AAA Emergency Road Kit Phish from Microsoft Outlook Part 2

Posted by Dave Yadallee on
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[40.93.195.88 listed in wl.mailspike.net]

0.4 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[40.93.195.88 listed in bl.score.senderscore.com]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[40.93.195.88 listed in bl.score.senderscore.com]

0.3 OFFER BODY: Offers you Something

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.7 MPART_ALT_DIFF BODY: HTML and text parts are different

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 MIME_HTML_ONLY_MULTI Multipart message only has text/html MIME parts

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different

freemails

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

1.0 VOWEL_URI_5 URI hostname with 5 consecutive vowels

1.0 XPRIO Has X-Priority header

1.8 COMBO_IMAGEONLY1 Appears to be an image only message

Subject: {SPAM?} 24 Hours Left to Claim Your Free Kit



--_3e3b4aa1-e54f-49e3-959f-9e8fd3e3f004_

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: 7bit













AAA – Free Car Emergency Kit













Your free AAA Emergency Kit + exclusive member discounts — claim today before supplies run out.









































AAA Emergency Road Kit Phish from Microsoft Outlook Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 02 Mar 2026 22:03:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vxHtZ-000000002NR-4A1z

for dave@doctor.nl2k.ab.ca;

Mon, 02 Mar 2026 22:02:09 -0700

Resent-From: The Doctor

Resent-Date: Mon, 2 Mar 2026 22:02:09 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-southcentralusazon11022088.outbound.protection.outlook.com ([40.93.195.88]:16119 helo=SN4PR2101CU001.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vxE80-00000000EJM-3rHH

for doctor@doctor.nl2k.ab.ca;

Mon, 02 Mar 2026 18:00:57 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=ePTOROJLdeUiTK5F7cL51JQz0/Y4m/TP4E0e19S8bCCymcjto0vs+nt/o4tgvesz0Tgj/ga9LD2WdHNqMXJIZsqsoej7+K8C8f3n02JsBY8YoTyDflQZqOIYnPJKALBcN812AmYGbyf0zWvcsFej+Duj5s0Dv13iRdm1O1ys323m6hVmuyEK0oxjIVb/joUt5gBuPtuCETOhZb+skvGAhCiQVG76+OrOCMAZlkkS8LggUKEzem2cDKchomalDmo0Cyqiv0Y1N/svzL2qE1P3H3lrmwcLxLrexn0BcGQpJQfiMSmQEA6ls5Gm3T7y+lMDjCvXxMC+Gk2gqpKHzh7ueA==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=aKwwy1FfgUynRw1SCPDPeYj1PdV9WCnSRxUDD2a/R0E=;

b=srSj2Ru72OqWLUg1+hpzxD9gLKTjc7G4W0KonXxl45nsDh1JAqHjFpirB1EC+boXCyp+oJWGCWnMCIW1yJy6898F9AtAefHy3yPL6b03W4Mv8oNd/9qq8a3CTkDddOTk/FXVnjelYWq2m36zkxge6zyhmdvEqX10IiGfCqi5TkURrGKHDzz2hVG+p3yAr3HMw8CKnEJCYEl+hbRc8/yUxatNarRvEjFv/smBlLna0ASS4VWU/1ZRQr/EY5e/s1aPtpFptxsx7gvwzXhRLNN0qnEETyalFetYRjc4LGswJxMKohGxnWcOqtC4axgc5FXKzdSXBXkTJWAwh+PRqigKnA==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=fail (sender ip is

103.241.67.132) smtp.rcpttodomain=doctor.nl2k.ab.ca

smtp.mailfrom=ohiostateuniversity52784.onmicrosoft.com; dmarc=none

action=none header.from=ohiostateuniversity52784.onmicrosoft.com; dkim=none

(message not signed); arc=none (0)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=ohiostateuniversity52784.onmicrosoft.com;

s=selector1-ohiostateuniversity52784-onmicrosoft-com;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=aKwwy1FfgUynRw1SCPDPeYj1PdV9WCnSRxUDD2a/R0E=;

b=ZZhKhow/KEPZwhSSOZ2mvmZv98NEtg3hpzCu6iapom/N5N/sAuoU6vwd2Cv3Qtxn8du5/Gim2exFpJb3iDDFU/kwlp9E4AtLgLIjfoKpa2Mm1cD1gkJPzg/pLP6RmARKCixO4Q/MX3Nmz0/kXmy6chbRVE0kLAoymLaQyFqKb+aLSyBGYt0Md1TGuJiMS72egVa3swb5QJ+3QfLhZMBa83j7fKlvv3HHi/gtTkE5rwAdL7L4qGyq94bavvT5MNhwHO7dwcCJzztbCt68thnI0V1lCExI6jBrg+Sh++v5NUXHXKFaowqF1nVLaEHnlRuNmj0d2G8bPeEPtf90JVmJYw==

X-MS-Exchange-Authentication-Results: spf=fail (sender IP is 103.241.67.132)

smtp.mailfrom=ohiostateuniversity52784.onmicrosoft.com; dkim=none (message

not signed) header.d=none;dmarc=none action=none

header.from=ohiostateuniversity52784.onmicrosoft.com;

Date: Tue, 03 Mar 2026 01:53:17 +0100

From: "AAA Safety Update"

Reply-To: support.e0k4pdduu5lb5@ohiostateuniversity52784.onmicrosoft.com

To: doctor@doctor.nl2k.ab.ca

Subject: 24 Hours Left to Claim Your Free Kit

X-Mailer: AAA Campaign Mailer v1.0

X-Priority: 3

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="_3e3b4aa1-e54f-49e3-959f-9e8fd3e3f004_"

List-Unsubscribe:

List-Unsubscribe-Post: List-Unsubscribe=One-Click

Message-ID:

<11826ed4-7564-4b41-8758-ed47487e6342@BL02EPF0001A102.namprd05.prod.outlook.com>

X-EOPAttributedMessage: 0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: BL02EPF0001A102:EE_|SN7PR07MB9628:EE_

X-MS-Office365-Filtering-Correlation-Id: c82ccaa7-5ba6-4fe4-6111-08de78c02cd4

X-MS-Exchange-SenderADCheck: 1

X-MS-Exchange-AntiSpam-Relay: 0

X-Microsoft-Antispam:

BCL:0;ARA:13230040|4022899009|61400799027|36860700013|34020700016|82310400026|376014|8096899003|54012099003|85622059;

X-Microsoft-Antispam-Message-Info:

ANdfcjTBHf/4f3lZB/nsMMvu79v0b14fXFwgMzrqAEn9jDIF+OAu529lUZFWpIUZi4e3lZ2OBC/oq6AVpzoZaSJp1CNvKkauLe3MvYJoRP5WXe27M0qLoLx6weGh5Kqw6DpsShL+3bsGYZ/w927RIxS70dGztURnPdRQ3ygpvY9deUUFaZc8KjDaJ9olDRj6SHdXwYPVR3TW9qZia10yXmc5m+mXaYLI16zMsiYHnFAB7q9rVSG8e4FlrPIBRLphKMOz6UERschUqjnYzaMSmPC7ac86pEmOipLqoVRhH5K0ZyE5Izk2VheH/CV9RiJWBwrYgXzbJe+s/s0Maniw8jw/rM8gZ6WQ//klWY7Q87VGlGIwNQG+O1sPCWV0R7MISXph8+ZvDFLfUAPqOTDeazAfHUbl4oVUcir24VGEYMW4mq//+i4/OpDSD7iguZCAxfy3JHRdAVXdWZcTUeL5Nh87uiG8Gk5quPsxdFGAcrQMq/uVQySvqOMgNYs2p7dDD+qIykCTe8hCOsPsBaXVzUnUqc6Ekiqz06sLjfgVk3ziBodvCCCefdkllZseukqEC5WVgvMR64qXpHZCv/txmd8vY335YGvtDgIUYlOcQKENk3yD6YJJDXaD6HANdwdslG9fQw7sR5pz4MvNnhqkko4zLaMCzeohe13pdJxKRvw5cOobWZPMkTOUoEeii1dn3FbkBq4mvBzXcYQOFR6+ILlt2QpFGmsdjfaN4NBaVRcsbv6AYr6/0RLVNSDfPuQqpLFRMCsIGhSxIiJC/Vs9JRepkxuq9ic3AuD26kX1+qs=

X-Forefront-Antispam-Report:

CIP:103.241.67.132;CTRY:ES;LANG:en;SCL:1;SRV:;IPV:CAL;SFV:NSPM;H:ohiostateuniversity52784.onmicrosoft.com;PTR:InfoDomainNonexistent;CAT:NONE;SFS:(13230040)(4022899009)(61400799027)(36860700013)(34020700016)(82310400026)(376014)(8096899003)(54012099003)(85622059);DIR:OUT;SFP:1102;

X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1

X-MS-Exchange-AntiSpam-MessageData-0:

GoCx9W37ul+/5yXUQ2YzQh9NskywoirUVOxmmUQJtZpFp6rdzf60lEKA924ZBPu/h6DTBnI6rytij/ebBErL0XDXCCuOvdXE+wbYW7McIOdJXUAuFNy8Jj5B9haFi/6o8MJPGrwTp8eHBkm/Rsck1sMD2bwCU8NpR4BMFlPJVcpOF2IhaUtwLHQa7pkjquX8qqpItyAsgo42a4n2Qzo8LZ2nQvBHB7b8wwllpQAUvQmg2e7qjrCEXcVshSoQSZ5G10T9zHqon+Vu1/R9yUhCQiO9kcrda53onb3vSdEA7B1hmlLZm20PBZVxx9kTctAfSzMW8AQHAHoaSrqQsS9XEUus1yYHQY5Tqz7MCM57AS+PeEFFCH6ruQun9P7MBTxf6J6IUlmZ9+fnxC3+pz3Cu+y3s0qaraIoG2R6YO2imxU1rcs5HlTtdKXxPBpOd4eK

X-OriginatorOrg: ohiostateuniversity52784.onmicrosoft.com

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 03 Mar 2026 00:59:51.2553

(UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id: c82ccaa7-5ba6-4fe4-6111-08de78c02cd4

X-MS-Exchange-CrossTenant-Id: 879e33ec-cf75-4093-82ee-7d9b07a688a8

X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=879e33ec-cf75-4093-82ee-7d9b07a688a8;Ip=[103.241.67.132];Helo=[ohiostateuniversity52784.onmicrosoft.com]

X-MS-Exchange-CrossTenant-AuthSource:

BL02EPF0001A102.namprd05.prod.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem

X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN7PR07MB9628

X-Spam_score: 12.9

X-Spam_score_int: 129

X-Spam_bar: ++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: AAA – Free Car Emergency Kit Your free AAA Emergency Kit

+ exclusive member discounts — claim today before supplies run out.



Content analysis details: (12.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[40.93.195.88 listed in will-spam-for-food.eu.org]

[40.93.195.88 listed in will-spam-for-food.eu.org]

[40.93.195.88 listed in will-spam-for-food.eu.org]

[40.93.195.88 listed in will-spam-for-food.eu.org]

[40.93.195.88 listed in will-spam-for-food.eu.org]

[40.93.195.88 listed in will-spam-for-food.eu.org]

[40.93.195.88 listed in will-spam-for-food.eu.org]

[40.93.195.88 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[40.93.195.88 listed in dnsbl.ahbl.org]

[40.93.195.88 listed in dnsbl.ahbl.org]

[40.93.195.88 listed in dnsbl.ahbl.org]

[40.93.195.88 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[40.93.195.88 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[40.93.195.88 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[40.93.195.88 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[40.93.195.88 listed in dnsbl.ahbl.org]

1.1 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The

query to Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[40.93.195.88 listed in sa-trusted.bondedsender.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.7 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[40.93.195.88 listed in sa-accredit.habeas.com]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[40.93.195.88 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[support.e0k4pdduu5lb5(at)ohiostateuniversity52784.onmicrosoft.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[benefits.1g5(at)ohiostateuniversity52784.onmicrosoft.com]

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[benefits.1g5(at)ohiostateuniversity52784.onmicrosoft.com]

NetKnow still in NetCraft's Top 10900 part 2

Posted by Dave Yadallee on

4Web





4web ranks >2000000 from >2000000 .



Alentus / Wolfpaw





Alentus

rank by Netcraft >2000000 from >2000000 and I note they are hosted in the USA .

wolfpaw.net

which ranks at >2000000 from >2000000



Yellowpencil





Yellowpencil Ranks >2000000 from >2000000



WSI Corporation





Next is WSI - We Simply The Internet of Toronto

at Netcraft Position >2000000 from >2000000 and are being hosted on Amazon.



Uniserve / Interbaun





Next, Uniserve

ranks on Netcraft >2000000 from >2000000

One of their acquisitions

interbaun

ranks with Netcraft ?????? from ?????? due to merging of sites.

One customer just came over from this organization in Nov 2006.



Clearwave Broadband





Clearwave Broadband ranks

at >2000000 from >2000000



Platinum Communications





Platinum Communications Corp.

bought out by Xplornet .



Wild Rose Internet





Wild Rose Internet

ranks >2000000 from >2000000 and I wonder if this is another wireless branch of Tera-Byte and bought out by Xplornet





TIC Internet





TIC Internet

ranks >2000000 from >2000000 ( I do remember you).



Nisa Custom Internet Solutions





Nisa Custom Internet Solutions

ranks >2000000 from >2000000 by Netcraft



MediaShaker





Media Shakers of Edmonton

ranks >2000000 from >2000000





Koi Media





Koi Media

rank >2000000 from >2000000



WebFire





Webfire.ca

ranks >2000000 from >2000000 and seems to be connected with Shaw.



Core Network Solutions Inc.





Core Network Solutions Inc.

ranks at >2000000 from >2000000 .



The Network Centre





The Network Centre

ranks >2000000 from >2000000 and are linked with Telus high Speed.





Open Concept Internet, Inc.





Open Concept Internet, Inc.

rank > 2000000 from > 2000000





Techalta





Interspots of Edmonton

acquired by Techalta ;



Yegtel





Yegtel rank > 2000000 .



Internet Crossroads





Internet Crossroads Ltd of North Edmonton

rank nothing from nothing by Netcraft and seems to merged with Tera-Byte/ecn.ab.ca .



If I remember anymore, I will add to this entry, before Netcraft changes our ranking. Please watch this space and please feel free to peruse

our services.

NetKnow still in NetCraft's Top 10900 part 1

Posted by Dave Yadallee on
All data is from Netcraft Toolbar .

Looks as if there are major changes to the Netcraft algorithm after some years! Why did Avast clasify the extension as URL:Phishing?

This is not the Alexa Tool Bar!



NetKnow







Netknow now at 10884 from 10853 at Netcraft and pfs compliant



A slight increase! We must do
  1. security audits regularly
  2. check on illegitimate traffic hitting the web server


    3. and
  3. keep design current!




How do we compare with other providers in

Edmonton, Alberta, Canada?



Rogers





Rogers Business Solutions

which rank 4895 from 4863 and are hosted in Europe.



Telus and reviews



Next we have Telus.com

ranked by Netcraft at 5685 from 6286 .

Sometimes their Web Hosting is done by
title="Internet Names for Business">Internet Names for Business

is ranked by Netcraft at >2000000 from >2000000 .



Is Telus's ADSL network susceptible to Code Red Attacks and Attackers?

Reviews of Telus are available :





Netknow again





We at Netknow are at 10884 from 18857 since the start of 2026.



Government of Alberta



The Government of Alberta Website

ranks 14761 from 14791 by Netcraft and seems to hosted on Cloudfare.



City of Edmonton







The City of Edmonton ranks 32596 from 31807 by Netcraft and hosted by Google.



University of Alberta







The University of Alberta ranks 51868 from 51699 hosted by Amazon Techonologies.



Juno and NetZero





We have Juno Internet ranked on top

at 301562 from 309275 who are the owners of

US Based Netzero at Netcraft Rank 78084 from 77026 .



Grant MacEwen University





MacEwan ranks 104997 from 105894 .



NAIT / Northern Alberta Institute of Technology





NAIT ranks 107894 from 106467 hosted by Microsoft .



TekSavvy



TekSavvy ranks 275196 from 264427 and are hosted by Microsoft



Shaw Cable





Next,

members.shaw.ca

ranks >2000000 from >2000000 and retired and

Shaw Cable

is next at Netcraft rank 1170578 from 1172972 . Hosted now by Akamei .

Their Network Hosting Arm,

Big Pipe is at

Netcraft rank 303560 from 303923 and hosted by Akamai in Europe .



Reviews of Shaw are available :





Xplornet



xplornet

ranks >2000000 from >2000000 and are listed with

Cirrus9 and are joining up with Shaw.

Their new domain xplore.ca ranks 399699 from 364551 .

According to an article in the Sherwood Park Independent, they are also getting an Alberta Government subsidy.



Internet Centre / CCINet



Internet Centre

rank 457602 from 458365 . Their partner Rack Nine ranks > 2000000.



Distributel / 3Web / CIA



Cybersurf

is ranked 827288 from 915352 and seems to be hosted in USA by DigitalOcean.



Primus



Primus

ranks >2000000 from >2000000 and now points to BLACKIRON_DataCentres ranked >2000000 from >2000000.



Northern lights Fiber







Northern lights Fiber are ranked by Netcraft >2000000 and uses AWS.



OkayVPN





OkayVPN

are ranked by Netcraft >2000000 and uses Cloudfare.



Radiant Communications / goco.ca





Radiant Communications

are ranked by Netcraft >2000000 and part of goco.ca

which ranks >2000000 .



Tera Byte Edmonton and reviews





Next is Tera-Byte

at Netcraft Rank >2000000 with

Tera-Byte.ca

ranking >2000000 from >2000000 and their wireless arm Tera-Byte Wireless

sold to Xplornet.

One of Tera-Byte's acquisitions

Edmonton Community Networks

ranks at >2000000 from >2000000 and

Go Edmonton ranks >2000000 from >2000000.

Alberta political blogger Daveberta ranks >2000000 from >2000000; interesting!!!

Reviews of Tera-byte is available at

here

and another here

and check Google for more reviews; just search tera byte.



MCSnet





MCSNET ranks >2000000 from >2000000 and are hosted by Microsoft .



Nucleus Internet Services





After that we have

Nucleus Information Services which can be found at Netcraft Rank >2000000 from >2000000 .

Intelcom phish from digitalocean

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 02 Mar 2026 14:25:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vxAkp-00000000AaS-2SsR

for dave@doctor.nl2k.ab.ca;

Mon, 02 Mar 2026 14:24:39 -0700

Resent-From: The Doctor

Resent-Date: Mon, 2 Mar 2026 14:24:39 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [192.241.168.10] (port=34152 helo=vtwo.tyentusa.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vx9WX-000000007hq-2eow

for root@nk.ca;

Mon, 02 Mar 2026 13:05:57 -0700

Received: from www-data by vtwo.tyentusa.com with local (Exim 4.90_1)

(envelope-from )

id 1vx9Vj-000533-7m

for root@nk.ca; Mon, 02 Mar 2026 20:04:59 +0000

To: root@nk.ca

Subject: Important: Your Package Requires Customs Clearance - 2.96 CAD Due

Date: Mon, 2 Mar 2026 20:04:59 +0000

From: Intelcom

Message-ID: <98b25f0bfcd495f151d0955f06e03eba@tyentshowroom.com>

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="b1_98b25f0bfcd495f151d0955f06e03eba"

Content-Transfer-Encoding: 8bit

X-Spam_score: 7.3

X-Spam_score_int: 73

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Intelcom Customs Update @media only screen and (max-width:

600px) { .container { width: 100% !important; padding: 20px !important; }

} Customs Clearance



Content analysis details: (7.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[192.241.168.10 listed in will-spam-for-food.eu.org]

[192.241.168.10 listed in will-spam-for-food.eu.org]

[192.241.168.10 listed in will-spam-for-food.eu.org]

[192.241.168.10 listed in will-spam-for-food.eu.org]

[192.241.168.10 listed in will-spam-for-food.eu.org]

[192.241.168.10 listed in will-spam-for-food.eu.org]

[192.241.168.10 listed in will-spam-for-food.eu.org]

[192.241.168.10 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[192.241.168.10 listed in dnsbl.ahbl.org]

[192.241.168.10 listed in dnsbl.ahbl.org]

[192.241.168.10 listed in dnsbl.ahbl.org]

[192.241.168.10 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[192.241.168.10 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[192.241.168.10 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[192.241.168.10 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[192.241.168.10 listed in dnsbl.ahbl.org]

1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

Subject: {SPAM?} Important: Your Package Requires Customs Clearance - 2.96 CAD Due



This is a multi-part message in MIME format.



--b1_98b25f0bfcd495f151d0955f06e03eba

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit









Â



Intelcom Customs Update

@media only screen and (max-width: 600px) {

.container { width: 100% !important; padding: 20px !important; }

}







Customs Clearance







Your shipment needs additional information to clear customs.





Shipment ID: INTLXXXXXX



Origin: International



Status: Awaiting Clearance



Provide Required Information





Need help? Call 1-888-744-1155 or reply to this email.









Intelcom Logistics • Delivering Excellence







--b1_98b25f0bfcd495f151d0955f06e03eba

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: 8bit









Â



Intelcom Customs Update







Customs Clearance









Your shipment needs additional information to clear customs.







Shipment ID: INTLXXXXXX





Origin: International





Status: Awaiting Clearance





Provide Required Information





Need help? Call 1-888-744-1155 or reply to this email.











Intelcom Logistics • Delivering Excellence













--b1_98b25f0bfcd495f151d0955f06e03eba--



Intelcom phish from Digital Ocean

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 02 Mar 2026 14:25:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vxAl5-00000000Aag-33ge

for dave@doctor.nl2k.ab.ca;

Mon, 02 Mar 2026 14:24:55 -0700

Resent-From: The Doctor

Resent-Date: Mon, 2 Mar 2026 14:24:55 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [192.241.168.10] (port=51378 helo=vtwo.tyentusa.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vx9bQ-000000007tW-0EyB

for sales@netknow.ca;

Mon, 02 Mar 2026 13:10:59 -0700

Received: from www-data by vtwo.tyentusa.com with local (Exim 4.90_1)

(envelope-from )

id 1vx9aY-0008CE-MY

for sales@netknow.ca; Mon, 02 Mar 2026 20:09:58 +0000

To: sales@netknow.ca

Subject: Important: Your Package Requires Customs Clearance - 2.96 CAD Due

Date: Mon, 2 Mar 2026 20:09:58 +0000

From: Intelcom

Message-ID: <8c1ae7d7775d860cd3fee3ac673a805b@tyentshowroom.com>

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="b1_8c1ae7d7775d860cd3fee3ac673a805b"

Content-Transfer-Encoding: 8bit



This is a multi-part message in MIME format.



--b1_8c1ae7d7775d860cd3fee3ac673a805b

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit









Â



Intelcom Customs Update

@media only screen and (max-width: 600px) {

.container { width: 100% !important; padding: 20px !important; }

}







Customs Clearance







Your shipment needs additional information to clear customs.





Shipment ID: INTLXXXXXX



Origin: International



Status: Awaiting Clearance



Provide Required Information





Need help? Call 1-888-744-1155 or reply to this email.









Intelcom Logistics • Delivering Excellence







--b1_8c1ae7d7775d860cd3fee3ac673a805b

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: 8bit









Â



Intelcom Customs Update







Customs Clearance









Your shipment needs additional information to clear customs.







Shipment ID: INTLXXXXXX





Origin: International





Status: Awaiting Clearance





Provide Required Information





Need help? Call 1-888-744-1155 or reply to this email.











Intelcom Logistics • Delivering Excellence













--b1_8c1ae7d7775d860cd3fee3ac673a805b--



Intelcom phish from digital Ocean

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 02 Mar 2026 14:25:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vxAku-00000000AaX-3S6F

for dave@doctor.nl2k.ab.ca;

Mon, 02 Mar 2026 14:24:44 -0700

Resent-From: The Doctor

Resent-Date: Mon, 2 Mar 2026 14:24:44 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [192.241.168.10] (port=34122 helo=vtwo.tyentusa.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vx9WX-000000007hk-2etl

for doctor@doctor.nl2k.ab.ca;

Mon, 02 Mar 2026 13:05:57 -0700

Received: from www-data by vtwo.tyentusa.com with local (Exim 4.90_1)

(envelope-from )

id 1vx9Vj-00051c-0u

for doctor@doctor.nl2k.ab.ca; Mon, 02 Mar 2026 20:04:59 +0000

To: doctor@doctor.nl2k.ab.ca

Subject: Important: Your Package Requires Customs Clearance - 2.96 CAD Due

Date: Mon, 2 Mar 2026 20:04:59 +0000

From: Intelcom

Message-ID: <071ab64dd2628dddf59847613533d17c@tyentshowroom.com>

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="b1_071ab64dd2628dddf59847613533d17c"

Content-Transfer-Encoding: 8bit

X-Spam_score: 7.3

X-Spam_score_int: 73

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Intelcom Customs Update @media only screen and (max-width:

600px) { .container { width: 100% !important; padding: 20px !important; }

} Customs Clearance



Content analysis details: (7.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[192.241.168.10 listed in will-spam-for-food.eu.org]

[192.241.168.10 listed in will-spam-for-food.eu.org]

[192.241.168.10 listed in will-spam-for-food.eu.org]

[192.241.168.10 listed in will-spam-for-food.eu.org]

[192.241.168.10 listed in will-spam-for-food.eu.org]

[192.241.168.10 listed in will-spam-for-food.eu.org]

[192.241.168.10 listed in will-spam-for-food.eu.org]

[192.241.168.10 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[192.241.168.10 listed in dnsbl.ahbl.org]

[192.241.168.10 listed in dnsbl.ahbl.org]

[192.241.168.10 listed in dnsbl.ahbl.org]

[192.241.168.10 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[192.241.168.10 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[192.241.168.10 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[192.241.168.10 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[192.241.168.10 listed in dnsbl.ahbl.org]

1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

Subject: {SPAM?} Important: Your Package Requires Customs Clearance - 2.96 CAD Due



This is a multi-part message in MIME format.



--b1_071ab64dd2628dddf59847613533d17c

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit









Â



Intelcom Customs Update

@media only screen and (max-width: 600px) {

.container { width: 100% !important; padding: 20px !important; }

}







Customs Clearance







Your shipment needs additional information to clear customs.





Shipment ID: INTLXXXXXX



Origin: International



Status: Awaiting Clearance



Provide Required Information





Need help? Call 1-888-744-1155 or reply to this email.









Intelcom Logistics • Delivering Excellence







--b1_071ab64dd2628dddf59847613533d17c

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: 8bit









Â



Intelcom Customs Update







Customs Clearance









Your shipment needs additional information to clear customs.







Shipment ID: INTLXXXXXX





Origin: International





Status: Awaiting Clearance





Provide Required Information





Need help? Call 1-888-744-1155 or reply to this email.











Intelcom Logistics • Delivering Excellence













--b1_071ab64dd2628dddf59847613533d17c--



Intelcom phish from digitalocean

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 02 Mar 2026 14:25:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vxAkj-00000000AaO-1zZb

for dave@doctor.nl2k.ab.ca;

Mon, 02 Mar 2026 14:24:33 -0700

Resent-From: The Doctor

Resent-Date: Mon, 2 Mar 2026 14:24:33 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [192.241.168.10] (port=34116 helo=vtwo.tyentusa.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vx9WX-000000007hj-2i1Z

for doctor@nk.ca;

Mon, 02 Mar 2026 13:06:01 -0700

Received: from www-data by vtwo.tyentusa.com with local (Exim 4.90_1)

(envelope-from )

id 1vx9Vj-00051X-0F

for doctor@nk.ca; Mon, 02 Mar 2026 20:04:59 +0000

To: doctor@nk.ca

Subject: Important: Your Package Requires Customs Clearance - 2.96 CAD Due

Date: Mon, 2 Mar 2026 20:04:58 +0000

From: Intelcom

Message-ID:

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="b1_f8e2c456103f7c29351263e0709f6d57"

Content-Transfer-Encoding: 8bit

X-Spam_score: 7.3

X-Spam_score_int: 73

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Intelcom Customs Update @media only screen and (max-width:

600px) { .container { width: 100% !important; padding: 20px !important; }

} Customs Clearance



Content analysis details: (7.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[192.241.168.10 listed in will-spam-for-food.eu.org]

[192.241.168.10 listed in will-spam-for-food.eu.org]

[192.241.168.10 listed in will-spam-for-food.eu.org]

[192.241.168.10 listed in will-spam-for-food.eu.org]

[192.241.168.10 listed in will-spam-for-food.eu.org]

[192.241.168.10 listed in will-spam-for-food.eu.org]

[192.241.168.10 listed in will-spam-for-food.eu.org]

[192.241.168.10 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[192.241.168.10 listed in dnsbl.ahbl.org]

[192.241.168.10 listed in dnsbl.ahbl.org]

[192.241.168.10 listed in dnsbl.ahbl.org]

[192.241.168.10 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[192.241.168.10 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[192.241.168.10 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[192.241.168.10 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[192.241.168.10 listed in dnsbl.ahbl.org]

1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

Subject: {SPAM?} Important: Your Package Requires Customs Clearance - 2.96 CAD Due



This is a multi-part message in MIME format.



--b1_f8e2c456103f7c29351263e0709f6d57

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit









Â



Intelcom Customs Update

@media only screen and (max-width: 600px) {

.container { width: 100% !important; padding: 20px !important; }

}







Customs Clearance







Your shipment needs additional information to clear customs.





Shipment ID: INTLXXXXXX



Origin: International



Status: Awaiting Clearance



Provide Required Information





Need help? Call 1-888-744-1155 or reply to this email.









Intelcom Logistics • Delivering Excellence







--b1_f8e2c456103f7c29351263e0709f6d57

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: 8bit









Â



Intelcom Customs Update







Customs Clearance









Your shipment needs additional information to clear customs.







Shipment ID: INTLXXXXXX





Origin: International





Status: Awaiting Clearance





Provide Required Information





Need help? Call 1-888-744-1155 or reply to this email.











Intelcom Logistics • Delivering Excellence













--b1_f8e2c456103f7c29351263e0709f6d57--



Intelcom phish from digitalocean

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 02 Mar 2026 14:25:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vxAkM-00000000Aa8-10RK

for dave@doctor.nl2k.ab.ca;

Mon, 02 Mar 2026 14:24:10 -0700

Resent-From: The Doctor

Resent-Date: Mon, 2 Mar 2026 14:24:10 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [192.241.168.10] (port=37788 helo=vtwo.tyentusa.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vx8e4-000000005ox-1OFd

for sales@nk.ca;

Mon, 02 Mar 2026 12:09:39 -0700

Received: from www-data by vtwo.tyentusa.com with local (Exim 4.90_1)

(envelope-from )

id 1vx8dD-00017h-2g

for sales@nk.ca; Mon, 02 Mar 2026 19:08:39 +0000

To: sales@nk.ca

Subject: =?UTF-8?Q?Reminder_meaning:_Your_package_must_be_completely_ready_for_del?= =?UTF-8?Q?ivery_=E2=80=93_CAD_2.96_(down)?=

Date: Mon, 2 Mar 2026 19:08:39 +0000

From: Intelcom

Message-ID: <83a4cdf2ca3ed0d6e67bf6664734d7f0@tyentshowroom.com>

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="b1_83a4cdf2ca3ed0d6e67bf6664734d7f0"

Content-Transfer-Encoding: 8bit



This is a multi-part message in MIME format.



--b1_83a4cdf2ca3ed0d6e67bf6664734d7f0

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit













Intelcom Customs Update

@media only screen and (max-width: 600px) {

.container { width: 100% !important; padding: 20px !important; }

}







Customs Clearance







Your shipment needs additional information to clear customs.





Shipment ID: INTLXXXXXX



Origin: International



Status: Awaiting Clearance



Provide Required Information





Need help? Call 1-888-744-1155 or reply to this email.









Intelcom Logistics • Delivering Excellence







--b1_83a4cdf2ca3ed0d6e67bf6664734d7f0

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: 8bit













Intelcom Customs Update







Customs Clearance









Your shipment needs additional information to clear customs.







Shipment ID: INTLXXXXXX





Origin: International





Status: Awaiting Clearance





Provide Required Information





Need help? Call 1-888-744-1155 or reply to this email.











Intelcom Logistics • Delivering Excellence













--b1_83a4cdf2ca3ed0d6e67bf6664734d7f0--



Webroot phish from Google Gmail Part 4

Posted by Dave Yadallee on
@
/InformAction">
emtype=3D"http://schema.org/EmailMessage">
ntent=3D"Chantelle Moore: INVOICE Webroot Securities (803)-201 2106 Bill da=

te: 2026-03-03 Order No: 98-674-1351 Dear User, This notice serves as confi=

rmation that USD487.00 has been charged for your Five Years Access Package =

under the Webroot PC Protection Plan, in accordance with your selected bill=

ing terms. Item Profile Center Quantity: 1 Device Product: Secure Protectio=

n Plus Subscription Term: 5-Years Billing Mode: Auto Debit Total Charged: $=

466.22 For questions concerning your service agreement, please contact our=

billing support at 1 803 201-2106. Until we connect again, Philip Smith We=

broot Securities, llc 4671 Airport Blvd # A Miami Fl 33144-2027 United Stat=

es . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . =

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .=

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . =

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .=

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ."=

/>
Event">
eduled"/>
rg/Organization">
n>
v58olk"/>
ight: 1px; height: 0; max-height: 0; width: 0; max-width: 0; opacity: 0; ov=

erflow: hidden;" itemprop=3D"name">Receipt 1037-256-NAZ delivery update ava=

ilable
























AAA


Member Services Bulletin



FREE OFFER


























Limited — While Supplies Last




Get Your


Emergency


Road Kit Free





A complete roadside safety kit — jumper cables, flashlight, first aid & more — shipped free to your door as our member appreciation gift.




style="display:inline-block;background:#c8102e;color:#ffffff;font-family:'Source Sans 3',Helvetica,sans-serif;font-size:13px;font-weight:700;padding:14px 30px;text-decoration:none;letter-spacing:1px;text-transform:uppercase;">

Claim Free Kit →



Inside Your Kit




🔌

Jumper Cables








🔦

LED Flashlight








🩺

First Aid Kit








📋

Safety Guide






$0.00


Free + Free Shipping
















★★★★★

"Rated 4.9/5 by AAA Members"

Verified Reviews



g=3D"0" role=3D"presentation" align=3D"center" style=3D"width:100%;" class=

=3D"body-container">

-[if mso | IE]>
=3D"presentation">
=

 

ellspacing=3D"0" role=3D"presentation" align=3D"center" style=3D"width:100%=

;" class=3D"">
r>

mscope itemtype=3D"http://schema.org/EmailMessage">


on">INVOICE
Webroot Securities
(803)-201 2106

Bill date: 2026-03-03=


Order No: 98-674-1351

Dear User,

This notice serves as confirmation=

that USD487.00 has been charged for your Five Years Access Package under t=

he Webroot PC Protection Plan, in accordance with your selected billing ter=

ms.

Item Profile Center
Quantity: 1 Device
Product: Secure Protecti=

on Plus
Subscription Term: 5-Years
Billing Mode: Auto Debit
Total =

Charged: $ 466.22

For questions concerning your service agreement, please=

contact our billing support at 1 803 201-2106.

Until we connect again,<=

br>Philip Smith
Webroot Securities, llc
4671 Airport Blvd # A Miami F=

l 33144-2027 United States
.
.
.
.
.
.
.
.
.
=

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
=

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
=

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
=

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
=

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
=

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
=

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
=

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
=

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
=

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
=

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
=

.
.
.
.
.
.
.
.
.
.
.
.


ole=3D"presentation" align=3D"center" style=3D"width:100%;" class=3D"">
dy>

n: rtl; font-size: 0; padding: 24px 32px; text-align: left; vertical-align:=

top;" class=3D"main-container-inner">=


display: inline-block; vertical-align: top; width: 100%;overflow: hidden; =

word-wrap: break-word;">
=3D"0" role=3D"presentation" width=3D"100%" class=3D"main-column-table-ltr"=

style=3D"padding-right: 32px; padding-left: 0;;table-layout: fixed;">
y><=

tr>

>
on" width=3D"100%" style=3D"table-layout: fixed;"><=

/tr>

e: 0; padding: 0; text-align: left; word-break: break-word;;padding-bottom:=

2px;">

font-weight: 400; font-size: 22px; line-height: 28px;color: #3c4043; text-d=

ecoration: none;" class=3D"primary-text" role=3D"presentation">
op=3D"name">Receipt 1037-256-NAZ delivery update available

>

ak: break-word;;padding-bottom:24px;">

ns-serif;font-style: normal; font-weight: 400; font-size: 14px; line-height=

: 20px; letter-spacing: 0.2px;color: #3c4043; text-decoration: none;" class=

=3D"primary-text" role=3D"presentation">Monday Mar 2 =

=E2=8B=85 9pm =E2=80=93 Tuesday Mar 3, 2026 =E2=8B=85 8:30pm (Pacific Time =

- Los Angeles)

: 0; text-align: left; word-break: break-word;;padding-bottom:24px;">

tyle=3D"font-family: Roboto, sans-serif;font-style: normal; font-weight: 40=

0; font-size: 14px; line-height: 20px; letter-spacing: 0.2px;color: #3c4043=

; text-decoration: none;" class=3D"primary-text" role=3D"presentation">
le border=3D"0" cellpadding=3D"0" cellspacing=3D"0" role=3D"presentation" s=

tyle=3D"padding-bottom: 4px;">


ont-size: 14px;color: #3c4043; text-decoration: none;font-weight: 700;-webk=

it-font-smoothing: antialiased;margin: 0; padding: 0;">Organizer


ak-word;;padding-bottom:24px;">

f;font-style: normal; font-weight: 400; font-size: 14px; line-height: 20px;=

letter-spacing: 0.2px;color: #3c4043; text-decoration: none;" class=3D"pri=

mary-text" role=3D"presentation">
spacing=3D"0" role=3D"presentation" style=3D"padding-bottom: 4px;">
=


coration: none;font-weight: 700;-webkit-font-smoothing: antialiased;margin:=

0; padding: 0;">Guests

(Guest list has been hidden a=

t organizer's request)

iv>

d>


--000000000000ad0dce064c0e7962--

Webroot phish from Google Gmail Part 3

Posted by Dave Yadallee on
font-face {

font-family: 'Google Sans';

font-style: normal;

font-weight: 700;

src: url(//fonts.gstatic.com/s/googlesans/v14/4UabrENHsxJlGDuGo1OIlLV154t=

zCwM.ttf) format('truetype');

}





=20



=20



=20



=20

















Webroot phish from Google Gmail Part 2

Posted by Dave Yadallee on
--000000000000ad0dce064c0e7962

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes

Content-Transfer-Encoding: base64



SU5WT0lDRSBXZWJyb290IFNlY3VyaXRpZXMgKDgwMyktMjAxIDIxMDYgQmlsbCBkYXRlOiAyMDI2

LTAzLTAzIE9yZGVyIE5vOiAgDQo5OC02NzQtMTM1MSBEZWFyIFVzZXIsIFRoaXMgbm90aWNlIHNl

cnZlcyBhcyBjb25maXJtYXRpb24gdGhhdCBVU0Q0ODcuMDAgIA0KaGFzIGJlZW4gY2hhcmdlZCBm

b3IgeW91ciBGaXZlIFllYXJzIEFjY2VzcyBQYWNrYWdlIHVuZGVyIHRoZSBXZWJyb290IFBDICAN

ClByb3RlY3Rpb24gUGxhbiwgaW4gYWNjb3JkYW5jZSB3aXRoIHlvdXIgc2VsZWN0ZWQgYmlsbGlu

ZyB0ZXJtcy4gSXRlbSAgDQpQcm9maWxlIENlbnRlciBRdWFudGl0eTogMSBEZXZpY2UgUHJvZHVj

dDogU2VjdXJlIFByb3RlY3Rpb24gUGx1cyAgDQpTdWJzY3JpcHRpb24gVGVybTogNS1ZZWFycyBC

aWxsaW5nIE1vZGU6IEF1dG8gRGViaXQgVG90YWwgQ2hhcmdlZDogJCA0NjYuMjIgIA0KRm9yIHF1

ZXN0aW9ucyBjb25jZXJuaW5nIHlvdXIgc2VydmljZSBhZ3JlZW1lbnQsIHBsZWFzZSBjb250YWN0

IG91ciBiaWxsaW5nICANCnN1cHBvcnQgYXQgMSA4MDMgMjAxLTIxMDYuIFVudGlsIHdlIGNvbm5l

Y3QgYWdhaW4sIFBoaWxpcCBTbWl0aCBXZWJyb290ICANClNlY3VyaXRpZXMsIGxsYyA0NjcxIEFp

cnBvcnQgQmx2ZCAjIEEgTWlhbWkgRmwgMzMxNDQtMjAyNyBVbml0ZWQgIA0KU3RhdGVzIC4gLiAu

IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g

LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu

IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g

LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu

IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g

LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu

IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuDQoNClJlY2VpcHQgMTAzNy0yNTYtTkFaIGRlbGl2ZXJ5

IHVwZGF0ZSBhdmFpbGFibGUNCk1vbmRheSBNYXIgMiDii4UgOXBtIOKAkyBUdWVzZGF5IE1hciAz

LCAyMDI2IOKLhSA4OjMwcG0NClBhY2lmaWMgVGltZSAtIExvcyBBbmdlbGVzDQoNCg0KDQpPcmdh

bml6ZXINCkNoYW50ZWxsZSBNb29yZQ0KcHJpbmNlZW1tYW51ZWxvY2hvbGkxQHdlYnJvb3R1cy5v

cmcNCg0K

--000000000000ad0dce064c0e7962

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable




schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-microsoft-com:office:offi=

ce">
t=3D"text/html; charset=3DUTF-8">
=3Ddevice-width,initial-scale=3D1">
ight dark">





















=20



=20



=20



=20