb0-a86d-f691f8c4bec4;Ip=[51.158.242.221];Helo=[unical.it]

X-MS-Exchange-CrossTenant-AuthSource:

BL6PEPF0001AB76.namprd02.prod.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem

X-MS-Exchange-Transport-CrossTenantHeadersStamped: LV8PR16MB6672

X-Spam_score: 9.0

X-Spam_score_int: 90

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Welcome to [Coded Mails] Preview - Welcome to Coded Mails