Wise phish Part 2

--18d525d01afacd5527ac234829573d649

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: 8bit













Wise · secure email update





































            Â

wise

















🔐 Secure your account faster

















Service update: We’ve made it even easier to keep your Wise account protected.

Link your email inside Wise for a faster, more secure experience.





























✓

Faster transactions – email verification speeds up every step.



✓

Extra security layer – your linked email acts as a secure recovery channel.



✓

One‑click verification – no more waiting, just confirm and go.



















âš¡ Link your email



















⚡ Pro tip: Linking your email also enables faster support and real‑time notifications.

This update is already live – you can link your email in just 2 taps.

















wise · 5 Churchill Place, London E14 5HU

This is a service update — no action required if already linked.

🔒 secure · wise.com





























--18d525d01afacd5527ac234829573d649--

Wise phish Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 25 Jun 2026 07:59:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wckar-000000002Bs-3d5C

for dave@doctor.nl2k.ab.ca;

Thu, 25 Jun 2026 07:58:13 -0600

Resent-From: The Doctor

Resent-Date: Thu, 25 Jun 2026 07:58:13 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [176.221.37.67] (port=35314 helo=sdc200.switchdigital.pt)

by doctor.nl2k.ab.ca with esmtp (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wcjFJ-00000000Kt7-0hjO

for webmaster@nk.ca;

Thu, 25 Jun 2026 06:32:01 -0600

Received: by sdc200.switchdigital.pt (Postfix, from userid 586)

id 69E034D41C55; Thu, 25 Jun 2026 13:20:12 +0100 (WEST)

Date: Thu, 25 Jun 2026 13:19:40 +0100

To: webmaster@nk.ca

From: =?UTF-8?B?V2lzZS4=?=

Subject: =?UTF-8?B?U2VjdXJpdHkgVXBkYXRlIGJ5IEp1bmUgMjUsIDIwMjY=?=

Message-ID:

List-Unsubscribe: mailto:bounce179-s8tW27kXAp4QjeE@fr.ittenz.com?subject=list-unsubscribe

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="18d525d01afacd5527ac234829573d649"

Content-Transfer-Encoding: 8bit



This is a multi-part message in MIME format.



--18d525d01afacd5527ac234829573d649

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit













Wise · secure email update





























            Â

wise

















🔐 Secure your account faster

















Service update: We’ve made it even easier to keep your Wise account protected.

Link your email inside Wise for a faster, more secure experience.

















✓

Faster transactions – email verification speeds up every step.









✓

Extra security layer – your linked email acts as a secure recovery channel.









✓

One‑click verification – no more waiting, just confirm and go.



















âš¡ Link your email



















⚡ Pro tip: Linking your email also enables faster support and real‑time notifications.

This update is already live – you can link your email in just 2 taps.

















wise · 5 Churchill Place, London E14 5HU

This is a service update — no action required if already linked.

🔒 secure · wise.com

WEb/SEO/App spam from Microsoft Outlook Part 2





--_000_PH0PR05MB89012E982D5A605675CD4420F2EC2PH0PR05MB8901namp_

Content-Type: text/plain; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable



Hi,

I reviewed your website=97great design, but it=92s not ranking well on Goog=

le for key searches.

We help businesses grow visibility using AI-powered SEO (ChatGPT & Gemini) =

across Google, Bing, and Yahoo.

Open to a quick chat? WhatsApp: +91 9211383434

Best,





--_000_PH0PR05MB89012E982D5A605675CD4420F2EC2PH0PR05MB8901namp_

Content-Type: text/html; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable








252">








d-color: rgb(255, 255, 255); margin: 1em 0in; font-family: Aptos, Aptos_Emb=

eddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: =

12pt; color: rgb(0, 0, 0);">

Hi,



d-color: rgb(255, 255, 255); margin: 1em 0in; font-family: Aptos, Aptos_Emb=

eddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: =

12pt;">

I reviewed your website=97great design=

, but it=92s not ranking well on Google for key searches.


We help businesses grow visibility using AI-powered SEO (ChatGPT & G=

emini)
 across Google, Bing, and Yahoo.


Open to a quick chat? WhatsApp:

=3D"https://wa.me/+919211383434" id=3D"OWA3d4b2bbe-8af7-ef25-bc1c-961dbdfa1=

064" class=3D"x_x_x_x_x_x_OWAAutoLink" title=3D"https://wa.me/+919211383434=

" data-auth=3D"NotApplicable" data-linkindex=3D"0" style=3D"color: blue; ma=

rgin: 0px;">+91

9211383434



d-color: rgb(255, 255, 255); margin: 1em 0in; font-family: Aptos, Aptos_Emb=

eddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: =

12pt; color: rgb(0, 0, 0);">

Best,



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">












--_000_PH0PR05MB89012E982D5A605675CD4420F2EC2PH0PR05MB8901namp_--

WEb/SEO/App spam from Microsoft Outlook Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 25 Jun 2026 06:15:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wciy1-000000000Mk-0dZM

for dave@doctor.nl2k.ab.ca;

Thu, 25 Jun 2026 06:14:01 -0600

Resent-From: The Doctor

Resent-Date: Thu, 25 Jun 2026 06:14:01 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-westus2azolkn19012048.outbound.protection.outlook.com ([52.103.10.48]:50722 helo=MW6PR02CU001.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wcd6e-000000007lO-2vKw

for sales@nk.ca;

Wed, 24 Jun 2026 23:58:42 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=lQt/caj5jtvkZ7CoLfeLqw+dx/OnuNOrwC3UcAGd9+x1T2CHMCQSEsBK3slo/RzPYfdvzt64xMT1lX+AuniLHnDfXUHzYzTLzNKWmnmop1TXK2vJiKKAIaj1xgJpP5Rl4oaBGFEweixpvtp51VY5gGYnDgQXLJThyUtYSE7ghAPp7pEAHKcqlAiQGpxkVzQqUiUsJ2Wn5m9+i5wBVczjYcDzhY4d2JrkfOTZ2lFFXAF8FrOx1DWK52KGHjScWEtC7/de1hebiLtqAlKk5FJab/0JRCZgynlQSX5bEBPycHfAEoARvJCUkpoEjK3dnWoECWyGViKudaWsZWEBO5pfZQ==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001; h=From:Date:Subject:Message-ID:MIME-Version;

bh=9jdP4Oy2z6YSnhYxTUFVxVJZTOZV1sJnPLP6Jzv8tIE=;

b=R4SLYKDWUyFrXrAVjtOutRtXZlQttCYrAIjuANY71gCPaZlfdy0ejZrI/abq+h+f/nG476FEZYjBtJjeAfP/5sNfYrTOZ4GKFgbJH25pLP/8XBswDAkri8n91R2PXENXccGyMGaOXryL1hZ4GbfQ98GooMXS0+P0NP888v1FWdOmnY35SECsbtEFLe3mnTcSoWnM7vpbq/M6ouLMPBFVmnB2hnic91Oylg5zwrIr6CkIassVADscs3xQUXLVsGU+q57RZni2GkvIwUVHU/x/F2p468MN7q1aULIi2lGBEBYNXDpUqsQ/U1vgjgqewEqSogUwWMdsbz9WlifVVzcV0w==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hotmail.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=9jdP4Oy2z6YSnhYxTUFVxVJZTOZV1sJnPLP6Jzv8tIE=;

b=MvXJwC/u3hcjnOO1RjLo3K2mvGeS8ek3rnaZtrYJzFDO7cP66VPFZbk2655rgbVhCruAujqMVflus/h01f/Up0s4yKMOmUoaEKN20QCuPynnW6vSCihzaJE22WnzfROogqEBQXpjdbi4akqwtMs62LGHpG374XVdEfjv7wQbVrvuaWDVxHJ7XQOHv6TYKTJ5dSfi0aJDJ65Gk9ZMAQNaSiAlITVAs5Z/rnzXwjWPVZlKCUspbe6lBzArxvzFXTE2hx/BvR3MCedfEn2PBvo3WA9whKXiAF64Hr0ERbyWvH2p1IVH/so9l96/GLEURqDvO6BYfynviB+H1AskwzHIIA==

Received: from PH0PR05MB8901.namprd05.prod.outlook.com (2603:10b6:510:d8::14)

by SJ2PR05MB9853.namprd05.prod.outlook.com (2603:10b6:a03:4f6::6) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.159.10; Thu, 25 Jun

2026 05:57:20 +0000

Received: from PH0PR05MB8901.namprd05.prod.outlook.com

([fe80::d5db:a25d:7226:9e41]) by PH0PR05MB8901.namprd05.prod.outlook.com

([fe80::d5db:a25d:7226:9e41%5]) with mapi id 15.21.0159.007; Thu, 25 Jun 2026

05:57:20 +0000

From: Michael Hudson

Subject: Fw: Proposal ?

Thread-Topic: Proposal ?

Thread-Index: AQHc5oYwqY1Gy2NsGkWd7ewsUHzyBbYTQNBmgDtLudw=

Date: Thu, 25 Jun 2026 05:57:19 +0000

Message-ID:



References:





In-Reply-To:



Accept-Language: en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

msip_labels:

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: PH0PR05MB8901:EE_|SJ2PR05MB9853:EE_

x-ms-office365-filtering-correlation-id: c24a7e1f-27e0-48e8-7cfb-08ded27e9e63

x-microsoft-antispam:

BCL:0;ARA:14566002|24121999003|9400799043|37011999003|31061999003|22091999003|19110799012|20031999006|704163111799003|2604032031799003|4140399003|25010399006|39105399006|24021099003|55001999006|12050799012|16051099003|15030799006|24071999003|15080799012|8062599012|8060799015|7071999006|3412199025|440099028|102099032|10035399007|31055399003|40105399003|43065399003;

x-microsoft-antispam-message-info:

=?Windows-1252?Q?3gu4JXKsXvkddD7DrkFCefRKbVgQCx8CVaahAS2M95T6b0imbJu9rd7b?=

=?Windows-1252?Q?mKe5tvBFXnQ7CcD8TqxHBEKlmp/vQp9f9dxUQ9GYBy8BT71xxVNYJT7h?=

=?Windows-1252?Q?O9ISgtv5ELTikRFwEyr7hTpj/wGylOWadII2Qt8W9B9nxwCgPMDPn0fN?=

=?Windows-1252?Q?vmvKzpEwjN3VClpUm9rWyAv+Hxf1wI2wv26LGPCjxB1e33K12iPY/AnD?=

=?Windows-1252?Q?Z8gDNb46ZKO2HcHObYbIzr9j24E7NrugbAwO5vdxV7Dqc8xQbuZQz4nB?=

=?Windows-1252?Q?pVK9SQcr84X6R8qpw91sHb8GogmVQllgF3huEPZtQJYrUjpSgfBbX5QH?=

=?Windows-1252?Q?4ICKt1foeWme8K1fgEx9PxgOEuZaX270v1WtKo1d5gL/a3F2YruF5RFg?=

=?Windows-1252?Q?3/6w6Ovsrn2QHEZ2ASjS0CLZHsiKPx3HNm08aXxmWvXhOCdgKrAs+aoj?=

=?Windows-1252?Q?BN4StpmW/Fo2C836rwHMj57RcRKK5fFAhL3OAlcjoTh0/avfPFk4+F4f?=

=?Windows-1252?Q?+97u86738+B5JRK8WU7s7h9JipBo6gDuYnQ9KX3y7GRNvdffulvNsrcl?=

=?Windows-1252?Q?wX8goNO3mUpoc4G8Kep+M2DCAyQ3a/cVSkx6zgwVTE005ZSNvhwYubSR?=

=?Windows-1252?Q?qyz0yCQtAB7FKjVD2NhKU93seOAel2T0eR18UhTylp5V2RvIJMhV+SMm?=

=?Windows-1252?Q?nF4ttKVl+jDN6F033wztfIi/cMjOymOaIrVklLeWpaH8A/f2GCwg1KxT?=

=?Windows-1252?Q?CgN/5+awu3qX+yH0hymvS9ySOCeu8sqWyHPKQrcKtJycE2bNflS6pedF?=

=?Windows-1252?Q?/IXFYKiczZI1zEWnEt0KHJ2ES3anNB4RwWS+lt1pnQp+8/jHZXQSeC9G?=

=?Windows-1252?Q?7Ns5msJfKaYNQKxiMxAwzfrBRcx2z8CRG4O/g6HP6uQSrApxPLiiBaf5?=

=?Windows-1252?Q?5+WE2K+k+lQSH+tFuiTxuafh/FFmfTtt/tLqcHEayr0GYwZDeeCiPpFq?=

=?Windows-1252?Q?p6SjNdIYyjryKCTeTYBxWs0gBq8HAvDZAQvlZRrZs539lvkeJzHIFo5K?=

=?Windows-1252?Q?mnntjL/wfMkILy5sYvZs87kC5rK7kbeRdx0XvnTr0PHIQ0X20kmgmrVN?=

=?Windows-1252?Q?QQmZ0LTp3x9RGukb5NKjlHwXLGic1NhMN1RR59v/llFhAcAMF+Bq4iUq?=

=?Windows-1252?Q?A84pGMewsYz2aqrfGLtOcdYhLasHx/rT6diildAMeCOBMRRBTp+xcFwW?=

=?Windows-1252?Q?F101jYUdecnZ9H4NUR6GJW2p8/F/qzSwWTeZK9z4r4NMtCT+L2lfdpiV?=

=?Windows-1252?Q?XsviAkK39FZxceaJLAm232WHElVtmfiIcUuAJOqLzj16XoU70ymheSWB?=

=?Windows-1252?Q?NYTwRy+oV0f8Zi4YBp5tHpQxTGE/mNr18ASVx8CNoG1L5YQukhXMEyq9?=

=?Windows-1252?Q?Ny/IhAgDR00VVA8it+0d1kMzfeRiV7LSec8z56b61x8WiaGD4qlVJz/4?=

=?Windows-1252?Q?ynR+Wcj+y02nXbiYF0GVNd/N58+ECg=3D=3D?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?Windows-1252?Q?biFONmso5UixKOrFekbtyFydt+Nng26Pb+oJsTeQWfJwX/mVF1m+BMLX?=

=?Windows-1252?Q?3iCPmuRqbwBABR+u03aW5By/e9i1yVML20EeheTG3V9FHbpQ4UVHo8cZ?=

=?Windows-1252?Q?qmCyFS3EmuRT5uElwREl3qhxItzQTazRMUpS9Ys0eNaRcg33LzL4Vf5M?=

=?Windows-1252?Q?OMQorviaSovMgaT3tnnE19ckwMb9jL/sAvClwtwCFTxmMniBO6lIaQuh?=

=?Windows-1252?Q?U16dnwO/kX1pIWyV0bzPbggHZIH04spjbzhb+W14aPwz2jCq6wk82KmO?=

=?Windows-1252?Q?0NkQmfWKEVYXGyAQOTv5q967TKdZoHgRBSxxVgdGuewrXBNL1lQQFwuW?=

=?Windows-1252?Q?p6TFBdZhckuuIEOTInUCo9Zv9wLzs+EuHO8VVtOqHEDX2DcCUmVigpME?=

=?Windows-1252?Q?Tac3wrTPNBiZMplnDqB3d9KtEGWr9oCyVAaICzSNxf1eJ2a75HJaoJ1H?=

=?Windows-1252?Q?iEFekIzuuJs34EnTXyLAjcZJFNlLEkOe0sgpFtBmM/gD8iEjHNjWXRe9?=

=?Windows-1252?Q?HISfKOBkxoyhe9cnnINE3KT9N4U7VMM/d0GE3GfwR4k+2/aatajOuPHL?=

=?Windows-1252?Q?qhw318sx8nEuoiWRNmAl9ZvXVvZPYYzdMHay1QUjcEeCSrq/Bvty72uO?=

=?Windows-1252?Q?lLxBw9I9E8WKLt5esm4j9KkCJEqtnIJXS4OC3GrsA3u2d9VLVez06Non?=

=?Windows-1252?Q?DeyjGzpA72NYq3QfiIMg1utUzlzJ7rHaGly2S9y8diHZwnClJOMuFFId?=

=?Windows-1252?Q?YBt2VOykMFkUpDWrzNr1r+Bs+s5k5nL5BBVbRWk0tIzPRH8sURi5Ztgc?=

=?Windows-1252?Q?CcCWCmDEfj9asQCMKUiihu2Lhi/PzAH1pYgN4Z17IgZyD2UAmoxlfMRh?=

=?Windows-1252?Q?naJ5f1/BFQjThNn90QRoDYlIFnO3BX1xYWNcSP9MIsry7JJK66jyVgPP?=

=?Windows-1252?Q?8+CdbsJq2rZklgaGTlVrH18iX78QSdXFwul7KTvsSKWoI5Hs8gVvkhlA?=

=?Windows-1252?Q?0usLsxe+LrRBOVLGNS91eWdT/eAClq2NuBUkIlpwZTw8I1P+1qQydSZR?=

=?Windows-1252?Q?+4TUoMHjvlHAR0IillH/5kPH2pMG8KBNAcxn07xFiOOpSz2P3QhOANaF?=

=?Windows-1252?Q?un+swN3i87DvUoNI6gJty4TjzBB6bVhHmXlm0CzKaXsabYJA6fL7/61Y?=

=?Windows-1252?Q?yMS1Im17doxIsm1akCNKlDAFI2X6eay/EgLIuT78C0z/fhJqmHC5+eWS?=

=?Windows-1252?Q?bPQg7b5vuXL1erHCGlZjIaoD+SBiObRG9pg6YarleXbDA139TJ8Kudia?=

=?Windows-1252?Q?CXE/6RZWCP6wxbEii1LaiVWobOfTnOAbtzVBrXzPpb+NNCQihx8HZ0Y4?=

=?Windows-1252?Q?y70MgSnuCKpaiUcnGJgHW/6HJZRrAwOi1h1LVPRvXCK1slIpzDVBL3u0?=

=?Windows-1252?Q?PCvVQPN4QytdA5YHvgrr3XqZrrXPQqSXMT5nI7mnZjsHWBluVAEG1c+l?=

=?Windows-1252?Q?SAweK17xcfafVpMBG8h35AJ0mntqMlW0My4iDxjLV7kjsMJTU1qoO2YZ?=

=?Windows-1252?Q?G/EA241SRFSA4O72?=

Content-Type: multipart/alternative;

boundary="_000_PH0PR05MB89012E982D5A605675CD4420F2EC2PH0PR05MB8901namp_"

MIME-Version: 1.0

X-OriginatorOrg: sct-15-20-9343-9-msonline-outlook-c6799.templateTenant

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: PH0PR05MB8901.namprd05.prod.outlook.com

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: c24a7e1f-27e0-48e8-7cfb-08ded27e9e63

X-MS-Exchange-CrossTenant-originalarrivaltime: 25 Jun 2026 05:57:19.7933

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: SJ2PR05MB9853

Lottery spam

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 24 Jun 2026 22:44:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wcbvr-000000003Zu-2k2e

for dave@doctor.nl2k.ab.ca;

Wed, 24 Jun 2026 22:43:19 -0600

Resent-From: The Doctor

Resent-Date: Wed, 24 Jun 2026 22:43:19 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from cpanel3.faster.net.br ([200.187.80.31]:52891 helo=ns1.faster.net.br)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wcaxL-000000000J5-0VnR

for sales@nk.ca;

Wed, 24 Jun 2026 21:40:56 -0600

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;

d=regnet.com.br; s=default; h=Reply-To:Date:From:To:Subject:MIME-Version:

Content-Type:Sender:Message-ID:Cc:Content-Transfer-Encoding:Content-ID:

Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc

:Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:

List-Subscribe:List-Post:List-Owner:List-Archive;

bh=p//gVYZkizsQOFK3jxrvO1S/MZk7KU78Q7j/BZK/dLU=; b=HQCtS259jEBc2hWMzvI/HJr3SV

a4W9oOEMQR+4O9bTUNS8Yx5tBgrHj3qTkpA8fiQtD4PCBV2OlzBORrjuKtRJLZ9ayvbyT+d10jhQG

Tdzfm3yv8jRi5yJAtUabSLAvh6oHM0gru+82IMMgkKa1LRGXayVy7X9t+UYluMrTH2k5A0ErtDgv1

qY+ADevOzgZuaggKNCVa2nV3gnYbLmsW7y22KgiYiWUUXh1t8clghSavOFKQipRJq7uaPtRBn+GVd

i/c+msaA/BhZ40OyngjhnK/PUURvvNf5dMJpByCnH/rSMa/n2QqGw4+V/dJ/5pEXgln964uiVfICt

BfM51/ug==;

Received: from [217.114.38.235] (port=28915 helo=[10.5.0.2])

by cpanel2.faster.net.br with esmtpsa (TLS1) tls TLS_DHE_RSA_WITH_AES_256_CBC_SHA

(Exim 4.96.2)

(envelope-from )

id 1wcavU-006eu7-2O

for sales@nk.ca;

Thu, 25 Jun 2026 00:38:54 -0300

Content-Type: multipart/alternative; boundary="===============0126583100=="

MIME-Version: 1.0

Subject: Your Attention

To: sales@nk.ca

From: "Phoenix Charlotte"

Date: Thu, 25 Jun 2026 04:38:51 +0100

Reply-To: phoenixgracecharlotte@gmail.com

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - cpanel2.faster.net.br

X-AntiAbuse: Original Domain - nk.ca

X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]

X-AntiAbuse: Sender Address Domain - regnet.com.br

X-Get-Message-Sender-Via: cpanel2.faster.net.br: authenticated_id: info@regnet.com.br

X-Authenticated-Sender: cpanel2.faster.net.br: info@regnet.com.br

X-Source:

X-Source-Args:

X-Source-Dir:

X-Spam_score: 8.9

X-Spam_score_int: 89

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Kindly confirm ownership of your email sales@nk.ca. It was

randomly selected, after an electronic computer Spinball draw, to receive

a Grant Donation of $1,250,000.00 USD from Phoenix Foundation. Send [...]





Content analysis details: (8.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.1 MISSING_MID Missing Message-Id: header

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[217.114.38.235 listed in will-spam-for-food.eu.org]

[217.114.38.235 listed in will-spam-for-food.eu.org]

[217.114.38.235 listed in will-spam-for-food.eu.org]

[217.114.38.235 listed in will-spam-for-food.eu.org]

[217.114.38.235 listed in will-spam-for-food.eu.org]

[217.114.38.235 listed in will-spam-for-food.eu.org]

[217.114.38.235 listed in will-spam-for-food.eu.org]

[217.114.38.235 listed in will-spam-for-food.eu.org]

[200.187.80.31 listed in will-spam-for-food.eu.org]

[200.187.80.31 listed in will-spam-for-food.eu.org]

[200.187.80.31 listed in will-spam-for-food.eu.org]

[200.187.80.31 listed in will-spam-for-food.eu.org]

[200.187.80.31 listed in will-spam-for-food.eu.org]

[200.187.80.31 listed in will-spam-for-food.eu.org]

[200.187.80.31 listed in will-spam-for-food.eu.org]

[200.187.80.31 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[217.114.38.235 listed in dnsbl.ahbl.org]

[217.114.38.235 listed in dnsbl.ahbl.org]

[217.114.38.235 listed in dnsbl.ahbl.org]

[217.114.38.235 listed in dnsbl.ahbl.org]

[200.187.80.31 listed in dnsbl.ahbl.org]

[200.187.80.31 listed in dnsbl.ahbl.org]

[200.187.80.31 listed in dnsbl.ahbl.org]

[200.187.80.31 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[217.114.38.235 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[217.114.38.235 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[217.114.38.235 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[217.114.38.235 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.

[200.187.80.31 listed in bb.barracudacentral.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[200.187.80.31 listed in bl.score.senderscore.com]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 LOTS_OF_MONEY Huge... sums of money

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

0.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?

Subject: {SPAM?} Your Attention



You will not see this in a MIME-aware mail reader.

--===============0126583100==

Content-Type: text/plain; charset="iso-8859-1"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Content-Description: Mail message body



Kindly confirm ownership of your email sales@nk.ca. It was randomly selecte=

d, after an electronic computer Spinball draw, to receive a Grant Donation =

of $1,250,000.00 USD from Phoenix Foundation. Send a confirmation Email rep=

ly for more details.

--===============0126583100==

Content-Type: text/html; charset="iso-8859-1"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Content-Description: Mail message body




=3Diso-8859-1"/>Kindly confirm ownership of your email sales@nk.ca. =

It was randomly selected, after an electronic computer Spinball draw, to re=

ceive a Grant Donation of $1,250,000.00 USD from Phoenix Foundation. Send a=

confirmation Email reply for more details.

--===============0126583100==--

Lottery spam from Microsoft Outlook Part 3






ddedFont", "Aptos_MSFontService", Calibri, Helvetica, sans-s=

erif; font-size: 12pt; color: rgb(0, 0, 0);">

Sincerely,



ddedFont", "Aptos_MSFontService", Calibri, Helvetica, sans-s=

erif; font-size: 12pt; color: rgb(0, 0, 0);">

Dr. Elizabeth Henning.



ddedFont", "Aptos_MSFontService", Calibri, Helvetica, sans-s=

erif; font-size: 12pt; color: rgb(0, 0, 0);">







ddedFont", "Aptos_MSFontService", Calibri, Helvetica, sans-s=

erif; font-size: 12pt; color: rgb(0, 0, 0);">

 Copyright =A9 2026 Microsoft! Inc. All rights reserved.








--_000_DB9PR10MB7625E43FBCEF4A786A6186DB9DED2DB9PR10MB7625EURP_--

Lottery spam from Microsoft Outlook Part 2

Content preview: Attn: Congratulation!!! Your e-mail address has won $2million

for 2026 Microsoft Award. Serial numbers MDB/002 0869958/09 Contact (ADVOCATE

FRANKLIN EDWARD) immediately; through his email address (frankline [...]



Content analysis details: (11.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[2603:10a6:10:338:0:0:0:17 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:338:0:0:0:17 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:338:0:0:0:17 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:338:0:0:0:17 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:338:0:0:0:17 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:338:0:0:0:17 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:338:0:0:0:17 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:338:0:0:0:17 listed in]

[will-spam-for-food.eu.org]

[52.103.32.17 listed in will-spam-for-food.eu.org]

[52.103.32.17 listed in will-spam-for-food.eu.org]

[52.103.32.17 listed in will-spam-for-food.eu.org]

[52.103.32.17 listed in will-spam-for-food.eu.org]

[52.103.32.17 listed in will-spam-for-food.eu.org]

[52.103.32.17 listed in will-spam-for-food.eu.org]

[52.103.32.17 listed in will-spam-for-food.eu.org]

[52.103.32.17 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[52.103.32.17 listed in dnsbl.ahbl.org]

[52.103.32.17 listed in dnsbl.ahbl.org]

[52.103.32.17 listed in dnsbl.ahbl.org]

[52.103.32.17 listed in dnsbl.ahbl.org]

[2603:10a6:10:338:0:0:0:17 listed in]

[dnsbl.ahbl.org]

[2603:10a6:10:338:0:0:0:17 listed in]

[dnsbl.ahbl.org]

[2603:10a6:10:338:0:0:0:17 listed in]

[dnsbl.ahbl.org]

[2603:10a6:10:338:0:0:0:17 listed in]

[dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[52.103.32.17 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[52.103.32.17 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[52.103.32.17 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[52.103.32.17 listed in dnsbl.ahbl.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

1.2 MISSING_HEADERS Missing To: header

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[webkk010(at)outlook.com]

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[webkk010(at)outlook.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[52.103.32.17 listed in wl.mailspike.net]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[52.103.32.17 listed in list.dnswl.org]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

3.0 BIGNUM_EMAILS Lots of email addresses/leads

0.8 HK_LOTTO No description available.

1.4 MALFORMED_FREEMAIL Bad headers on message from free email service

0.0 LOTS_OF_MONEY Huge... sums of money

0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information

1.0 FREEMAIL_REPLY From and body contain different freemails

1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form

1.8 ADVANCE_FEE_4_NEW_MONEY Advance Fee fraud and lots of money

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[52.103.32.17 listed in bl.score.senderscore.com]

Subject: {SPAM?}



--_000_DB9PR10MB7625E43FBCEF4A786A6186DB9DED2DB9PR10MB7625EURP_

Content-Type: text/plain; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable



Attn:



Congratulation!!!

Your e-mail address has won $2million for 2026 Microsoft Award. Serial numb=

ers MDB/002 0869958/09 Contact (ADVOCATE FRANKLIN EDWARD) immediately; thro=

ugh his email address (franklinedward00@aol.com) or phone number +277363940=

04 and forward him your Winning No.(19-45-87-36-76-38(77), to redeem your w=

inning prize, All participants were selected randomly from Worldwide Web si=

te through computer draw system and extracted from over 100,000 email addre=

sses of companies and Individuals.



Sincerely,

Dr. Elizabeth Henning.



Copyright =A9 2026 Microsoft! Inc. All rights reserved.



--_000_DB9PR10MB7625E43FBCEF4A786A6186DB9DED2DB9PR10MB7625EURP_

Content-Type: text/html; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable








1">








ddedFont", "Aptos_MSFontService", Calibri, Helvetica, sans-s=

erif; font-size: 12pt; color: rgb(0, 0, 0);">

Attn:



ddedFont", "Aptos_MSFontService", Calibri, Helvetica, sans-s=

erif; font-size: 12pt; color: rgb(0, 0, 0);">







ddedFont", "Aptos_MSFontService", Calibri, Helvetica, sans-s=

erif; font-size: 12pt; color: rgb(0, 0, 0);">

Congratulation!!!



ddedFont", "Aptos_MSFontService", Calibri, Helvetica, sans-s=

erif; font-size: 12pt; color: rgb(0, 0, 0);">

Your e-mail address has won $2million for 2026 Microsoft Award. Serial numb=

ers MDB/002 0869958/09 Contact (ADVOCATE FRANKLIN EDWARD) immediately; thro=

ugh his email address (franklinedward00@aol.com) or phone number +277363940=

04 and forward him your Winning

No.(19-45-87-36-76-38(77), to redeem your winning prize, All participants =

were selected randomly from Worldwide Web site through computer draw system=

and extracted from over 100,000 email addresses of companies and Individua=

ls.



ddedFont", "Aptos_MSFontService", Calibri, Helvetica, sans-s=

erif; font-size: 12pt; color: rgb(0, 0, 0);">


Lottery spam from Microsoft Outlook Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 24 Jun 2026 22:38:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wcbq9-000000003J0-38iY

for dave@doctor.nl2k.ab.ca;

Wed, 24 Jun 2026 22:37:25 -0600

Resent-From: The Doctor

Resent-Date: Wed, 24 Jun 2026 22:37:25 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-northeuropeazolkn19010017.outbound.protection.outlook.com ([52.103.32.17]:18620 helo=DB3PR0202CU003.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wcWRx-00000000Jb1-2BET

for doctor@doctor.nl2k.ab.ca;

Wed, 24 Jun 2026 16:52:16 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=wCDiIoo3iTnGkSRA4GJh/tCNjKoZiRJcR1GM57+6WIwbMGt574JKHO/vPZ9F9szF9VJPBdpxAjd+ayKR1ujHgZ7jqQw20BxpzmHdmZIk2R8xQaWb9xdoSrDXPMEwrtwTA2Q63fuwaFkxYQeTFRoo4O99hDHBp8aigZNb0f2RDaoqe8hBxVR/3v+1deO6rOmw/803TFEEgJRN8IQM0QgJr6yMHLG2w8DslBBg13HNGe3Fr3Bzt2EkDQaMCaGYyBxgM/DnLUxZPQ0TolSB+D03ejaJBDBPQU/rsI9QPJtm8R118O7WE7gvNeMsLp0rfC47me9A3cZi0womzetX6EmQTA==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=TI1xJPTAy9U/+9C6Gcr3pTqhGS44SLIkHDOBIL0sVvU=;

b=oXPehhMthLxR2ANQFAWFDsBUYYEHV0aCKrAXZYG+NrBXhvB4wc03rws/dSesT7vpm//j4RWQdHlUilEeWlZ/z/2BFTouauVNK3u43NxSJ7Nkl8viaPdlMgdIQsz/KQ+bZQrOTA9qpuoNG7kzaIu2PoUO607+WcquDyhUPbOPXVB6ctyG4poMYsbxYO9toc/t5du7ERGK0bVzzZssfdPgUzpMPQyzeaPGPt0Wlih9V2RmxEqu9/qFZNFqCIgCXffC6ixmG1Yq52N0on4N4BlZdspOEFHYK6eLy2K0F9i8qs9lIR64ACje4Wvj5V5U/nDXryhOJ5PHNOaxbPr2/WkNIg==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=TI1xJPTAy9U/+9C6Gcr3pTqhGS44SLIkHDOBIL0sVvU=;

b=ZFmDrfEF9A2daPEfO2KRBDt0AmvE63p7A4Zz40Sc+evTbLaJg+csMfRldYFg+DkDnYYHwqLoQxAWbabGfZbcjwypK5KAkIGcUBlUBJ0IGKIJ2FustLAJyMZJ8WKWAOOegJcEN1i/xETuPbY5W8M6O1JPK/9YA1xqeHZ/aQCnt40ECblmPuhk73gWmDu+o1LAsh4X+3avbEKlvpO4EaYLrHgirCfS+cl7OWpFzOerVTrqSAxLRvsDkckrEOjD3TPVq6JV0zLCe/bzA+f+yE2beNw7QhKYfazQMmRU3bo8ZX+piIqm7XbeUKRrHr+JmsvHNe7bgmx0jAjumgUOBp6GRA==

Received: from DB9PR10MB7625.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:10:338::17)

by GVUPR10MB9896.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:150:349::5) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.139.18; Wed, 24 Jun

2026 22:50:57 +0000

Received: from DB9PR10MB7625.EURPRD10.PROD.OUTLOOK.COM

([fe80::d389:eeca:2942:c93c]) by DB9PR10MB7625.EURPRD10.PROD.OUTLOOK.COM

([fe80::d389:eeca:2942:c93c%6]) with mapi id 15.21.0159.015; Wed, 24 Jun 2026

22:50:57 +0000

From: Microsoft Inc.

Subject:

Thread-Index: AQHdBCvrEANbyvxel0u2deUzlzOl1g==

Date: Wed, 24 Jun 2026 22:50:56 +0000

Message-ID:



Accept-Language: en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

msip_labels:

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: DB9PR10MB7625:EE_|GVUPR10MB9896:EE_

x-ms-office365-filtering-correlation-id: 10af752e-11ef-4b4e-6d68-08ded2430dbc

x-microsoft-antispam:

BCL:0;ARA:14566002|15030799006|19110799012|8062599012|15080799012|25010399006|4140399003|8060799015|39105399006|55001999006|5062599005|24121999003|22091999003|24071999003|7071999006|31061999003|41001999006|24021099003|6115599003|16051099003|20031999006|35041999009|26104999009|102099032|40105399003|43065399003|31055399003|26131999018|26121999007|440099028|3412199025|39005299015|11120399003;

x-microsoft-antispam-message-info:

=?iso-8859-1?Q?Ao3DgGIueJjRp4a4GYwGGa2kvYrYFzwjoljhxL5RFQaYY/fDbQ0xgWERGB?=

=?iso-8859-1?Q?0v7RMsHLnHVvm8HhA3owTX8PKB+QERwlJZtNysS3QZIGR40VFTuDVUjN6v?=

=?iso-8859-1?Q?et1yahMlrMZ3txCZm0PTvpsINl4QIva92ma4eh/rQkP3R3EUFhnbj/gIKP?=

=?iso-8859-1?Q?EtJk7jH4GMWdAl60N1xit/6fhaJ+zOE0HWZ7VgOZ2EJduLHMmEULhivX6o?=

=?iso-8859-1?Q?KdfOxMI8wHdDpgXKT5RbU3L7JXaabm98LE1QTC8mFp9UMYq3o0WXAtFl9H?=

=?iso-8859-1?Q?ylKCG9MpoCa0RFOQPTSs9TxBpwVG3skxGOoOckB8r90JUD8muxn73PkBOj?=

=?iso-8859-1?Q?DXvtCwspwE0KqPmp1J0WQZIDZnIBpF+lVZgXYpZDz2R1kcBgiB3TWT9VHC?=

=?iso-8859-1?Q?ZnjI2ces3vAHmlQfg/cww+6R3RN/Hklm3tNrSmNii5SnvTa5qP0mzRU3bh?=

=?iso-8859-1?Q?BzDSQh+8gWkyFmls4zEGbLVtjgUJh0aB4dV+WcA7zznhAVIso02LVJyPl+?=

=?iso-8859-1?Q?K3sUHN/gM12R5J9e51rBsf6w3R9avm8eSMnZp1ibOr3tEzKKiSexx8SRSi?=

=?iso-8859-1?Q?PEhxRkv2QFpQTOUGvr4Q96K99TAICz2n8UZ3IAfqrheH0CWG9sTbFlGBFX?=

=?iso-8859-1?Q?HAJceDfMhnNWRntiNx8QopbuVyF+OwVgHcLfPYUwL0WbuasSyyPCRGZg9F?=

=?iso-8859-1?Q?gWJ3Jgsv/Bt59zhe+aqO+Q468fv4GRoZ0qPH9ZCKPDWmqSfrViayn8Ff86?=

=?iso-8859-1?Q?0J8jAfZPwdcnPuZhfWA+/HyCO4w7kR1UnES1JXpOubxoYDqu05xPKqDOQB?=

=?iso-8859-1?Q?qP6flzowuQVEUILp34Z1qQL0l7IQ+AKMqs0HTR+QELkJEtnCPGop7DifhQ?=

=?iso-8859-1?Q?e0pJC1JjierLmVuFkowQ0tV2OQcJG6lPtYOQR5uan8uAvrFp8Q4YChjxAt?=

=?iso-8859-1?Q?bHr2LGrws2ZJ+EwI4iu8Lx5qFGAthpC+gRFI+tqWqeRks1urWLZzCyJKJU?=

=?iso-8859-1?Q?ch6G0fdXtOSjw0v8T97/CLJMTyvc0BdjKljVP8WcZdmtA6TYlWg21IG6jU?=

=?iso-8859-1?Q?d5PpgMk1wRFxdHGrKNseTk5VWmXAx8MH0yNC+J5VlRQZhSAkPNSm/ZB0ty?=

=?iso-8859-1?Q?fv6e0FPi7bJ2me5J87rwaai/bpIpyFQo19FsdkW14zjFxFNRSSBCZQHU0a?=

=?iso-8859-1?Q?eGsd6DCXI/kHveziwdv9PVSRC6iwPFH6aIzuBXJ3VNU365oLnQHRc69+Zy?=

=?iso-8859-1?Q?/cvCMbDKiqfO/NHZMRr1R1U88fZlEDY514gCxiww5f+MRQUrxiSMh04VKI?=

=?iso-8859-1?Q?VEB+Tcq5S5bdc6ZUh/9vUwk86tFXzwYX18OudHpwRobjrD2NZX7X5OGTsP?=

=?iso-8859-1?Q?9vkhuWVT011nkVjj3a5QVvRd/kuSpBq0IFcwaVwtWyYvE6DOAcuCyQTZms?=

=?iso-8859-1?Q?wXacwGM7Fqb4Drimv2maA8MJqZDDjyBB3fEzEUAIb+w4Zj2Rv1x//5JXPK?=

=?iso-8859-1?Q?0=3D?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?iso-8859-1?Q?PxFrNeDtHTel/gjSjeOwd3WcTmCZKebxquqJZ7FMj253YVu5QAXntN3qNN?=

=?iso-8859-1?Q?2GFk0X6aKtYPOc9xmacmLvsvnCFOg3g5a1P9E5xKbEm51CpB+ZpGC8nLQp?=

=?iso-8859-1?Q?iZFfF8k8W7d0WnPd28zZwKkXuj6gHeCQKAG4u0onJaRTVscxNjiH3wytXJ?=

=?iso-8859-1?Q?Tqo13uuCHHcGwOZEwy6IOiBwcNknycdTT/nEnYIODm/krozoS8SYdRUZH1?=

=?iso-8859-1?Q?RFBpq53KRFzC5cfd45dz/83V2b5YFSh3qjhrw9OnyYcYaifsd59Wm/JSJ3?=

=?iso-8859-1?Q?dHSETBIMYDWweDeX4q/v9X0ASf8Z8mCT/Ndsp3IC9xYgsRruppqrVh27ev?=

=?iso-8859-1?Q?+jon2tTS1FLYaac3mtu80IibY/xEmv7RQbUDUdbPnbnhlhGU1pWMNY8wi0?=

=?iso-8859-1?Q?UYXpfK/qwMKfC5A5qPwQm3+44da+hQO/fEi4jkH/E0vkUC4SWhWj6e2aD3?=

=?iso-8859-1?Q?HKt7KUNZjQhj4be54X3ZQVpl8hmQz0tmsN96DBgUlbDYDsIwo7P8IrLgFY?=

=?iso-8859-1?Q?5c/K5Nij2dSMb3fBZpgE2QdWzXh2JjEQhgLNoTJk4Uo+QDEf7etGjLjmAh?=

=?iso-8859-1?Q?8LZFanRLIp1k/hxT8CdmvlPd7+KWz/fZnhKzz5nyqSlFEvVBZ0pnrltIVB?=

=?iso-8859-1?Q?vWgJZOy+sXYcwCDHaVwGhLYrOyVuM1zBvvpjKluFC3TzmmYBsCRANvuK9d?=

=?iso-8859-1?Q?jT5lTJxkmoTZ7Mw1xVBhVf2gHr059n/YzLnIQJYXpILdcBQrcoCjZBUkeS?=

=?iso-8859-1?Q?pr1oB7DDzTVaTxJEekg5CufjWetQz4iMZypgFtnUO3upMbxohOzQ5jMJs3?=

=?iso-8859-1?Q?Cb9D2s9oo31EuYko4z3S2V0XcogSBe2x62VLSqrpUEh+Lk9RZPQtlViQie?=

=?iso-8859-1?Q?wZ0ikk1w3wznmE0oU5Lkl91IzTrdfTO2ofXm+bPLzke3O3stg9xIggJv7i?=

=?iso-8859-1?Q?gm+AMI6HIMdjpOHom/domYqCWDcOrDGyvogP6exSGoF5IermfAsqvPxPAK?=

=?iso-8859-1?Q?oZoNdcMDjbBa9x4nRPt/I1V7Al5EwMkUxy/Ss93SCofZcxnb27EtqqxTyL?=

=?iso-8859-1?Q?1oblhyfZnku8PHr/pfmMaQzPnrOsxSC4fO7MJpMcN5ZgkpcvhQtxhZEpm7?=

=?iso-8859-1?Q?CUeKRgK3WPw8cPUKcyaZUy5OcoN/A8v3yp3KrBdn0fmcQWBJO7FOhxxUOt?=

=?iso-8859-1?Q?Q0j/pdFo3v1EZ/+TeAFtUUBZ8MCP1n5YAw4h0FGkytmstDyIvH1FHdQWm9?=

=?iso-8859-1?Q?q1n2mRt5j9CPxf7OSvhlQopl1N9NmjjtHPYcEYlQP61iUdtwHTwMpC7Qtj?=

=?iso-8859-1?Q?iCWWXnztgTCBWP47iea/cYcHsWDIlXxkaEA02x25qCOEhcxAOprv3sBOzR?=

=?iso-8859-1?Q?67ZUYaBM+63RwA0VPDr3MIvaYexZf3eXsPY29lsXBzN38ZV00xCIY=3D?=

Content-Type: multipart/alternative;

boundary="_000_DB9PR10MB7625E43FBCEF4A786A6186DB9DED2DB9PR10MB7625EURP_"

MIME-Version: 1.0

X-OriginatorOrg: outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: DB9PR10MB7625.EURPRD10.PROD.OUTLOOK.COM

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: 10af752e-11ef-4b4e-6d68-08ded2430dbc

X-MS-Exchange-CrossTenant-originalarrivaltime: 24 Jun 2026 22:50:56.7918

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: GVUPR10MB9896

X-Spam_score: 11.8

X-Spam_score_int: 118

X-Spam_bar: +++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

vobile compliance phish

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 24 Jun 2026 15:53:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wcVW1-00000000FRa-2ldD

for dave@doctor.nl2k.ab.ca;

Wed, 24 Jun 2026 15:52:13 -0600

Resent-From: The Doctor

Resent-Date: Wed, 24 Jun 2026 15:52:13 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from notify.vobie.mobi ([34.168.17.114]:33266)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wcVIn-00000000BSo-1Rwx

for root@doctor.nl2k.ab.ca;

Wed, 24 Jun 2026 15:38:41 -0600

Received: from ec2-52-40-185-211.us-west-2.compute.amazonaws.com ([52.40.185.211] helo=[127.0.0.1])

by notify.vobie.mobi with esmtpa (Exim 4.92)

(envelope-from )

id 1wcVI1-000744-BF

for root@doctor.nl2k.ab.ca; Thu, 25 Jun 2026 05:37:45 +0800

Content-Type: multipart/mixed; boundary="===============2944097959991222325=="

MIME-Version: 1.0

From: Vobile Compliance

To: root@doctor.nl2k.ab.ca

Subject: Notice of Claimed Infringement - Case ID 1cdb5686d146519e0166

Reply-To: p2p@copyright-notice.com

X-Originator: p2p@copyright-notice.com

Message-Id: 558dd678-c26e-455d-a737-7a1c2a391a01@copyright-notice.com>

X-Mail-From: p2p@copyright-notice.com

X-Message-ID: 558dd678-c26e-455d-a737-7a1c2a391a01@copyright-notice.com>

X-Notice-ID: 1cdb5686d146519e0166

Auto-Submitted: auto-generated

Date: Thu, 25 Jun 2026 05:37:45 +0800

X-Spam_score: 6.0

X-Spam_score_int: 60

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Notice ID: 1cdb5686d146519e0166

Notice Date: 2026-06-24T21:37:45Z WorldGate



Content analysis details: (6.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[52.40.185.211 listed in will-spam-for-food.eu.org]

[52.40.185.211 listed in will-spam-for-food.eu.org]

[52.40.185.211 listed in will-spam-for-food.eu.org]

[52.40.185.211 listed in will-spam-for-food.eu.org]

[52.40.185.211 listed in will-spam-for-food.eu.org]

[52.40.185.211 listed in will-spam-for-food.eu.org]

[52.40.185.211 listed in will-spam-for-food.eu.org]

[52.40.185.211 listed in will-spam-for-food.eu.org]

[34.168.17.114 listed in will-spam-for-food.eu.org]

[34.168.17.114 listed in will-spam-for-food.eu.org]

[34.168.17.114 listed in will-spam-for-food.eu.org]

[34.168.17.114 listed in will-spam-for-food.eu.org]

[34.168.17.114 listed in will-spam-for-food.eu.org]

[34.168.17.114 listed in will-spam-for-food.eu.org]

[34.168.17.114 listed in will-spam-for-food.eu.org]

[34.168.17.114 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[52.40.185.211 listed in dnsbl.ahbl.org]

[52.40.185.211 listed in dnsbl.ahbl.org]

[52.40.185.211 listed in dnsbl.ahbl.org]

[52.40.185.211 listed in dnsbl.ahbl.org]

[34.168.17.114 listed in dnsbl.ahbl.org]

[34.168.17.114 listed in dnsbl.ahbl.org]

[34.168.17.114 listed in dnsbl.ahbl.org]

[34.168.17.114 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[52.40.185.211 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[52.40.185.211 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[52.40.185.211 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[52.40.185.211 listed in dnsbl.ahbl.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

1.7 DEAR_SOMETHING BODY: Contains 'Dear (something)'

0.3 LONGWORD BODY: Uses overlong words

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[34.168.17.114 listed in bl.score.senderscore.com]

1.2 INVALID_MSGID Message-Id is not valid, according to RFC 2822

1.5 IMPRONONCABLE_2 Too much mixed numbers and lower-case letters

Subject: {SPAM?} Notice of Claimed Infringement - Case ID 1cdb5686d146519e0166



-----BEGIN PGP SIGNED MESSAGE-----

Hash: SHA1



Notice ID: 1cdb5686d146519e0166

Notice Date: 2026-06-24T21:37:45Z



WorldGate



Dear Sir or Madam:



I certify under penalty of perjury that I am authorized to act on behalf of the Paramount Global companies CBS Broadcasting Inc., CBS Studios Inc., Paramount Pictures Corporation, Showtime Networks Inc., Viacom International, Inc., Black Entertainment Television LLC, and other Paramount Global subsidiaries and affiliates (collectively, the “Rights Owners”), the owners of certain exclusive intellectual property rights in the copyrighted work(s) identified in this notice. I have a good faith belief that the information in this notice is accurate.



We have become aware that the below IP addresses have been using your service for distributing video files, which contain infringing video content that is exclusively owned by the Rights Owners.



We have a good faith belief that the Rights Owners’ video content that is described in the below report has not been authorized for sharing or distribution by the copyright owner, its agent, or the law. Such copying and use of this material constitutes clear infringement of the Rights Owners' rights under the Copyright Act and its counterpart laws around the world.



We are requesting your immediate assistance in removing and disabling access to the infringing material from your network. We also ask that you ensure the user and/or IP address owner refrains from future use and sharing of the Rights Owners’ materials and property.



In complying with this notice, you should not destroy any evidence that may be relevant in a lawsuit relating to the infringement alleged; including all associated electronic documents and data relating to the presence of the infringing items on your site, which shall be preserved while disabling public access, irrespective of any document retention or corporate policy to the contrary.



Nothing in this letter shall be construed as a waiver or relinquishment of any right, remedy, or claims possessed by the Rights Owners, or any affiliated party, all of which are expressly reserved.



Should you have any questions, please contact me at the information below.



Ben Sodos

Vobile, Inc.

Address: 2880 Lakeside Drive, Suite 200

Santa Clara, CA 95054, United States

Email: p2p@copyright-notice.com

408.217.5026











1cdb5686d146519e0166

Open

Normal





Paramount Global

Vobile - Compliance

2880 Lakeside Drive, Suite 200

Santa Clara, CA 95054


+1 (408) 492 1100

p2p@copyright-notice.com





WorldGate

root@doctor.nl2k.ab.ca





2026-06-24T21:37:43Z

204.209.81.1

51699

BitTorrent



1







2026-06-24T21:37:43Z

The Neighborhood

www.UIndex.org - The Neighborhood S08E06 Welcome to the Walk of Roses 1080p AMZN WEB-DL DDP5 1 H 264-Kitsune

1628542168

2ceaed387d6f421450c6bd3df0dbc7276cb2f850







-----BEGIN PGP SIGNATURE-----

Version: GnuPG v2.0.22 (GNU/Linux)



iQEcBAEBAgAGBQJqPE4pAAoJEN5LM3Etqs/WXksH/0oe9ZQzXSzQ2UmrRcgFFNBH

IaFikTQA/GNye5KU8XRNW/E5GdIHgzLarhUuMMNISPa+aZ9V1Xbsby+RMg48UI6V

uUlNBabyhDj64PCcImqoIWmjnhudFRvC4wMgsmsLkoDrx/RAmofOMFTpP0Y59rEW

amQWcwqKB05beSJkQ/0hcquLFxeTkXcpHy25uE3u71AJeVn8RbvXnOGUYdaRk1zt

WQ+mQADgPkAraE39j+rfALvzpfulIuAzTcTwNrZOIhPRvBbnIXVF6xqOwh4GX1fu

+IYm669hDWueYf2ef0c0sBno4VscmI1TwfpXHxbCoEfv7KiFS+NBdO1FwVCJS5o=

=VdJc

-----END PGP SIGNATURE-----



Vobile Compliance phish

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 24 Jun 2026 15:51:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wcVU6-00000000FEx-436p

for dave@doctor.nl2k.ab.ca;

Wed, 24 Jun 2026 15:50:14 -0600

Resent-From: The Doctor

Resent-Date: Wed, 24 Jun 2026 15:50:14 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from notify.vobie.mobi ([34.168.17.114]:62718)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wcTt0-000000006Qx-0Hlw

for root@doctor.nl2k.ab.ca;

Wed, 24 Jun 2026 14:07:57 -0600

Received: from ec2-52-40-185-211.us-west-2.compute.amazonaws.com ([52.40.185.211] helo=[127.0.0.1])

by notify.vobie.mobi with esmtpa (Exim 4.92)

(envelope-from )

id 1wcTsE-0006N6-2N

for root@doctor.nl2k.ab.ca; Thu, 25 Jun 2026 04:07:02 +0800

Content-Type: multipart/mixed; boundary="===============3954241546102495088=="

MIME-Version: 1.0

From: Vobile Compliance

To: root@doctor.nl2k.ab.ca

Subject: Notice of Claimed Infringement - Case ID 0e48ea0b5a90ac605dd8

Reply-To: p2p@copyright-notice.com

X-Originator: p2p@copyright-notice.com

Message-Id: 7d5d2627-8b4f-4ac2-89de-c3280ef11411@copyright-notice.com>

X-Mail-From: p2p@copyright-notice.com

X-Message-ID: 7d5d2627-8b4f-4ac2-89de-c3280ef11411@copyright-notice.com>

X-Notice-ID: 0e48ea0b5a90ac605dd8

Auto-Submitted: auto-generated

Date: Thu, 25 Jun 2026 04:07:02 +0800

X-Spam_score: 6.0

X-Spam_score_int: 60

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Notice ID: 0e48ea0b5a90ac605dd8

Notice Date: 2026-06-24T20:07:02Z WorldGate



Content analysis details: (6.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[52.40.185.211 listed in will-spam-for-food.eu.org]

[52.40.185.211 listed in will-spam-for-food.eu.org]

[52.40.185.211 listed in will-spam-for-food.eu.org]

[52.40.185.211 listed in will-spam-for-food.eu.org]

[52.40.185.211 listed in will-spam-for-food.eu.org]

[52.40.185.211 listed in will-spam-for-food.eu.org]

[52.40.185.211 listed in will-spam-for-food.eu.org]

[52.40.185.211 listed in will-spam-for-food.eu.org]

[34.168.17.114 listed in will-spam-for-food.eu.org]

[34.168.17.114 listed in will-spam-for-food.eu.org]

[34.168.17.114 listed in will-spam-for-food.eu.org]

[34.168.17.114 listed in will-spam-for-food.eu.org]

[34.168.17.114 listed in will-spam-for-food.eu.org]

[34.168.17.114 listed in will-spam-for-food.eu.org]

[34.168.17.114 listed in will-spam-for-food.eu.org]

[34.168.17.114 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[52.40.185.211 listed in dnsbl.ahbl.org]

[52.40.185.211 listed in dnsbl.ahbl.org]

[52.40.185.211 listed in dnsbl.ahbl.org]

[52.40.185.211 listed in dnsbl.ahbl.org]

[34.168.17.114 listed in dnsbl.ahbl.org]

[34.168.17.114 listed in dnsbl.ahbl.org]

[34.168.17.114 listed in dnsbl.ahbl.org]

[34.168.17.114 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[52.40.185.211 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[52.40.185.211 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[52.40.185.211 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[52.40.185.211 listed in dnsbl.ahbl.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

1.7 DEAR_SOMETHING BODY: Contains 'Dear (something)'

0.3 LONGWORD BODY: Uses overlong words

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[34.168.17.114 listed in bl.score.senderscore.com]

1.2 INVALID_MSGID Message-Id is not valid, according to RFC 2822

1.5 IMPRONONCABLE_2 Too much mixed numbers and lower-case letters

Subject: {SPAM?} Notice of Claimed Infringement - Case ID 0e48ea0b5a90ac605dd8







-----BEGIN PGP SIGNED MESSAGE-----

Hash: SHA1



Notice ID: 0e48ea0b5a90ac605dd8

Notice Date: 2026-06-24T20:07:02Z



WorldGate



Dear Sir or Madam:



I certify under penalty of perjury that I am authorized to act on behalf of the Paramount Global companies CBS Broadcasting Inc., CBS Studios Inc., Paramount Pictures Corporation, Showtime Networks Inc., Viacom International, Inc., Black Entertainment Television LLC, and other Paramount Global subsidiaries and affiliates (collectively, the “Rights Owners”), the owners of certain exclusive intellectual property rights in the copyrighted work(s) identified in this notice. I have a good faith belief that the information in this notice is accurate.



We have become aware that the below IP addresses have been using your service for distributing video files, which contain infringing video content that is exclusively owned by the Rights Owners.



We have a good faith belief that the Rights Owners’ video content that is described in the below report has not been authorized for sharing or distribution by the copyright owner, its agent, or the law. Such copying and use of this material constitutes clear infringement of the Rights Owners' rights under the Copyright Act and its counterpart laws around the world.



We are requesting your immediate assistance in removing and disabling access to the infringing material from your network. We also ask that you ensure the user and/or IP address owner refrains from future use and sharing of the Rights Owners’ materials and property.



In complying with this notice, you should not destroy any evidence that may be relevant in a lawsuit relating to the infringement alleged; including all associated electronic documents and data relating to the presence of the infringing items on your site, which shall be preserved while disabling public access, irrespective of any document retention or corporate policy to the contrary.



Nothing in this letter shall be construed as a waiver or relinquishment of any right, remedy, or claims possessed by the Rights Owners, or any affiliated party, all of which are expressly reserved.



Should you have any questions, please contact me at the information below.



Ben Sodos

Vobile, Inc.

Address: 2880 Lakeside Drive, Suite 200

Santa Clara, CA 95054, United States

Email: p2p@copyright-notice.com

408.217.5026











0e48ea0b5a90ac605dd8

Open

Normal





Paramount Global

Vobile - Compliance

2880 Lakeside Drive, Suite 200

Santa Clara, CA 95054


+1 (408) 492 1100

p2p@copyright-notice.com





WorldGate

root@doctor.nl2k.ab.ca





2026-06-24T20:07:01Z

204.209.81.1

58090

BitTorrent



1







2026-06-24T20:07:01Z

The Neighborhood

The.Neighborhood.S08E03.1080p.HEVC.x265-MeGusta[EZTVx.to].mkv

295562105

f5a0e938ad358ef4f86ba969bb646a6d2d71c14e







-----BEGIN PGP SIGNATURE-----

Version: GnuPG v2.0.22 (GNU/Linux)



iQEcBAEBAgAGBQJqPDjmAAoJEN5LM3Etqs/Wt8cIAI+GpcZYOJqGkh68Hi+QmG4v

ef0bLVQP9tcIOXnK+qx7KN0oq0sd+2EJjyCX2Q6kwWZQz3O4SOK568V1jkbOvtg4

7BTjdrz2Gv2qSawDItGdAsflA/SLnqxrJt/ie8Iw0dQuJbByePqRVqcyA190ZUs6

Ns9iBb6eWPU/obdAhiJHa3XZwmrd5b5MFZ41h3aTIk67mUm0yxipNIRqKunVekzw

zY74KuRP9aU9Dv0kR/+IHZx0NGryCcsD9Hpk1twi6luu8FL56nYEb9M4378Xk8jj

SVt39Sr2RXah+tigHIzcoEYUREtq0nA4HleCoLABGx3Iv/Xl0CfPAApfyUa+hHY=

=v2CA

-----END PGP SIGNATURE-----





Vobile Compliance phish

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 24 Jun 2026 15:49:52 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wcVTj-00000000FCY-1Or1

for dave@doctor.nl2k.ab.ca;

Wed, 24 Jun 2026 15:49:51 -0600

Resent-From: The Doctor

Resent-Date: Wed, 24 Jun 2026 15:49:51 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from notify.vobie.mobi ([34.168.17.114]:36918)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wcT9v-0000000029i-1dl1

for root@doctor.nl2k.ab.ca;

Wed, 24 Jun 2026 13:21:23 -0600

Received: from ec2-52-40-185-211.us-west-2.compute.amazonaws.com ([52.40.185.211] helo=[127.0.0.1])

by notify.vobie.mobi with esmtpa (Exim 4.92)

(envelope-from )

id 1wcT94-0002HM-8P

for root@doctor.nl2k.ab.ca; Thu, 25 Jun 2026 03:20:22 +0800

Content-Type: multipart/mixed; boundary="===============4778763038542898899=="

MIME-Version: 1.0

From: Vobile Compliance

To: root@doctor.nl2k.ab.ca

Subject: Notice of Claimed Infringement - Case ID e05e7b81b4ea99913ff3

Reply-To: p2p@copyright-notice.com

X-Originator: p2p@copyright-notice.com

Message-Id: da35d1f4-23aa-49fb-ad79-d1be197234e5@copyright-notice.com>

X-Mail-From: p2p@copyright-notice.com

X-Message-ID: da35d1f4-23aa-49fb-ad79-d1be197234e5@copyright-notice.com>

X-Notice-ID: e05e7b81b4ea99913ff3

Auto-Submitted: auto-generated

Date: Thu, 25 Jun 2026 03:20:22 +0800

X-Spam_score: 6.0

X-Spam_score_int: 60

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Notice ID: e05e7b81b4ea99913ff3

Notice Date: 2026-06-24T19:20:22Z WorldGate



Content analysis details: (6.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[52.40.185.211 listed in will-spam-for-food.eu.org]

[52.40.185.211 listed in will-spam-for-food.eu.org]

[52.40.185.211 listed in will-spam-for-food.eu.org]

[52.40.185.211 listed in will-spam-for-food.eu.org]

[52.40.185.211 listed in will-spam-for-food.eu.org]

[52.40.185.211 listed in will-spam-for-food.eu.org]

[52.40.185.211 listed in will-spam-for-food.eu.org]

[52.40.185.211 listed in will-spam-for-food.eu.org]

[34.168.17.114 listed in will-spam-for-food.eu.org]

[34.168.17.114 listed in will-spam-for-food.eu.org]

[34.168.17.114 listed in will-spam-for-food.eu.org]

[34.168.17.114 listed in will-spam-for-food.eu.org]

[34.168.17.114 listed in will-spam-for-food.eu.org]

[34.168.17.114 listed in will-spam-for-food.eu.org]

[34.168.17.114 listed in will-spam-for-food.eu.org]

[34.168.17.114 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[34.168.17.114 listed in dnsbl.ahbl.org]

[34.168.17.114 listed in dnsbl.ahbl.org]

[34.168.17.114 listed in dnsbl.ahbl.org]

[34.168.17.114 listed in dnsbl.ahbl.org]

[52.40.185.211 listed in dnsbl.ahbl.org]

[52.40.185.211 listed in dnsbl.ahbl.org]

[52.40.185.211 listed in dnsbl.ahbl.org]

[52.40.185.211 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[34.168.17.114 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[34.168.17.114 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[34.168.17.114 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[34.168.17.114 listed in dnsbl.ahbl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[34.168.17.114 listed in bl.score.senderscore.com]

1.7 DEAR_SOMETHING BODY: Contains 'Dear (something)'

0.3 LONGWORD BODY: Uses overlong words

1.2 INVALID_MSGID Message-Id is not valid, according to RFC 2822

1.5 IMPRONONCABLE_2 Too much mixed numbers and lower-case letters

Subject: {SPAM?} Notice of Claimed Infringement - Case ID e05e7b81b4ea99913ff3



--===============4778763038542898899==





-----BEGIN PGP SIGNED MESSAGE-----

Hash: SHA1



Notice ID: e05e7b81b4ea99913ff3

Notice Date: 2026-06-24T19:20:22Z



WorldGate



Dear Sir or Madam:



I certify under penalty of perjury that I am authorized to act on behalf of the Paramount Global companies CBS Broadcasting Inc., CBS Studios Inc., Paramount Pictures Corporation, Showtime Networks Inc., Viacom International, Inc., Black Entertainment Television LLC, and other Paramount Global subsidiaries and affiliates (collectively, the “Rights Owners”), the owners of certain exclusive intellectual property rights in the copyrighted work(s) identified in this notice. I have a good faith belief that the information in this notice is accurate.



We have become aware that the below IP addresses have been using your service for distributing video files, which contain infringing video content that is exclusively owned by the Rights Owners.



We have a good faith belief that the Rights Owners’ video content that is described in the below report has not been authorized for sharing or distribution by the copyright owner, its agent, or the law. Such copying and use of this material constitutes clear infringement of the Rights Owners' rights under the Copyright Act and its counterpart laws around the world.



We are requesting your immediate assistance in removing and disabling access to the infringing material from your network. We also ask that you ensure the user and/or IP address owner refrains from future use and sharing of the Rights Owners’ materials and property.



In complying with this notice, you should not destroy any evidence that may be relevant in a lawsuit relating to the infringement alleged; including all associated electronic documents and data relating to the presence of the infringing items on your site, which shall be preserved while disabling public access, irrespective of any document retention or corporate policy to the contrary.



Nothing in this letter shall be construed as a waiver or relinquishment of any right, remedy, or claims possessed by the Rights Owners, or any affiliated party, all of which are expressly reserved.



Should you have any questions, please contact me at the information below.



Ben Sodos

Vobile, Inc.

Address: 2880 Lakeside Drive, Suite 200

Santa Clara, CA 95054, United States

Email: p2p@copyright-notice.com

408.217.5026









e05e7b81b4ea99913ff3

Open

Normal





Paramount Global

Vobile - Compliance

2880 Lakeside Drive, Suite 200

Santa Clara, CA 95054


+1 (408) 492 1100

p2p@copyright-notice.com





WorldGate

root@doctor.nl2k.ab.ca





2026-06-24T19:20:06Z

204.209.81.1

59892

BitTorrent



1







2026-06-24T19:20:06Z

The Neighborhood

The.Neighborhood.S08E07.1080p.WEB.h264-ETHEL[EZTVx.to].mkv

1645139007

8cdea20f84464af39876d532ca554d1c31547147







-----BEGIN PGP SIGNATURE-----

Version: GnuPG v2.0.22 (GNU/Linux)



iQEcBAEBAgAGBQJqPC32AAoJEN5LM3Etqs/WrB8H/RM3NpgF2fAzVmRVHQMx8NBX

DCFUJCvT4tZ3N54N5DJDfZJ7vPHcJotmIwmMi1lY0Km0FS4kceee5xl8qxu2llza

qf3yoySGoKXlCyV5ke1mY8Q0Pe5/m5lejj2sE1GY7GMJLMzNTpjL173FCQ8ydPn2

ykKJ4+6txyo1Xgn2y6iXwt4gnFKW7lpLzyUYtryuQga7tEe8ugzbYSr4h58ssJqu

wSB7GWXR+HIEPzZVTUrdmnTDulRRnk55VEz9tn8AltE4aqVVuIfF8RC+laY82/13

+sbs0IEzwyHZVxC5D3SoTn6jvM6v/FaTMPgHG9JchuKyBwy8aZOK9jzSwib4Jzo=

=dvyW

-----END PGP SIGNATURE-----



Bitcoin Paypal Phish from Microsoft OutLook Part 4

Haresasz Nxysarwsa has invited you to Important Transaction Alert – BTC Order Submitted

Title: Important Transaction Alert – BTC Order Submitted

When: June 24, 2026

Organizer:

Haresasz Nxysarwsa

Description: Dear Customer,



This email confirms that your PayPal payment for Bitcoin has been received and your order is now under review.



Transaction Overview:



Payment Method: PayPal

Asset Purchased: Bitcoin (BTC)

Amount Paid: $500.00

Current Status: Under Review



Our security team is currently validating the transaction. Once approved, your order will be completed automatically.



If you did not authorize this activity, please call +1 813 934 5511 immediately to prevent further processing.



Thank you for your prompt attention.



Sincerely,

Customer Support Team

Attendees:



cynthiaperez389903@groups.outlook.com





Dear Customer,



This email confirms that your PayPal payment for Bitcoin has been received and your order is now under review.



Transaction Overview:



Payment Method: PayPal

Asset Purchased: Bitcoin (BTC)

Amount Paid: $500.00

Current Status: Under Review



Our security team is currently validating the transaction. Once approved, your order will be completed automatically.



If you did not authorize this activity, please call +1 813 934 5511 immediately to prevent further processing.



Thank you for your prompt attention.



Sincerely,

Customer Support Team

Kedy

streda 24. jún 2026

Organizátor

Haresasz Nxysarwsa

haressaznzxrrsxaxz321@gmail.com

Hostia

(Zoznam hostí bol na žiadosť organizátora skrytý)

Odpoveď na cynthiaperez389903@groups.outlook.com

Áno



Nie



Možno

Ďalšie možnosti



Pozvánka z Kalendára Google



Túto správu ste dostali, pretože ste účastníkom danej udalosti.



Ak túto pozvánku prepošlete, ktorýkoľvek jej príjemca bude môcť odoslať odpoveď organizátorovi, byť pridaný do zoznamu hostí, pozývať iných bez ohľadu na ich vlastný stav pozvánky alebo meniť vaše potvrdenie účasti. Ďalšie informácie

Nigerian spam

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 24 Jun 2026 15:49:52 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wcVTX-00000000FBF-1Fkn

for dave@doctor.nl2k.ab.ca;

Wed, 24 Jun 2026 15:49:39 -0600

Resent-From: The Doctor

Resent-Date: Wed, 24 Jun 2026 15:49:39 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail.serangkota.go.id ([103.102.250.249]:44632)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wcTog-000000006Bo-0IdB

for doctor@nk.ca;

Wed, 24 Jun 2026 14:03:30 -0600

Received: from localhost (localhost [127.0.0.1])

by mail.serangkota.go.id (Postfix) with ESMTP id A099A71A051;

Thu, 25 Jun 2026 02:14:56 +0700 (WIB)

Received: from mail.serangkota.go.id ([127.0.0.1])

by localhost (mail.serangkota.go.id [127.0.0.1]) (amavisd-new, port 10032)

with ESMTP id N_cX3B1n2iIv; Thu, 25 Jun 2026 02:14:56 +0700 (WIB)

Received: from localhost (localhost [127.0.0.1])

by mail.serangkota.go.id (Postfix) with ESMTP id 4201770F04C;

Thu, 25 Jun 2026 02:13:00 +0700 (WIB)

DKIM-Filter: OpenDKIM Filter v2.10.3 mail.serangkota.go.id 4201770F04C

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=serangkota.go.id;

s=223131DC-BAC7-11ED-98AC-0EA98736A510; t=1782328381;

bh=HrhEKg1uLexM/E8VXk/DV9SjoUFNgas09P6QmtbQIDw=;

h=MIME-Version:To:From:Date:Message-Id;

b=TgeK/2q7icx6hWHduiBtuAzKGNyaggZmB1W0AYnulTvnwzMQU4OU5Idx6BNWDlk5k

Qcqb0IJS06n0wZB27Q9m5fpZMCBTj8K4I1rII03GPr1lMTqapKFgr64CgPfc9X6Yy2

Y4Y/5GDCbZkTC8/TmRQqxBHDCHQseWq40oWJe7AUNLxM+mwSOJFUyk13FkM6wHf421

+CwP/OFyYorJk9IcxjjVmPN3KFG8y8b5VSSphtNJMmrM/4+DcyM+KF7nKqCDa8z9lU

tsuQliAXRO43ggfvnwayDo8J+Wi78VFx44QJs9akwk+Ot1yRkZEJJwRKgHMZxwAmzj

LycQ56yQMy3KA==

X-Virus-Scanned: amavisd-new at serangkota.go.id

Received: from mail.serangkota.go.id ([127.0.0.1])

by localhost (mail.serangkota.go.id [127.0.0.1]) (amavisd-new, port 10026)

with ESMTP id pR0QH1n9P47E; Thu, 25 Jun 2026 02:12:59 +0700 (WIB)

Received: from EC2AMAZ-EP6II2T.us-west-2.compute.internal (ec2-35-161-247-59.us-west-2.compute.amazonaws.com [35.161.247.59])

by mail.serangkota.go.id (Postfix) with ESMTPSA id 2C37A6F21BB;

Thu, 25 Jun 2026 02:09:13 +0700 (WIB)

Content-Type: multipart/alternative; boundary="===============1031955268=="

MIME-Version: 1.0

Subject: Ref: FNBTX/IRD

To: Me

From: "Jeremy Booker"

Date: Wed, 24 Jun 2026 19:07:22 +0000

Reply-To: mrjerryfirst67@gmail.com

Message-Id: <20260624190915.2C37A6F21BB@mail.serangkota.go.id>

X-Spam_score: 7.5

X-Spam_score_int: 75

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Ref: FNBTX/IRD/GBX/20/026 Your unclaimed award/palliative

payment has been approved for immediate release. Kindly confirm you are still

alive? Yours Sincerely, Jeremy Booker. Ref: FNBTX/IRD/GBX/20/026 [...]



Content analysis details: (7.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[35.161.247.59 listed in will-spam-for-food.eu.org]

[35.161.247.59 listed in will-spam-for-food.eu.org]

[35.161.247.59 listed in will-spam-for-food.eu.org]

[35.161.247.59 listed in will-spam-for-food.eu.org]

[35.161.247.59 listed in will-spam-for-food.eu.org]

[35.161.247.59 listed in will-spam-for-food.eu.org]

[35.161.247.59 listed in will-spam-for-food.eu.org]

[35.161.247.59 listed in will-spam-for-food.eu.org]

[103.102.250.249 listed in will-spam-for-food.eu.org]

[103.102.250.249 listed in will-spam-for-food.eu.org]

[103.102.250.249 listed in will-spam-for-food.eu.org]

[103.102.250.249 listed in will-spam-for-food.eu.org]

[103.102.250.249 listed in will-spam-for-food.eu.org]

[103.102.250.249 listed in will-spam-for-food.eu.org]

[103.102.250.249 listed in will-spam-for-food.eu.org]

[103.102.250.249 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[35.161.247.59 listed in dnsbl.ahbl.org]

[35.161.247.59 listed in dnsbl.ahbl.org]

[35.161.247.59 listed in dnsbl.ahbl.org]

[35.161.247.59 listed in dnsbl.ahbl.org]

[103.102.250.249 listed in dnsbl.ahbl.org]

[103.102.250.249 listed in dnsbl.ahbl.org]

[103.102.250.249 listed in dnsbl.ahbl.org]

[103.102.250.249 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[35.161.247.59 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[35.161.247.59 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[35.161.247.59 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[35.161.247.59 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.

[103.102.250.249 listed in bb.barracudacentral.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[mrjerryfirst67(at)gmail.com]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[103.102.250.249 listed in bl.score.senderscore.com]

1.6 RCVD_IN_MSPIKE_L3 RBL: Low reputation (-3)

[103.102.250.249 listed in bl.mailspike.net]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 RCVD_IN_MSPIKE_BL Mailspike blacklisted

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

Subject: {SPAM?} Ref: FNBTX/IRD



You will not see this in a MIME-aware mail reader.

--===============1031955268==

Content-Type: text/plain; charset="iso-8859-1"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Content-Description: Mail message body



Ref: FNBTX/IRD/GBX/20/026

Your unclaimed award/palliative payment has been approved for immediate rel=

ease.

Kindly confirm you are still alive?

Yours Sincerely,

Jeremy Booker.=20

--===============1031955268==

Content-Type: text/html; charset="iso-8859-1"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Content-Description: Mail message body




=3Diso-8859-1"/>Ref: FNBTX/IRD/GBX/20/026
Your unclaimed aw=

ard/palliative payment has been approved for immediate release.
Kindly c=

onfirm you are still alive?
Yours Sincerely,
Jeremy Booker.
HTML>

--===============1031955268==--

Bitcoin Paypal Phish from Microsoft OutLook Part 3

Content preview: Important Transaction Alert – BTC Order Submitted streda

24. jún 2026 Dear Customer, This email confirms that your PayPal payment

for Bitcoin has been received and your order is now under review.



Content analysis details: (16.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.128.69 listed in will-spam-for-food.eu.org]

[209.85.128.69 listed in will-spam-for-food.eu.org]

[209.85.128.69 listed in will-spam-for-food.eu.org]

[209.85.128.69 listed in will-spam-for-food.eu.org]

[209.85.128.69 listed in will-spam-for-food.eu.org]

[209.85.128.69 listed in will-spam-for-food.eu.org]

[209.85.128.69 listed in will-spam-for-food.eu.org]

[209.85.128.69 listed in will-spam-for-food.eu.org]

[2603:10b6:5:3ad:cafe:0:0:12 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:5:3ad:cafe:0:0:12 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:5:3ad:cafe:0:0:12 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:5:3ad:cafe:0:0:12 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:5:3ad:cafe:0:0:12 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:5:3ad:cafe:0:0:12 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:5:3ad:cafe:0:0:12 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:5:3ad:cafe:0:0:12 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:5:3ad:0:0:0:11 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:5:3ad:0:0:0:11 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:5:3ad:0:0:0:11 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:5:3ad:0:0:0:11 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:5:3ad:0:0:0:11 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:5:3ad:0:0:0:11 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:5:3ad:0:0:0:11 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:5:3ad:0:0:0:11 listed in]

[will-spam-for-food.eu.org]

[40.93.10.76 listed in will-spam-for-food.eu.org]

[40.93.10.76 listed in will-spam-for-food.eu.org]

[40.93.10.76 listed in will-spam-for-food.eu.org]

[40.93.10.76 listed in will-spam-for-food.eu.org]

[40.93.10.76 listed in will-spam-for-food.eu.org]

[40.93.10.76 listed in will-spam-for-food.eu.org]

[40.93.10.76 listed in will-spam-for-food.eu.org]

[40.93.10.76 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.128.69 listed in dnsbl.ahbl.org]

[209.85.128.69 listed in dnsbl.ahbl.org]

[209.85.128.69 listed in dnsbl.ahbl.org]

[209.85.128.69 listed in dnsbl.ahbl.org]

[40.93.10.76 listed in dnsbl.ahbl.org]

[40.93.10.76 listed in dnsbl.ahbl.org]

[40.93.10.76 listed in dnsbl.ahbl.org]

[40.93.10.76 listed in dnsbl.ahbl.org]

[2603:10b6:5:3ad:cafe:0:0:12 listed in]

[dnsbl.ahbl.org]

[2603:10b6:5:3ad:cafe:0:0:12 listed in]

[dnsbl.ahbl.org]

[2603:10b6:5:3ad:cafe:0:0:12 listed in]

[dnsbl.ahbl.org]

[2603:10b6:5:3ad:cafe:0:0:12 listed in]

[dnsbl.ahbl.org]

[2603:10b6:5:3ad:0:0:0:11 listed in]

[dnsbl.ahbl.org]

[2603:10b6:5:3ad:0:0:0:11 listed in]

[dnsbl.ahbl.org]

[2603:10b6:5:3ad:0:0:0:11 listed in]

[dnsbl.ahbl.org]

[2603:10b6:5:3ad:0:0:0:11 listed in]

[dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.128.69 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.128.69 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.128.69 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.128.69 listed in dnsbl.ahbl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[40.93.10.76 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

1.0 HK_RANDOM_FROM From username looks random

3.5 VOWEL_FROM_7 Impronouncable from header (7+ consecutive vowels)

0.5 FROM_LOCAL_NOVOWEL From: localpart has series of non-vowel letters

1.0 HK_RANDOM_REPLYTO Reply-To username looks random

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[40.93.10.76 listed in wl.mailspike.net]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[haressaznzxrrsxaxz321(at)gmail.com]

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[haressaznzxrrsxaxz321(at)gmail.com]

2.6 HK_SCAM_N13 BODY: No description available.

0.1 TW_RW BODY: Odd Letter Triples with RW

0.3 LONGWORD BODY: Uses overlong words

0.6 MEGALONGWORD BODY: Uses really overlong words

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.2 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and EnvelopeFrom

freemail headers are different

0.1 TO_IN_SUBJ To address is in Subject

3.0 LONG_INVISIBLE_TEXT Long block of hidden text - bayes poison?

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[40.93.10.76 listed in bl.score.senderscore.com]

Subject: {SPAM?} =?UTF-8?Q?Pozv=C3=A1nky=3A_Important_Transaction_Alert_=2D_BTC_Order_S?=

=?UTF-8?Q?ubmitted_=40_st_24=2E_j=C3=BAn_2026_=28cynthiaperez389903=40groups=2Eoutlo?=

=?UTF-8?Q?ok=2Ecom=29?=

Bitcoin Paypal Phish from Microsoft OutLook Part 2

X-Microsoft-Antispam-Message-Info:

=?utf-8?B?ZWZ2TDNLMS9VY2xPYThrZHNUdmRGOExRYnY5dU54Qk5QcC9IdVVrTStYY0Zv?=

=?utf-8?B?QThhODZDTTA2WlQ0RmU2OVhrY1ROaWhjWGpQNW9sQjgvR0FyOGxPNTdOMjdX?=

=?utf-8?B?cE5TRWx2d2wyZ3p6MEY0eDYzUEZBREZlMlNnSGt0UFE4WmtGMFl2NWc0MDZB?=

=?utf-8?B?UE53VnBQcFBhZklqSDduZDFtQUQ1NjdVMFp5NGhYL3hIdHpkdmd1NDF6SHVa?=

=?utf-8?B?ZE9NdlkzMDk4RCttUWVpMnV6a3dXdjE0VE5oTjgvVER3RXh1d1lnaWQ2UnM1?=

=?utf-8?B?NXNuMVhjNG9HM3ZKOGFZRFBhZ0lwYXFvTFVXUHlub3F1TGZYMHVZUkMvWkZP?=

=?utf-8?B?blhSdVVHWExXUXJuVHRNRVViMUJqa1ZHako2VjRRWC9iY1lrN1FoVXptbzJ6?=

=?utf-8?B?cGIyZDFsWm1OakxJYVMzOGV1b1FnQTFXNVlpWWhRbzdZVkl3blJEbVRBYWkv?=

=?utf-8?B?VHQyTTFnVDVCcC9LdlRhYy82cE84dW9XZmxsaXlIZHZjS25XNUkxNzhKQzRa?=

=?utf-8?B?ZTRvL1JjbERaOFF2TDFyY2FETWtnbzhadFZncEpML2svZ1NVZ0QxMjN4UldH?=

=?utf-8?B?VWtjbDFQdjh2ZDVwK29lZUlmenVweWpVR1RZcWN5ZDRYUFpSWXFtZ0d0K250?=

=?utf-8?B?aUxnS2U5OFE1TXprYWh4aHVpUHVwc0pTLyszRkc5eE1nUHpyb3R6aXMzakh3?=

=?utf-8?B?bTM4QzF5WVgwMGRYUGRqeXdvdXNkOThMWmI2YmMyTERTTCsvU2hueXBOaHIx?=

=?utf-8?B?MjBzMmpTT1FnVUo0MlExNzF4OXQyWW92NEJ0N3RhYkxpMWFLUVFMYjVPaUtO?=

=?utf-8?B?T2R3VWlmNC9RWERVbmxoWVNQQ21FMnJXblpZQ0NGSlRGWVFiOVRtUG5qV0hj?=

=?utf-8?B?MkU0aUF6Z2NMcXFsY05EM2xEYTNQNnNpak1sZzVaM25OY0R5ZUE0QXdYbjRK?=

=?utf-8?B?VlY4K1A4TW9nTWtKaGdSd3Vndnp0ZzlhSzJGYzIrUmgzdHNVVkRZTFczNEtX?=

=?utf-8?B?U2hDODlXaytQZHZvUXBJRWdFV2JQYXRZRmZvYlZPaGNoSzJHcW5QK2lyQ3Za?=

=?utf-8?B?bFdsbUpGNXhUd25KMGdWSzlqQ3VRMThIM28vSDZlVXIrQXJSRUxkR0hHamVV?=

=?utf-8?B?MmYvU01sVlhXUm5GOWl4NkIzcFBIWEJlZHk4S2JIaVd6RjdRb1dVRjg2clp5?=

=?utf-8?B?TmRpeGhQQXlrWXIxMkYwd0RBVWtMNTdCMGc1Smc3TUdYZkdGQWpZL2cyZG5u?=

=?utf-8?B?dExXSVI1dUwyMnhHRUcweGJSc2dxU0I4eWozWWFPUTFYNXZTWlIwM2ZWMXpE?=

=?utf-8?B?M09XckVjaldxcUVyNm1HMDlndkNzV0tjbWVEQ0dtdFB1bjRJaXBVVkhDREFw?=

=?utf-8?B?d2VsRFl1bDYydVpzd0R0STZMUGlNeW44M3luWWJZS3BlRjg1MldhcUNMdC9Y?=

=?utf-8?B?N1lwT2U5aHFjREoxZXY1bUlWS2xOMEZFYzUzSVh1KzBEMks1dnVvTlhNeTQy?=

=?utf-8?B?ZkhsaXBQK2l2cXo0eXZOOXI0Uy9naU9EVENKVUhqaENjRnZML0JEbEY0RFNv?=

=?utf-8?B?S00zVzNmKytrQTloOWZoOHQydkg0QWI0Nk91VDkxNytXcjdERU5LVzBsLzFu?=

=?utf-8?B?M2hMZW9aUUpYbGNxTktuc1VHYlNtaHplYi9uVlVJQ29EWmQ0WTY1V0ozcERZ?=

=?utf-8?B?eHdVNHU2RDZIcE5mNGt1dkw2R29VSFhnZUlGMjl5NW5Rd3h1KzJJU1VTZGZY?=

=?utf-8?B?NUZQYlFlN1YvU0VLWWxXNGZzTHNwQUZiTUo1S0Fkdkw3NFNHYytjMTNOTHov?=

=?utf-8?B?WS9JbmNIWUp0Z2oyalVLd3RSMnV2UEZTMEJJcXlDZS9xLzlZT3dmUjdmYUU3?=

=?utf-8?B?Rzd2aDVSaUhYQ3hmNFVWT1VtVVE3SHhGRkxadkVLT3BUbzFkMXpEZzlWR292?=

=?utf-8?B?UEpkNHdTZjFVdTBvem8yVkZ6dlRuN2tFY1NIMlpCR1hRMmRvNTNGektCWU9s?=

=?utf-8?B?NUE2NkUwZGRzdzd4c3R1dVFYay8wTFBxLzNqQm90U3QrK3hYeitFbFZDY0tV?=

=?utf-8?B?eUpkQkNTMk85YnFyOG91VERaNTVZVCtJemN2Wm9DN1EzRDVtYzFnYWdHanUx?=

=?utf-8?B?cll0NDk0bWsyWEhES2xxZXhlZEI0YU4yNWNYaFZKN0tKZEVTbk0xaFRiZnFa?=

=?utf-8?B?M0hZRy9VT1BCQzZnNXlDMGN3N2lwMkxRM0p3NEo4NElxRjRVYjdUYTkxZXdK?=

=?utf-8?B?ZXFaSml6dWNxUjFaeXhRb2ZzazdTcktVWmNMZGRqRXVOb2VsTm9nQUFxNms3?=

=?utf-8?B?ZUk1N1Axd2hzNFFpMTRlVDhDOHFDbzJ3RTJDcUltbmNCajlDRnRQWGxCL09h?=

=?utf-8?B?eXlNcmtoWW4wSkJBUVp0U1dMeHptR2JTTlNVN21YRHFOWHhXcy9UNmlFWjJr?=

=?utf-8?B?bk5ZVlZzc2FHT09oR3JIY2RrbEx3elc1VDlkYzVjelFFdHhaL2RpVGUvV0M2?=

=?utf-8?B?STZBVEkyanNjN0xjK3VxcCtiK2M1WGliN0c2bjJmYlV0OVpxSzlIamFoUk4z?=

=?utf-8?B?Z1dPSmQ5a09ESm9oYjJrdDdrVW4rTWJodnN6ZlJzR0YyNnQyd1IydzRnWW1y?=

=?utf-8?B?WUFkak42SXZ2elJGdWpIcUtrSHJzTWtaWjhNcnhqL3BIUFloMERsVFcranZB?=

=?utf-8?B?eGtBSkMrMzYzcUN3VjFNcWVrcExVWGZXS2VIWE1CakFYc29CdmJLdllTQXIr?=

=?utf-8?B?T0RkcWk1VG8vN3RMcjRadnNKNFQ2UGpHSkZTZDlUcEJjcFJHMjBOQ2M1c01F?=

=?utf-8?B?TkNqVWdPSFBnOHIvVGxVbHNOcUlOKzgvMDE2Nndhais1ckFXN2p6a2JGVTRV?=

=?utf-8?B?dzJoSUxlQ3IrTFBoT0xCam5MQjIzUkZXbVZ1L2RRSU12dU42NDJtUEJtK0hh?=

=?utf-8?B?MElDN3dpazlIOTBTU3ZabEtOOFVLbW9rRWgwUUxYbzFjYkRhd2lXZzZWR3dR?=

=?utf-8?B?dnAyTVB2Q3d0bmF6N1dNNDU5ald4Ym5hbHBHb3ZkUDdhdXA4Wm85TjVEK01L?=

=?utf-8?B?aHVrVFYySms1dGxJekN2NWg2RldzeFZ5Kys2QXJBLzZzbmJCeTFMNGNtTDFY?=

=?utf-8?B?V3NKYmc5TnduUDlFOHlwUXlNa2ZUcEpZYWNvN1hTY0RvQ0M1NUNuMmtkaXQr?=

=?utf-8?B?Q054SFh3ZjRwQnlvYVptMmFqRUptS1BMN0xXQkxTZUVka3NxR21oVjRhVmJR?=

=?utf-8?B?OWtLbm14blVhM1V4UVlFOEptRHlUYlljNkFhTDBia2pJdnM4Smg2blF1WTU0?=

=?utf-8?B?VkVJcHA4emIrTTBFREREYnRwSlFKZHg0b0hXTVBTZnFTYy9VTWU3bDFzeVBQ?=

=?utf-8?B?aDR6dWdqK0NQQXVoVWdWQ2tPSnhCaENTbVZ5WjgyQW8yNDZ1SWd5eW5sdE1X?=

=?utf-8?B?OVNubXRETFVKb1p6VGJpM0tQcHVOU0I3dUhqa2llOTdueGlPN3gvT0xiSmt1?=

=?utf-8?B?YUNsbllJUXlJRFEyTEJOL2k4STNoeWxtNExuQ1dPN2VzdzNtdDBxTFVFYkxL?=

=?utf-8?B?MUhUZDRLM2kxVjlvb21qSlBJbkw3dDZwdjdhcjhUd29rT1lWTFNBUWxuTm9B?=

=?utf-8?B?YkJOSkE0YjhCVFFXY3BwMFVZQ0hudlB3UXJlRndwNlAxQ0d3ZElIdkx3K1BV?=

=?utf-8?B?clFNcjA3MUxwL1pUMU5CeGJGNERMQytCUnFXL3h5enhqYWZPcllsbTlvbXJK?=

=?utf-8?B?Vzl3L2UwTU1aS3hubDQ4ZURYajhKOVM1OWlDbWtYd2IvNmFzcVdzWXlObHZG?=

=?utf-8?B?bHZtQkYrSzhrbnBJaFhod3JZaUFVb1V3UGZ3YWFFZXNSMzVDUml1RTZaNmhl?=

=?utf-8?B?cDhHQlYybDhwNHVRNlgrSHJyOE9JVjNGYXVMMldZN0RQMm5oYmVMSGEwcGNS?=

=?utf-8?B?WUZodXY3aUNBVFVMSjV6UElCeDFVQzVQVUNYUUV5Tm0wSXpSSHQ3US8yYzhE?=

=?utf-8?B?b2JINFB0YlNXd3RkS1BRMXpYWXk3d0FTYkxXdmI5VU9ZUzk5ZzNONlVYZUsx?=

=?utf-8?Q?2Q1InOONmYNHm6Syi00IsNzGH01AoxceEojQ7A?=

X-Auto-Response-Suppress: DR, OOF, AutoReply

X-OriginatorOrg: sct-15-20-9412-4-msonline-outlook-090a5.templateTenant

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 24 Jun 2026 16:03:33.0602

(UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id: 8d1e42fe-8a60-4f7b-18a6-08ded20a2420

X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-AuthSource: DS2PEPF000061C1.namprd02.prod.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: Internet

X-MS-Exchange-Transport-CrossTenantHeadersStamped: SJ0PR18MB3948

X-Spam_score: 16.3

X-Spam_score_int: 163

X-Spam_bar: ++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.