Bitcoin Paypay Phish from Microsoft Outlook Part 4







Haresasz Nxysarwsa has invited you to PayPal Transaction Successful – BTC Order Pending Completion

Title: PayPal Transaction Successful – BTC Order Pending Completion

When: July 1, 2026

Organizer:

Haresasz Nxysarwsa

Description: Dear Customer,



Thank you for your recent PayPal payment. Your Bitcoin order has been received and is now awaiting final confirmation.



Order Summary:



Asset Purchased: Bitcoin (BTC)

Payment Method: PayPal

Total Amount: $290.00

Status: Pending Completion



Please allow a short period for processing as our system validates the transaction details.



If you do not recognize this payment, please call +1 656 556 2206 immediately.



Best Regards,

Order Processing Department

Attendees:



cynthiaperez389903@groups.outlook.com



PayPal Transaction Successful – BTC Order Pending Completion

Dear Customer, Thank you for your recent PayPal payment. Your Bitcoin order has been received and is now awaiting final confirmation. Order Summary: Asset Purchased: Bitcoin (BTC) Payment Method: P



Dear Customer,



Thank you for your recent PayPal payment. Your Bitcoin order has been received and is now awaiting final confirmation.



Order Summary:



Asset Purchased: Bitcoin (BTC)

Payment Method: PayPal

Total Amount: $290.00

Status: Pending Completion



Please allow a short period for processing as our system validates the transaction details.



If you do not recognize this payment, please call +1 656 556 2206 immediately.



Best Regards,

Order Processing Department

Kedy

streda 1. júl 2026

Organizátor

Haresasz Nxysarwsa

haressaznzxrrsxaxz321@gmail.com

Hostia

(Zoznam hostí bol na žiadosť organizátora skrytý)

Odpoveď na cynthiaperez389903@groups.outlook.com

Áno



Nie



Možno

Ďalšie možnosti



Pozvánka z Kalendára Google



Túto správu ste dostali, pretože ste účastníkom danej udalosti.



Ak túto pozvánku prepošlete, ktorýkoľvek jej príjemca bude môcť odoslať odpoveď organizátorovi, byť pridaný do zoznamu hostí, pozývať iných bez ohľadu na ich vlastný stav pozvánky alebo meniť vaše potvrdenie účasti. Ďalšie informácie



Bitcoin Paypay Phish from Microsoft Outlook Part 3



1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.128.71 listed in dnsbl.ahbl.org]

[209.85.128.71 listed in dnsbl.ahbl.org]

[209.85.128.71 listed in dnsbl.ahbl.org]

[209.85.128.71 listed in dnsbl.ahbl.org]

[40.93.10.76 listed in dnsbl.ahbl.org]

[40.93.10.76 listed in dnsbl.ahbl.org]

[40.93.10.76 listed in dnsbl.ahbl.org]

[40.93.10.76 listed in dnsbl.ahbl.org]

[2603:10b6:806:6f:cafe:0:0:70 listed in]

[dnsbl.ahbl.org]

[2603:10b6:806:6f:cafe:0:0:70 listed in]

[dnsbl.ahbl.org]

[2603:10b6:806:6f:cafe:0:0:70 listed in]

[dnsbl.ahbl.org]

[2603:10b6:806:6f:cafe:0:0:70 listed in]

[dnsbl.ahbl.org]

[2603:10b6:806:6f:0:0:0:15 listed in]

[dnsbl.ahbl.org]

[2603:10b6:806:6f:0:0:0:15 listed in]

[dnsbl.ahbl.org]

[2603:10b6:806:6f:0:0:0:15 listed in]

[dnsbl.ahbl.org]

[2603:10b6:806:6f:0:0:0:15 listed in]

[dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.128.71 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.128.71 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.128.71 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.128.71 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[40.93.10.76 listed in list.dnswl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[40.93.10.76 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[40.93.10.76 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

1.0 HK_RANDOM_FROM From username looks random

3.5 VOWEL_FROM_7 Impronouncable from header (7+ consecutive vowels)

0.5 FROM_LOCAL_NOVOWEL From: localpart has series of non-vowel letters

1.0 HK_RANDOM_REPLYTO Reply-To username looks random

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[haressaznzxrrsxaxz321(at)gmail.com]

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[haressaznzxrrsxaxz321(at)gmail.com]

0.1 TW_RW BODY: Odd Letter Triples with RW

0.3 LONGWORD BODY: Uses overlong words

0.6 MEGALONGWORD BODY: Uses really overlong words

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.2 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and EnvelopeFrom

freemail headers are different

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

3.0 LONG_INVISIBLE_TEXT Long block of hidden text - bayes poison?

0.1 TO_IN_SUBJ To address is in Subject

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

Subject: {SPAM?} =?UTF-8?Q?Pozv=C3=A1nky=3A_PayPal_Transaction_Successful_=2D_BTC_Order?=

=?UTF-8?Q?_Pending_Completion_=40_st_1=2E_j=C3=BAl_2026_=28cynthiaperez389903=40gr?=

=?UTF-8?Q?oups=2Eoutlook=2Ecom=29?=

Bitcoin Paypay Phish from Microsoft Outlook Part 2

X-Microsoft-Antispam-Message-Info:

=?utf-8?B?MnczaTlZTjF6aStMMzgxeWFYUHdVZHFoTUY2TFNlRldaZ3NzY2J4K3ZlV3Np?=

=?utf-8?B?K25KT0hkcWtlcnRPaUowUmNneUdPbHIzTHU5azJEL3FjU1h4VGMycE9uSTVw?=

=?utf-8?B?WWVFZTNyTDJnSG1sVHFCZlRIb0psTXJNUmhveFdvK1hmOWdTSVlzV1BzY3FW?=

=?utf-8?B?TFZxUmZ2eGllTTZXOENpNjhyRGxRRDl3RGhiRS8yZ3NiaWRmdWdOZVE5RnYv?=

=?utf-8?B?MDR3OHROckRmeVhTVEFNWkQvVFQrMHRUY3hmWm8vRTVlazVMMUZhYUNCNndo?=

=?utf-8?B?OStRMmg4MGk5QzQ3dUx2OGI2UDRmUm1QTE1Ia200M3QxUFhKbmhGNmJrYzZP?=

=?utf-8?B?bjgxRklNei8rdW1Ielg1UUJLRGU1RG53S3poZ2gyeUpmWmp2dmdSZVlkc2ty?=

=?utf-8?B?VGZldWFxZ2UwU2VxQ3NrRGZOcUFHayswRDVHQ1FRaDBRTmp5RWdMTFc5aE1v?=

=?utf-8?B?bXRIOEJETnVYSGdIaXo5WldRMTdUeThIV3hpZ2RjSzdWV093VG9HYVJKNkQv?=

=?utf-8?B?TW9lV1A3SjkyT3phS1JNckZwRGpwSlpWRDRTZVpaNVprbGd2NkdWbXpRV0w4?=

=?utf-8?B?VFluc3hmVVVQL3IzOWF2N3h2U0w5WTdXSUxtclN2allpcE5MdlVlOVhyN1dy?=

=?utf-8?B?Rk0zcURyU3ZoRVJCdERDUC9lcnhvNGpDUmZJT1JIMGM1Rm84NmN2K2JjRVlV?=

=?utf-8?B?REZJMHVWWHVZZU9GQlU3K3JCVTlReDFZdXZXK1BvY1lqbTR2NDhuRzNkcW1s?=

=?utf-8?B?ZjVQK1BWaktCeklXSzlUQUNHMG56cGR5Wms4SzhwVHZLS1J2Q1h1UnFqK1Bu?=

=?utf-8?B?eHBzZ0IycFNUN1o4UVo4cTRyUmJwQ3orWlJsaTJsVlBJdWtqYWFCNWxGODlP?=

=?utf-8?B?and4TGxoTkxudWtUMHlIT0lxWVRDd050OGNUZVVXVXhMZFozK0xIanh2dXFy?=

=?utf-8?B?RWNwdGV2ZS8wMzA1eGZYcmVTU0xPWXJUb2hlcmgwUmx1bHRaYnJURitsZUVy?=

=?utf-8?B?eFRyS0RBem9Jb2hqaWZUSEVkYmxnUmNhUlJ5ZHlscmJYeTVoeGhaQklNVE1N?=

=?utf-8?B?bTlocURWcTFMT3dmSVdpUzZ4NmFldXQxVUdQVktkZVB4UFpBUkZJUUdVbkRZ?=

=?utf-8?B?UlVkWGZraWdrZXA4U0UzMU1ZaHpYUU5OVnVVQ0c4QStOdU9UZUhRNjFKaVZS?=

=?utf-8?B?SmJxeGRrOHRtcFJ3U2dMbUpaaS81bGt5TnEyc2dEV1lQazNXcXl4eVhoU3ds?=

=?utf-8?B?VStYSHRXcXVFbHJ6cWRRKzYwaUZyS0lwSjlpS0p1UHVVdTYycnZidGV3ZFBG?=

=?utf-8?B?RmlzaDR0YU9wclZTdzZpU1V4ajgwK05ES1JUQkVkcXVwVVc2UnhGSDY4b2c2?=

=?utf-8?B?TnJ5ZGkvTXRnRzgxRUpQNEpMUkY2ckZScS9CT0tNNSthQ1ZzWmxlM3NoQXVy?=

=?utf-8?B?NHhTMld3TzUvSzJpblp4TUw3VmE2Wk93NmdiM2M4U2swa05yZS9NdWxqSU1O?=

=?utf-8?B?ODFZR1lsOVo2OFNlckE2ZjN0d3o0WFZHODJObzNLVHI2NWdnN0tnclhxRjdD?=

=?utf-8?B?TEZEZG4vWGlyVmh0enoydldPVzFMUVRUWllXMGN3Y2VIbmxnck54aklycmc5?=

=?utf-8?B?c01kWGQxd0huZTZwUERYVXB5QlNLWnVlb3RHQjJrWDcwQkZsWXRMbFd1VXgy?=

=?utf-8?B?ZFBIY3o0SXNPTys2cDhnN3BlM1lPUUlYVmZkNWFWWWtSbFlkTU03dkI0V0hY?=

=?utf-8?B?ZHlhQzl6QnlUWmdRdnVNK3cvTEtnYjhiblp6eDVNSmYxcHFkeVdwRGN5STlh?=

=?utf-8?B?VUVVaVZialRoMklLZ0ZicXN5TTB6NTBldXBZYTJRcXd1NEhuaTVKOXpCNEY1?=

=?utf-8?B?bGZ6RncrR3VFWFR0VmE4ZklDNG10NzNjS1dBcXNMNGU0cTgzYXJBY2gxZlNr?=

=?utf-8?B?UXp3aW01Um05dUw2RFB3dWpZd3hwaU9Fb0FTaCtIVWwrWEpjUWFSd2V0d0x1?=

=?utf-8?B?cDlEM0xsZXhyYWRsdEFyOUFhRUcwRHlaU3g5Qiszb0RqamdzTkYrUVNySU85?=

=?utf-8?B?ZzVkZmdlOVUveEpMTEtmeFEweElXeDBuMG85cEVTSlRrR0dOaHVoOUhtUlVq?=

=?utf-8?B?ZVlYUkloOVAyVjlENHUxZEFIR2oxaFRRWnF2N0FjbTkzQVh2YnBvK3h6UjlZ?=

=?utf-8?B?em01QXpCeTlrcEJQVHpxMVVXY0oyNDVNNVNHeDQ4WnEzeFJtMUN2djZXVGpp?=

=?utf-8?B?L3JwSmVMZ0s4MEtjZDVPQkhPN0ozeHdFaGFvRnpaLzBBbWh2Y1YvdnJreldj?=

=?utf-8?B?cHRjZDI3WUZRSjdjR1grNmFEU2kvRG5BMEF5STU2SUVTbWQrTkhpZkZjVXBm?=

=?utf-8?B?bktvdzJWcEtpVDl4RGk2VTliNzJxN2pDZTh2MXdlTWlBaW1mQlRwZ0tnUFBZ?=

=?utf-8?B?c1NWalBlaWowc3dCcXBpUnZwTWJhaDVEakxZRmF1SWh6Y2Vyb2Z3TTRNNGt0?=

=?utf-8?B?RytSU095M2UzM2l4VWN2WkRpQmh1cHVnVzVhcHg0TjVWdkZaei9wakx4V0hJ?=

=?utf-8?B?WGI1ejlxNTRjQzFKRitWZGhleEhRZlQrUVNMZE1sbXFnWEt1cWZMSmU2alQ2?=

=?utf-8?B?SmxKb2gxN1lSSnlTY1k5RCtXVHk5ZTZYSmdTK3NpWUhDREkyaWwrUVkxbmta?=

=?utf-8?B?Y1JnemxVUVE1Kzh2Sk0vSFlKOXNjNDV1alEzVEwxeDRvaW1ueGttMVZuTkV3?=

=?utf-8?B?Y2Zkb2Z4RlpLMEdROURnemNoaWFtaUs4eW83dFNtQlRGVE9sT3VHVSthVzcx?=

=?utf-8?B?K1JrRko4b0tCMXdGaDBqT1RNNkRTVHJLdHlpaTRnS21SaGwvcHIxN2VYeVJw?=

=?utf-8?B?TldwejhEdVhqamNnclVEdnhFejBZSmtWeWJYNitaOSt4TXgvT3Q2dGVvaGNQ?=

=?utf-8?B?UGdJaVFFUDlRazdSb0wyNGl3YzZ1Z0VGWjBPUWJHQ0NGR3hkZVFtUFM0cUhh?=

=?utf-8?B?a2F2R1phamdqd0ZZcHFqaS9qSGtaSDNuM3MwNHEwYThzU3VMODc0Y04wTWtJ?=

=?utf-8?B?b0RQUWVzVDhkd1RKclBKQ2NZR0NsRmxpU0JUSjd0Z2dpSFFtdGRkVU9RVFpP?=

=?utf-8?B?VmhyS2RQdVp3aTVUWGt0LzJnQkZyLzZod1dka05wNFZNRG90b3lGRUV4ZlI4?=

=?utf-8?B?dkVZcHVLK21wNXJpOTBBWHloekkrYmZIZG9Cc01LcU5DZFViaFhMZXp3NWFu?=

=?utf-8?B?VS9mZFg3ZklLMnQwdDQ4ekZFWHpJUXRRaWh2SFRJSnZwNHZockxvUGUvTk1z?=

=?utf-8?B?citsRFJ3N3JoRXMybmhUQ2w3SEE3R2NaUklNc09nYWFMbGkzdWhTZVY1UTJK?=

=?utf-8?B?VjhpaU0wRDlUQVE4ZXNaeGI1QWRtc1o1UUR6WGFMTUtRQ01QdXdZaDh5THZs?=

=?utf-8?B?MTFVS1phNDUyNWhFQXdKWFY3RWUrYXM4bDhPVXFUK2RMeE40TW9QbDJ1aG9q?=

=?utf-8?B?eTNtSExVZnBXQlRkdTduRXdZclNpaUpGZk4zem0rZkVWTXB6QnhMWkI0Vk5s?=

=?utf-8?B?U2dja2E2OWNDV2dVaTR2ZXh2a1RBOW1uKzNNZXBveVYrZ1RyUzhIRXB4VXBQ?=

=?utf-8?Q?bnO2Hovn06w+gxodvdiwjqzaopVKzAoeE?=

X-Auto-Response-Suppress: DR, OOF, AutoReply

X-OriginatorOrg: sct-15-20-9412-4-msonline-outlook-090a5.templateTenant

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Jul 2026 16:59:22.5755

(UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id: 2bbe6c9a-6bd5-4051-93c1-08ded7921981

X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-AuthSource: SA2PEPF00003AE9.namprd02.prod.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: Internet

X-MS-Exchange-Transport-CrossTenantHeadersStamped: LV8PR18MB6045

X-Spam_score: 13.7

X-Spam_score_int: 137

X-Spam_bar: +++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: PayPal Transaction Successful – BTC Order Pending Completion

streda 1. júl 2026 Dear Customer, Thank you for your recent PayPal payment.

Your Bitcoin order has been received and is now awaiting final confirmation.





Content analysis details: (13.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.128.71 listed in will-spam-for-food.eu.org]

[209.85.128.71 listed in will-spam-for-food.eu.org]

[209.85.128.71 listed in will-spam-for-food.eu.org]

[209.85.128.71 listed in will-spam-for-food.eu.org]

[209.85.128.71 listed in will-spam-for-food.eu.org]

[209.85.128.71 listed in will-spam-for-food.eu.org]

[209.85.128.71 listed in will-spam-for-food.eu.org]

[209.85.128.71 listed in will-spam-for-food.eu.org]

[2603:10b6:806:6f:cafe:0:0:70 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:6f:cafe:0:0:70 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:6f:cafe:0:0:70 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:6f:cafe:0:0:70 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:6f:cafe:0:0:70 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:6f:cafe:0:0:70 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:6f:cafe:0:0:70 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:6f:cafe:0:0:70 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:6f:0:0:0:15 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:6f:0:0:0:15 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:6f:0:0:0:15 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:6f:0:0:0:15 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:6f:0:0:0:15 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:6f:0:0:0:15 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:6f:0:0:0:15 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:6f:0:0:0:15 listed in]

[will-spam-for-food.eu.org]

[40.93.10.76 listed in will-spam-for-food.eu.org]

[40.93.10.76 listed in will-spam-for-food.eu.org]

[40.93.10.76 listed in will-spam-for-food.eu.org]

[40.93.10.76 listed in will-spam-for-food.eu.org]

[40.93.10.76 listed in will-spam-for-food.eu.org]

[40.93.10.76 listed in will-spam-for-food.eu.org]

[40.93.10.76 listed in will-spam-for-food.eu.org]

[40.93.10.76 listed in will-spam-for-food.eu.org]

Bitcoin Paypay Phish from Microsoft Outlook Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 01 Jul 2026 14:14:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wf1JH-000000006pX-2ZV6

for dave@doctor.nl2k.ab.ca;

Wed, 01 Jul 2026 14:13:27 -0600

Resent-From: The Doctor

Resent-Date: Wed, 1 Jul 2026 14:13:27 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-westus2azlp17010076.outbound.protection.outlook.com ([40.93.10.76]:61195 helo=CO1PR03CU002.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1weyIa-00000000PAh-13N3

for doctor@doctor.nl2k.ab.ca;

Wed, 01 Jul 2026 11:00:44 -0600

Received: from SA0PR12CA0010.namprd12.prod.outlook.com (2603:10b6:806:6f::15)

by LV8PR18MB6045.namprd18.prod.outlook.com (2603:10b6:408:230::15) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.159.19; Wed, 1 Jul

2026 16:59:22 +0000

Received: from SA2PEPF00003AE9.namprd02.prod.outlook.com

(2603:10b6:806:6f:cafe::70) by SA0PR12CA0010.outlook.office365.com

(2603:10b6:806:6f::15) with Microsoft SMTP Server (version=TLS1_3,

cipher=TLS_AES_256_GCM_SHA384) id 15.21.181.9 via Frontend Transport; Wed, 1

Jul 2026 16:59:22 +0000

Authentication-Results: spf=pass (sender IP is 209.85.128.71)

smtp.mailfrom=gmail.com; dkim=pass (signature was verified)

header.d=google.com;dkim=pass (signature was verified)

header.d=gmail.com;dmarc=pass action=none header.from=gmail.com;compauth=pass

reason=100

Received-SPF: Pass (protection.outlook.com: domain of gmail.com designates

209.85.128.71 as permitted sender) receiver=protection.outlook.com;

client-ip=209.85.128.71; helo=mail-wm1-f71.google.com; pr=C

Received: from mail-wm1-f71.google.com (209.85.128.71) by

SA2PEPF00003AE9.mail.protection.outlook.com (10.167.248.9) with Microsoft

SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.181.6

via Frontend Transport; Wed, 1 Jul 2026 16:59:22 +0000

X-IncomingTopHeaderMarker:

OriginalChecksum:FA932CAA5DF57B5255CABC285A98440E4050EE89AE41195CB67E849F6AAA2613;UpperCasedChecksum:B7790383E8231A03E8B246624AE3DA88805C6B856DF249EF8A05C471893DFBA8;SizeAsReceived:3418;Count:15

Received: by mail-wm1-f71.google.com with SMTP id 5b1f17b1804b1-49244130073so7313205e9.1

for ; Wed, 01 Jul 2026 09:59:22 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=google.com; s=20251104; t=1782925161; x=1783529961; darn=groups.outlook.com;

h=to:from:subject:date:message-id:sender:reply-to:mime-version:from

:to:cc:subject:date:message-id:reply-to;

bh=AyyLgGBErAgFdI/6CeTnHTXhKZdTf5hxe2xfAvRuHdI=;

b=TLmzLHaQT0TxL8xwj5lCcPY/mk8ByvV/dAZ7mJGMPZHGTUoeM701kw9yXYLRn/fYHS

pLViXMENhFZG9gxGrYJe5TV+xJbu9pUN58HwN3X+Qt7iJyhttI4iZ/B78uL0YwOc7JUA

gK7ClQATQcCJihIDJRIRcVRpTDE3rqan5fhTViVwRTCJTXdxvqcnAmjKUZg7nTjZaLp1

genDdt1PI+p2zvYv83xrx474ogzf4ej4hazetNDSfByaLWmZ3uU3LCSgDJm2oKjXMojv

9GxzAszHbeDz2QaO+oOs5XjZeubAQWccmpV2xJZY0Cuo10kQGsFcQJTVKCbNqyitJ2G0

TKTg==

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1782925161; x=1783529961; darn=groups.outlook.com;

h=to:from:subject:date:message-id:sender:reply-to:mime-version:from

:to:cc:subject:date:message-id:reply-to;

bh=AyyLgGBErAgFdI/6CeTnHTXhKZdTf5hxe2xfAvRuHdI=;

b=joPgSh3+wbqxLw97hfv37RD5tURBiV4/UbUWhNyvb7VdQmFubjklilFdNguOZDlg/l

463DXdlFijGRyKqZGF87DQ5YAWrOC0Q93a4dtbH9+mHsUHbwzBkU9OHEtM1fRipJOmY8

qoQGR/G2L2W3D7ZFzrEIopY09b6DQ+1jO5HCeiSA4niJFfFzgKgN8CLv0ZfR8FLRcxB7

FpckK3DUT2YWCUBSSmwFCdTNg5A78jmXJDSsQTgvsWXiJUDqQFF1T1YVNdCHQIWIua+R

LWra2VMF5LhHRKeN57gqJZpw2HRNsp2UcZDQapH5PW7Rc+cP6gIdPY/BFUuKcFWKtwta

j7pA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1782925161; x=1783529961;

h=to:from:subject:date:message-id:sender:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=AyyLgGBErAgFdI/6CeTnHTXhKZdTf5hxe2xfAvRuHdI=;

b=P3uuh228TuvWfnQ/mkO7vSOeEZwPMj9HQ7LvJzLC6F4ZhuVnl9YoHtaZhcC85Xidna

EBPXl7lKlcNxoCXHpq4bbc7MXDyq0u65z1K+JRH2JloT5NRDY7UBR1pQdfmyo/8JMa9P

9NSDJPugvTpgR+HXz1sKUszAjknEcZQyvN97k/v60mSRtVJcWIhWm+jIM14fGOaKXKRe

+O8AVEM4dQtP8KS4M10u3ZtMnc0oZsIl8N88gzB30BiclCecaNDAAD53v7Lll1u0sKA9

D4sbl9ufmbn/FbCLR4CyygNtiePs3Nz1PKp6xmkgk7X9TJvbRCo2z1BZWejUTYwxqMdd

1pQQ==

X-Gm-Message-State: AOJu0YyE5k3FQ7SkRMeS8n9TtcWIILzmFIwkl2FSNH5SBPe4dAUDxL5t

3j5A+2ByYZeqHYT5/obW95MIpA+J0Aey0TR5QDKQ1u0ZyjFb0LghfuwjBNIhTL1JERgqDtljUOO

IdhmVp3QiTUnIEBFu5JukLeP74JYn2nAInDg=

MIME-Version: 1.0

X-Received: by 2002:a05:600c:6a96:b0:493:b750:b565 with SMTP id

5b1f17b1804b1-493c2ba9d58mr30716335e9.35.1782925160556; Wed, 01 Jul 2026

09:59:20 -0700 (PDT)

Reply-To: Haresasz Nxysarwsa

Sender: =?UTF-8?Q?Kalend=C3=A1r_Google?=

Message-ID:

Date: Wed, 01 Jul 2026 16:59:20 +0000

Subject: =?UTF-8?Q?Pozv=C3=A1nky=3A_PayPal_Transaction_Successful_=2D_BTC_Order?=

=?UTF-8?Q?_Pending_Completion_=40_st_1=2E_j=C3=BAl_2026_=28cynthiaperez389903=40gr?=

=?UTF-8?Q?oups=2Eoutlook=2Ecom=29?=

From: Haresasz Nxysarwsa

To: cynthiaperez389903@groups.outlook.com

Content-Type: multipart/mixed; boundary="000000000000db2b2006558f9c78"

X-IncomingHeaderCount: 15

X-EOPAttributedMessage: 0

X-EOPTenantAttributedMessage: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa:0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: SA2PEPF00003AE9:EE_|LV8PR18MB6045:EE_

X-MS-Office365-Filtering-Correlation-Id: 2bbe6c9a-6bd5-4051-93c1-08ded7921981

X-Sender-IP: 209.85.128.71

X-MS-Exchange-EOPDirect: true

X-SID-PRA: HARESSAZNZXRRSXAXZ321@GMAIL.COM

X-SID-Result: PASS

X-MS-Consumer-Group-Expansion-Loop: cynthiaperez389903@groups.outlook.com

X-MS-Exchange-Group-Expansion-Loop: cynthiaperez389903@groups.outlook.com

X-Microsoft-Antispam:

BCL:0;ARA:1444111002|16001999021|24102599021|1680799066|16200799027|26000799027|29080799009|32020799003|4040799016|26130799012|970799063|5139299004|9000799056|6092099016|9400799043|9020799019|6019299003|34130799006|22000799015|3151999006|18021999003|1041999012|1602099012|2145499017|30041999003|1370799030|1380799030|1360799030|4302099013|21002599022;

Web/SEO/App spam from Google Gmail

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@nk.ca

Delivery-date: Wed, 01 Jul 2026 11:37:00 -0600

Received: from mail-ua1-f72.google.com ([209.85.222.72]:52505)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1weyrG-000000003ho-2OEa

for dave@nk.ca;

Wed, 01 Jul 2026 11:36:30 -0600

Received: by mail-ua1-f72.google.com with SMTP id a1e0cc1a2514c-96910ded42cso190948241.1

for ; Wed, 01 Jul 2026 10:35:34 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1782927329; x=1783532129; darn=nk.ca;

h=to:from:subject:date:message-id:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=TM1/P+geKfrnLJhdHrk+K3EDMBXY6vOPC/Pcf22eb8E=;

b=ZQ3cFo4bMrtFqO5jbvvo26L0+LcT608TieW8TDdCU306EQQ7awH+NotcPzf9BCjX1S

uzqXvilYnurssHPtA+6o34qHNc4IobbPf/B4907+KEjwfM5exBMhh6geHRiAYfeWqXR7

4ldMjYgCQhqxQHM3SDfODWqRNijcMc72CqadSWswr2VCBo01GfgYiPzhGwt+LCFSfOBS

ypUj2Tbza7ODm44arZlfuvBZwZYnLJjAKzfJAVYYaK4vMgoyoaMkt3ExwR3iJnkMkgYy

IRMvyZ5KAaIH2R9G/V0xZ4qAY80beuDzT1x0Fo2prPZnphd3w1pdVGZzx9a1pz/p0eTz

8Lsw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1782927329; x=1783532129;

h=to:from:subject:date:message-id:mime-version:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=TM1/P+geKfrnLJhdHrk+K3EDMBXY6vOPC/Pcf22eb8E=;

b=kadxqO5TIbaGfd0cOkjF9SiixoZkBTmfdrKD2aqxZ2wm6RY8WXAhAuKet/ziwdtab5

rH4fLoATU3KrnwmUcB6ZlyRb1ueFMTCsKv0hBM0O4XBjGoOTpYZIXgIn9THXcv41gJmV

WqZsh3xqN3MTFCLwGYtoLD8LKeiZxhCwgOHl9ybXhjMZw2dhDYZwUuQH5ho6FsLyvTZo

9j34Imbr2BO/gv3zAIhS+APylTh+2qW5dBrzhnO/b6YftHSZ/C44W4nRfEj/HUZ6GJDv

q96HaWGkDwmEhe12kt6LealQrxMMRujxEnbnuJEs8K1yKD2Ifhg/uuuQzCpRBlVUJDcs

zF4g==

X-Gm-Message-State: AOJu0YyWqH4ofoiQTHpTfnboCkl2kvUDlZWWzLL2cNNDHOZAFo5rplUz

oUGpDZgx7YaRfKqfNYCTVDkBxtLrMTHG7UPdXqq96jd4dkc+T9NVXbow31hvNfyHtwpE/scaB81

s4hSGJw==

MIME-Version: 1.0

X-Received: by 2002:a05:6102:149c:b0:738:be73:55e9 with SMTP id

ada2fe7eead31-73da8e70480mr1292445137.12.1782927328681; Wed, 01 Jul 2026

10:35:28 -0700 (PDT)

Message-ID:

Date: Wed, 01 Jul 2026 17:35:28 +0000

Subject: =?UTF-8?B?TGV04oCZcyB0YWtlIGh0dHBzOi8vbmsuY2EgaGlnaGVyIGluIHNlYXJjaCDwn5SNIA==?=

From: adamwilsum@gmail.com

To: dave@nk.ca

Content-Type: multipart/alternative; boundary="0000000000001624fc0655901e7f"



--0000000000001624fc0655901e7f

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes



Hello dave@nk.ca,

I recently looked into https://nk.ca and noticed a few ways we could help

you climb search rankings.



Our SEO strategies focus on visibility, traffic, and measurable ROI.



Open to a quick 10-min chat this week?



Kind regards,



Adam Wilsum



--0000000000001624fc0655901e7f

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Hello dave@nk.ca,
I recently looked into https://nk.ca and noticed a few=

ways we could help you climb search rankings.

Our SEO strategies fo=

cus on visibility, traffic, and measurable ROI.

Open to a quick 10-m=

in chat this week?

Kind regards,

Adam Wilsum

--0000000000001624fc0655901e7f--

Web/SEo/App spam from Google Gmail

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 01 Jul 2026 14:14:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wf1J2-000000006oe-0Q9M

for dave@doctor.nl2k.ab.ca;

Wed, 01 Jul 2026 14:13:12 -0600

Resent-From: The Doctor

Resent-Date: Wed, 1 Jul 2026 14:13:11 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ej2-f2.google.com ([74.125.228.130]:48902)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wexvq-00000000Kvb-1MXZ

for sales@nk.ca;

Wed, 01 Jul 2026 10:37:10 -0600

Received: by mail-ej2-f2.google.com with SMTP id a640c23a62f3a-c073a616ab0so39490266b.0

for ; Wed, 01 Jul 2026 09:36:15 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1782923768; cv=none;

d=google.com; s=arc-20260327;

b=n1o5pnN6NeCdyfkz1+EXJD1Rqy5tNly+nNWJvwG5YCqJKjHnOEToiDuXikTmiRPlEo

EbFFkmVEqKlIySmiBvfJYl2rYWqNlJstDALHohXVNTf7yYJ7IdxgdevM4OkjvM0iafjB

/tRBLk22xhxQvm92e+8lCghAonJmQldtzXHTVPrTnQer2xij2Kg8/mNYKbetzfzsTaFT

AXL/GIiCJM0BOUCxFK3yzEoiIJgGkJNOvTSoJNmNLU9NAeu3HelWicatWYCLR+OEYJO2

tgZ/We+IPcAU/KdK1ThzLSlBw1C3y3X/XNB7tYrT6nvxNWi4RL4Cku0mWKB4mBISngit

SEkQ==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;

h=to:subject:message-id:date:from:mime-version:dkim-signature;

bh=x17FsE6naXrKnXZL3qeHI+a+5JHr+xs7J5vHorkn6ZQ=;

fh=C4vsnDG7cTH8aa/8f7sygxKSfblX4MPDg6mph8A3jUw=;

b=rOK48BU6iUrcnaNLs4d9ujFSolhdVhiNE6BUPaeztUvMixNKil6r9JlNCm+j8390Iy

WoPdD4pmsEvxBYd55dkhXFYLyiORkjfkPdrqT5eQDsOdzQ4tS05LGypFwGHQV0fZGlBC

Q2mwVBXZ6xWQrmR90SX9ToJZ7tDoodVtcqpfiltWqaLklJLWSSowDTz4USPkjZXKMrn2

k4W2t4X60LNBCzPoeVIyFJa7sSl+e9eM2luiIT+1GQsPBSOiFIRS2kKNY7rIrTJJK/vS

otBkoVwU6h90d+X7spEHbjWzd2DSyrofYMKPWK3AJsIjLTCUcojPUTjhV3oIhk/r8RcA

EUkg==;

darn=nk.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1782923768; x=1783528568; darn=nk.ca;

h=to:subject:message-id:date:from:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=x17FsE6naXrKnXZL3qeHI+a+5JHr+xs7J5vHorkn6ZQ=;

b=Se+4PI72ylr7++rsblpcF6FVqvoKuUno5ynl8BSaJltRutXB/cl95yHByKGtum9XUr

+Zsvkp9d5NqoUaTP0jWiA+YbF6vJCIOYpu7MA4JRmloi6Xd/9zTgmsxgbBGaeAn8kpVG

kdxQW0PWQqMY09JLxc+8/dgKvnt8AArPZHFTh0tj8orQML27FUtmpIg5C51DS0SSjxMn

i1ryXPUsUSY3NuYF6Byz6ACwNpxSvIliNgBu8e5+F8x9RSFBqMADV7Qm0IYyp/XEeoTh

wf/+fA5XCI4SFU54bHhHn5S3UjpJl7G3W8TPm38JuC9D+lYqSb1Aj7moi52F30DdTG18

2SYw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1782923768; x=1783528568;

h=to:subject:message-id:date:from:mime-version:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=x17FsE6naXrKnXZL3qeHI+a+5JHr+xs7J5vHorkn6ZQ=;

b=f6aJDATH3iJytQ45h3OS9vFJoIwVHtl5zKfUb/mkb06Q/RMMo6stjdjAabu7c+AAvl

BULhORA12Rbu6b/Yz+QNgzFpnVA+DxvqTcfcgbkrVblsrz27lUD7hPUGGZGW2nKMnTaD

jH8kKSs4fi9ffEQex+UgwmgHacnuA88ujprSZzzICcrSDHYK90qYHJ5YW1KMWvEnBpf1

SjbOSPVb59kq3q+CIrrniAtXd7wSabbmpLh03zR6NcXHrVed3dNbHpAThU8urLtVhWGA

8+iCI5kEfTZ5tbChdBDek7DyL4HhRovQeZGxQEX61KYsdlx4dneMGw1hg8JYHjDR7l+N

gOYw==

X-Gm-Message-State: AOJu0YxB/ZSHKxvQJW9wMWQkOfVXjQMcD1b/48cjmvdWEF61ELK5XnKg

hoImv6ihPOoTcIYK9S/nezkoYdK8++oyukT1AfLmmOyuWwzFSPohneLbOPLbfCs1C4E/bNIJz/O

9NZepazc7z0U/jCkmKhR7a0YyZSMrAxOVE/Cey18=

X-Gm-Gg: AfdE7cmSJxFZy8YbJRKr9eiJ9fv12P2W15usS/zpTqLCCsMdtney7UolmRfZezi+WUw

YrSk3rD+UOJg203sICXPKYIkBf2gwd8VmZnThRtpevJYXq7pNkIcaEP9qmo/B8zFy9LtDpPjehK

1pexhv5FKJ42SYwzs5QtqTLihFTP7cj5viqfNh4itZSmCbCnUQNctY/ChOgB5/i7RoKqDhv32Gh

m/MohMuG5vpD7eNOoN+QGTsMQkAhMdqDVF2cTiUt0d7483bL2ITJjfvfp+McHXGREsmDMW2

X-Received: by 2002:a17:906:6a27:b0:c06:3267:4483 with SMTP id

a640c23a62f3a-c12aa1b3512mr126956066b.36.1782923768127; Wed, 01 Jul 2026

09:36:08 -0700 (PDT)

MIME-Version: 1.0

From: Abu Sayem

Date: Wed, 1 Jul 2026 22:35:54 +0600

X-Gm-Features: AVVi8CfxpGJ_n2zVIjvH50M1gpmTWtGQFjSJkgWuw2eygNEKMp5_Wo0Ep88o59Y

Message-ID:

Subject: Wev development

To: sales@nk.ca

Content-Type: multipart/alternative; boundary="000000000000dc644a06558f494b"



--000000000000dc644a06558f494b

Content-Type: text/plain; charset="UTF-8"



intactwebsolutions.com



--000000000000dc644a06558f494b

Content-Type: text/html; charset="UTF-8"







--000000000000dc644a06558f494b--

Chinese products spam

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dve@doctor.nl2k.ab.ca

Delivery-date: Wed, 01 Jul 2026 14:14:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wf1Iw-000000006oF-2Bz1

for dve@doctor.nl2k.ab.ca;

Wed, 01 Jul 2026 14:13:06 -0600

Resent-From: The Doctor

Resent-Date: Wed, 1 Jul 2026 14:13:06 -0600

Resent-Message-ID:

Resent-To: dve@doctor.nl2k.ab.ca

Received: from mail-m158182.netease.com ([47.251.158.182]:21918)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wexca-00000000GOK-2pn9

for sales@nk.ca;

Wed, 01 Jul 2026 10:17:19 -0600

Content-Type: multipart/alternative; BOUNDARY="=_Part_1976164_215894736.1782922570593"

To: sales

Subject: =?UTF-8?B?UmU6Q3VzdG9tIFNob2UgU29sZSBTb2x1dGlvbnMgZm9yIEZvb3R3ZWFyIEJyYW5kcw==?=

X-Priority: 3

MIME-Version: 1.0

Received: from serenatam@lebaijk.com( [10.139.0.42] ) by ajax-webmail ( [127.0.0.1] ) ; Thu, 2 Jul 2026 00:16:10 +0800 (GMT+08:00)

From: SerenaTam

Date: Thu, 2 Jul 2026 00:16:10 +0800 (GMT+08:00)

X-WM-Tid: 0a9f1e776ae100f8kunm715a231227a9a8

DKIM-Signature: a=rsa-sha256;

b=hSmQR4jaWFCnH2cCyhkvzY35JMDmpNXYewMeOFWQ6sC2OIHQzfz03HyyCkccOnwfEPU1hO8VbdYYfvFjt8qXQWbRiVNYcHIFwGYPiuPIdEsKzwQKtc+wCfAA4v9YmWH6khRZ/U7v/WunSgPLAreAxr+tufzDh+06uD/5S7Y28zXVL2+QdNjU2iLVubTKM3zXaQ4nMe8Nxbeeh6Kaymx/gCKgPwcNE4HVDBV4RXIGLyuzbuxNxkzYFs2RiC44GdmjOrpBxiMIiCsJK4Na13I1lBpHax362WQYs/G++drT/JRFsrXAPExvrczxNPIRm8LEtaGAIeO8JJj/gKjwmpzdRw==; s=default; c=relaxed/relaxed; d=lebaijk.com; v=1;

bh=BL95h406DBMujmq7CAdWpQ8JApjnT9DI8AojMtZs8Bg=;

h=date:mime-version:subject:message-id:from;

Message-ID:





Hi sales,

I hope everything is going well for you.

Your interest in our updates means a lot to us. We look forward to keeping you informed with our latest news and offers.

We are interested in learning more about your purchasing needs and the types of products you are seeking. Please let us know, and we can provide you with our comprehensive product catalog..

Your swift feedback will ensure we meet your needs effectively.

Thank you for taking the time to review this. I look forward to your prompt reply.

Best regards,







Obtain the latest product info by choosing . Keep My News Flow



Need to pause messages? Go to Opt Out Settings.





SerenaTam

serenatam@lebaijk.com









在2026-06-22,SerenaTam 写道:



-----原始邮件-----

发件人: SerenaTam

发件时间: 2026年06月22日 周一

收件人: [sales ]

主题: Custom Shoe Sole Solutions for Footwear Brands



Hi Sales,



We specialize in custom shoe soles, including natural rubber and bio-based sole solutions for footwear brands and manufacturers.



Would you be interested in seeing some of our latest sole designs?



Reply interested if you do.





Best regards,



Maintain your product-savvy edge with . Stay Updated on News



If you prefer to exit, choose Review Communication Options.





SerenaTam

serenatam@lebaijk.com





McAfee Phish from Google Gmail PArt 4























































































--===============8854736105934040237==--

McAfee Phish from Google Gmail PArt 2



--===============8854736105934040237==

Content-Type: text/html; charset="us-ascii"

MIME-Version: 1.0

Content-Transfer-Encoding: 7bit