Web/SEO/App Spam from Microsoft Outlook Part 3

From: Seo Gibson

Sent: 22 January 2026 07:38

To: Seo Gibson

Subject: Re: Send



Hi,



I personally visited your website when I was browsing it.



In order to significantly improve these search results for you, I would lik=

e to send you an audit report of your website.



Can I Send you Quote=94 and Cost/=94?



Best regards



--_000_PN2P287MB2122B7042B4D65A6AC29F57DB562APN2P287MB2122INDP_

Content-Type: text/html; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable








252">








Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">

Hi,



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

 



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

I sent you an email a few days ago. I didn't get any response back from you=

.



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

 



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

May I send you over those price list.



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

 



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

Thank you!



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">









11pt; color: rgb(0, 0, 0);">

From: Seo Gibson <SeoGibsonExpert@outlook.com>


Sent: 22 January 2026 07:38


To: Seo Gibson <SeoGibsonExpert@outlook.com>


Subject: Re: Send


 





_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

Hi,



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">







_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

I personally visited your website when I was browsing it.



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">







_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

In order to significantly improve these search results for you, I would lik=

e to send you an audit report of your website.



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">







_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

Can I Send you Quote=94 and Cost/=94? 



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">







_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

Best regards








--_000_PN2P287MB2122B7042B4D65A6AC29F57DB562APN2P287MB2122INDP_--

Marriott pillows phish

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 10 Feb 2026 13:55:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vpuky-000000007Az-1t2r

for dave@doctor.nl2k.ab.ca;

Tue, 10 Feb 2026 13:54:48 -0700

Resent-From: The Doctor

Resent-Date: Tue, 10 Feb 2026 13:54:48 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [5.181.2.206] (port=51149 helo=aboveandbeyondmeta.xyz)

by doctor.nl2k.ab.ca with esmtp (Exim 4.98.2 (FreeBSD))

id 1vptnt-000000003mZ-47WZ

for doctor@nl2k.ab.ca;

Tue, 10 Feb 2026 12:53:48 -0700

DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=smtp; d=nl2k.ab.ca;

h=Date:To:From:Subject:Content-Type:Mime-Version; i=doctor@nl2k.ab.ca;

bh=MoF2iYD7llMRKvL+LegVm3wEgF0=;

b=JhHWNCkd/oMTBkrKAKZ9P2yrBEghS0ktaywwf6n6h10eOjinUFPP+TcRFhwVx9ptmpADBpc+ctP5

v0pkszztUJ/a5gk0eUHnU8HjgW8K1lXCx9wvu3hOnUBIdEZ0ut0hg/p8vfCjzrl5Azfdw/k9Ih3D

fq+kuMreLBYcEVdEVvQ=

DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=smtp; d=nl2k.ab.ca;

b=mzcdaQOBZPAoCO/DS+CPOY7WxFvXS+wVNCX2GKQ9u3dcCyjV8kPRFt9MzusCMEc7kAqFtk4knPhp

bRzs1Ps8J7PyWt12fJ2CSSJJ5eINmLeX1Z8mdqAq6vISf7EIP81YP1uegHzjYAUL56PwUWBwWEyG

gYwDFOrPHabUGO4cPQ8=;

Date: Tue, 10 Feb 2026 19:52:26 +0000

To: doctor@nl2k.ab.ca

From: Marriott Department

Subject: You have won Marriott Luxury Pillows 2-Piece Set

Content-Type: text/html

Mime-Version: 1.0

X-Spam_score: 11.5

X-Spam_score_int: 115

X-Spam_bar: +++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: doctor! Unsubscribe 115 E 23rd St New York, NY, US 10010



Content analysis details: (11.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.1 MISSING_MID Missing Message-Id: header

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[5.181.2.206 listed in will-spam-for-food.eu.org]

[5.181.2.206 listed in will-spam-for-food.eu.org]

[5.181.2.206 listed in will-spam-for-food.eu.org]

[5.181.2.206 listed in will-spam-for-food.eu.org]

[5.181.2.206 listed in will-spam-for-food.eu.org]

[5.181.2.206 listed in will-spam-for-food.eu.org]

[5.181.2.206 listed in will-spam-for-food.eu.org]

[5.181.2.206 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[5.181.2.206 listed in dnsbl.ahbl.org]

[5.181.2.206 listed in dnsbl.ahbl.org]

[5.181.2.206 listed in dnsbl.ahbl.org]

[5.181.2.206 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[5.181.2.206 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[5.181.2.206 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[5.181.2.206 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[5.181.2.206 listed in dnsbl.ahbl.org]

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

1.8 HTML_IMAGE_ONLY_08 BODY: HTML: images with 400-800 bytes of words

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.1 HTML_SHORT_LINK_IMG_1 HTML is very short with a linked image

0.4 TO_EQ_FM_DIRECT_MX To == From and direct-to-MX

0.0 T_STY_INVIS_DIRECT HTML hidden text + direct-to-MX

1.4 TO_EQ_FM_HTML_DIRECT To == From and HTML only, direct-to-MX

Subject: {SPAM?} You have won Marriott Luxury Pillows 2-Piece Set











doctor!




























Unsubscribe


115 E 23rd St New York, NY, US 10010











Web/SEO/App Spam from Microsoft Outlook Part 2



































In-Reply-To:



Accept-Language: en-IN, en-US

Content-Language: en-IN

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

msip_labels:

x-ms-exchange-messagesentrepresentingtype: 1

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: PN2P287MB2122:EE_|PN3P287MB1020:EE_

x-ms-office365-filtering-correlation-id: f8cf9980-ecd0-48ec-72a1-08de68d5a485

x-microsoft-antispam:

BCL:0;ARA:14566002|48001999003|37102599003|31061999003|20031999003|39105399006|7071999006|19110799012|15030799006|15080799012|8062599012|8060799015|461199028|39145399003|40105399003|41105399003|35041999009|3412199025|440099028|102099032|1710799026;

x-microsoft-antispam-message-info:

=?Windows-1252?Q?kt+L0414KGGtPLGVYotlG5m3v65fEH2sk2E/qx3sB2Eapc8ijb9enzT3?=

=?Windows-1252?Q?y9zglnywc6D+Zz8bdNWat5VSXINWhA7ptXbfbWgSG1ebq/VUPefU8xMi?=

=?Windows-1252?Q?wvVE5DctQ2kqSXRamZUyIQ5YRKGG+cIsTF89eWrK5/Lv+Mn28uhSxpL4?=

=?Windows-1252?Q?M6BwJCiiScpw7ILpHk0vUm3d3nKysI4mq7XFEV9CyHV2yJ6jBftT9/b9?=

=?Windows-1252?Q?5KY95Bz1RYNl9VfeV7Rrplkm3DWCRyF2M9RgYmK0HaPlHB4IvJcMyycL?=

=?Windows-1252?Q?+XmtNlCLANJYHeg+pV3ZaCbGuIPbf/YVYfU+m+MXPjIsBZcsmbLqlaZY?=

=?Windows-1252?Q?xB637EXmKzmi8rklpiatThpUMdlHxn93dTwoescPn90DE1QAM6fQnL82?=

=?Windows-1252?Q?aR2lSBYgXh0Pxm3un3s9kqas2vNi5M8VUiF4srL68AgPe2oz9//rA3gW?=

=?Windows-1252?Q?lilyH2M64GCHMAjiCWkklOcnmvWEAjbxG5A36YgcGfqK1wyJdbBwrVTO?=

=?Windows-1252?Q?egFBxvljAUPmaXG05/6vgvx2z6CF/Uz02Y9jN2s4AruGbgR4fmCiXPOs?=

=?Windows-1252?Q?/91lvygo0yXQycjGcPSYc8o+beA+ZhCvs3YFIVKhlUvq0Gj6XSl08yEK?=

=?Windows-1252?Q?ls1lCt0K9PfFC+lyxF9iRDqhXo62+GC3x6Xe2zKt6Q7QBbWXTe6z7V4I?=

=?Windows-1252?Q?hXfH6T8v8k/JJXBLc6pVSpeDn9Na95TFUVGhyO9Mk/+ZN9RyLocu5cDS?=

=?Windows-1252?Q?D1zGuU11Q2POXueHOshaaX5x+9PkfE5+h2j6A7D79+tmzWsyYYI5VnNl?=

=?Windows-1252?Q?GBc7GYXtiJLLI+5jMyct5XgFuLbJyytCU6F8KNjHuZJYoG8/yEbSgYbP?=

=?Windows-1252?Q?CTVYfIfZJtOWp8Oe5Gxo7lBxkleejRLGwPQjwHJ/KFDyVtV6OKNEAOxZ?=

=?Windows-1252?Q?QQK3zNEv/d7lw+72ZYbmsfPMSijTaLSidWkhedRIebirlH937vKqUvwS?=

=?Windows-1252?Q?8IlG+3DbhzhgOShymVTA/fsvsdo6YDljDirjWuVtvJVPYQG+ZoCRIxVh?=

=?Windows-1252?Q?OzNsBJQIIkkBscG/l4gS03VLky4PHypQKQ721bIFvlZTsg9oydCKlJ5J?=

=?Windows-1252?Q?57C3gcNi/u4/Kj7lwXz6Z9W4ujGY+UwyEiP6UdU6ezPC+Z8QpL+CTwxt?=

=?Windows-1252?Q?NysetE9TTVeUo/iVsrryiZv2gIVBSyZeHvSQgtH3a6y1DrbsuT8BDYAT?=

=?Windows-1252?Q?I8aV6Up5RuC/jmB8x+hYyGG1s2RVa69sUP4T08ozkCpQNK1CHVEaUhOy?=

=?Windows-1252?Q?ab6YesqFAvJhcck65jNlPUcEXuAppezoNTNiKTAyAukay3z76ZTBFXbq?=

=?Windows-1252?Q?TCYy69CCqW2h4GKZFkT8Z+sJ8RlP0RN7JbM4XFQA7AdeJL8vvRwBdS1j?=

=?Windows-1252?Q?UA7ikg7QXvb2T31I/y4p9GyJwu98AciF99lwsNz4SJZ/Hk6qZzuDVdgX?=

=?Windows-1252?Q?fjQpT7vRhUX9clHdO5tWWkoe8QpEzaptSJ6gGfd7rc1rE11O3zrB8uTp?=

=?Windows-1252?Q?gQvVP7CHMae1J12R?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?Windows-1252?Q?5eLrSS60U3r//39tEQ3+X9f51H6jnsQGXWzbLd7QdB/HjB+hxHnSW1g9?=

=?Windows-1252?Q?qouaICcsxPELeZcgWAsV5ZBPDwTWKHTus5KXs7NrnMZ/OJUm+qpJDvmA?=

=?Windows-1252?Q?8bM0InWDTJ2xPtj1xmAcLCYrgnsKkqNoWrleUBCrR2T+U4jeQyqokbkt?=

=?Windows-1252?Q?T4Nf0bZ93E6MBhmCVFQ4KJst5CameojJCp5oEQ06WwcRCEiw2bHkMSJ/?=

=?Windows-1252?Q?uzN4jbO92AOlVnQOo3N03e6T7bBxQRNP2hjLD00vxXEJ7Ugr+YkWvnTH?=

=?Windows-1252?Q?7yhqf6B3YURdBKnP+s5nC/jYQhYtskNDZ++dw47l6JHxFr3pm6agv8JU?=

=?Windows-1252?Q?xK4XLDX8fSSkn10XqMQJTNgOUiCOOMif6fXJ0/6lQbY21vB/B7Yhqfbm?=

=?Windows-1252?Q?BsfXiywkd6zuTxNzcwtvK44KIX5+4o2u+TlgpDvMAqBYiU3q7Q/xOOOt?=

=?Windows-1252?Q?dr3AL7PHCuLjWemSU2GHP3dy/0VjTWQMAehVHhBPeSOfq9yMFNPTFfnG?=

=?Windows-1252?Q?YuU/MX7JXrFLAQOxhN1zBD/k9+LlLrUMqhkW/CINxUX8Zn+mDpfo9Hfa?=

=?Windows-1252?Q?sPK/MV4C2Z7qWJ67qmMSg9HMcnOMUy4Aotl3BVaiQ0Z+8neK9VAe2JLl?=

=?Windows-1252?Q?EEx5AsgjPyrwVjyUXcEvcbN1pLlmL712NllprxliRJe8KjkJGu0TkkhM?=

=?Windows-1252?Q?eTeDipTGXiPJ+jHuEjAwXMPDelmL1HpKUPcv6EexPXVM3khCQ8VgWg42?=

=?Windows-1252?Q?cidvtqcxDXp64E03Xqo0tiZadtMYir3G3wJtaF5pBiF1njxB8Pm8nPb5?=

=?Windows-1252?Q?Z2fDODoFqix98/vboefnWfl7SDMNR91F72wGrX0Htukm6VO4yDiYTUxE?=

=?Windows-1252?Q?v8XtdgIxo3xedQRz7lYCQt4YQMh6dOhNpSLtIy6LKXpgpRNL1qc4zDo1?=

=?Windows-1252?Q?AsLRI5dEOLgDv9Llu127cF5FPWszNUFxtzoQi68Kk3orbaDH5Qu/aaic?=

=?Windows-1252?Q?O3lLZk4C/9IAXH4vew1vZa1KY4w9LKI6rSVI5/8qz9YrqYRIu54cXJ5/?=

=?Windows-1252?Q?c2mO/SA9k64idoeKQH3eT4NhXXhJbkwgTVow3lHPy1xrNDKDlwDlwFJF?=

=?Windows-1252?Q?qQk1S/BBG87UbIQI8IfKSmSvmSs15puqSrfYVAystjiLuP99gR34Jmhd?=

=?Windows-1252?Q?HYgq1S45ksJQU6OC1VwTpjCYnys/x2mmLFrx92lwyW0Pw5aq9IwBV107?=

=?Windows-1252?Q?kF0VxAgmTliPsq0PWThBjRdj8rgGtvQKQzoybRI1i8oUKnTzhMBQPI14?=

=?Windows-1252?Q?QRhqVI0sOI0GM9AE+gOc+tgueVvl73IDANki8yooJmYEa/Qq5NPW6YKz?=

=?Windows-1252?Q?VMf5CvV1aUmYDC6x54kho0scAo1Eom6cVMZGNnYz53acKEKdM0sFJ/bi?=

=?Windows-1252?Q?ctZ7ZApo40mhD8uSDY9TrLwqxJvIeus9bFiMSKNNwcZ9RFbUCDCAWMeY?=

=?Windows-1252?Q?gOr5C187igcXibim+jsrYa2OJiMG/Al8cwb5xc6AzS6YKjhfB5SIRptv?=

=?Windows-1252?Q?VsIEn7oQr83jar4I?=

Content-Type: multipart/alternative;

boundary="_000_PN2P287MB2122B7042B4D65A6AC29F57DB562APN2P287MB2122INDP_"

MIME-Version: 1.0

X-OriginatorOrg: outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: PN2P287MB2122.INDP287.PROD.OUTLOOK.COM

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: f8cf9980-ecd0-48ec-72a1-08de68d5a485

X-MS-Exchange-CrossTenant-originalarrivaltime: 10 Feb 2026 18:53:13.0433

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: PN3P287MB1020



--_000_PN2P287MB2122B7042B4D65A6AC29F57DB562APN2P287MB2122INDP_

Content-Type: text/plain; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable



Hi,



I sent you an email a few days ago. I didn't get any response back from you=

.



May I send you over those price list.



Thank you!

Web/SEO/App Spam from Microsoft Outlook Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 10 Feb 2026 12:00:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vpsxT-00000000B2p-0nHR

for dave@doctor.nl2k.ab.ca;

Tue, 10 Feb 2026 11:59:35 -0700

Resent-From: The Doctor

Resent-Date: Tue, 10 Feb 2026 11:59:35 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-centralindiaazolkn19011024.outbound.protection.outlook.com ([52.103.68.24]:8479 helo=PNZPR01CU001.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vpssg-00000000Ajx-3nbM

for root@nk.ca;

Tue, 10 Feb 2026 11:54:49 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=KKUWKCuFJcPw9T7BmQykTCiLIIe1EGESckJ02xAPnIpOPjCyFRAdEkYY6EvTvFYpGYQccqoEQy9tggqjhqCu7cvv93nzXi+1io21RyRyEL0yukiUja1kRrUY2Z1K+wGv5NmLauejmZBhvugLo2q6c/Ezgb+EJjCYJiCbc0ZmYqGqVcUVKGLSV+B/7Vlh7rFJsdcszU2KDRd1k/FHsauxkmZLfM9OBL30Q1UlgyuIbTTe8pE/wiAkJBU09UEYfiMU+p3iXWDFmDBUOL0A8YXk61DTmVExDwKXM4IfOFnk1XDR5T6iVF+J78eKGFcqynS8PHKySRBzIqcoHDBj07EkSQ==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=VY+HC4rmH0C2iRrhzJ9oc66mYgUTCMv9CMT63Awm1UM=;

b=MhHD2aNf0OzssNmkdcO5EmWv1qNgGo7pzHUialWUyTYa2uNPkuOPlTe/TTBrh25m8XOO5W7ezIRB9VQ5ioFIyAi3uLGkqvNCDe+NTR5SmsXoTocGO6U7PhaeDBow2Hyk/YF9/iNHK/Ul73e8ESZ/4bCVdum1Dh0EwrhQFgYDx7lyKu9fMgNQPBudD22ZyXtMDbNjU1MQNJ9Rw1ptFoBCfHLbpSQ2JoCsI1KrTb0S4HsLP9GhoOtHZn5/qi7V0MWZyctDV5MxBxDGUuPa79eubcGHr6tnsrYjIUNL2RGRE53GHIzx+QrNnoQ7bsMhdY6JftImNnp1op8nJ0jgcDMwFA==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=VY+HC4rmH0C2iRrhzJ9oc66mYgUTCMv9CMT63Awm1UM=;

b=EFRzAYU97xWt1xFEbZZxXwMie5TDcTdBl8BcCaKJOmWy9L/mth0sMLQyL6HZrGWeojA6X4+373+DduNW8QQN83ib+l2SY0GWVklp5BLXOj0CMacIgsFmYeaHsehu/cMT3eLSo9Pt+Q/ExZK7pDhB8RmFDicXGK8r2q0MwktAPcYDSK6/vhX06bxUPoX89tpPDbkUa1Z6ms/w3QCJgRUjbWIaF/1ns4FgTzqcQcIt0fI9PEi6AMliixFZgwBxY2DfVMPE9NKXwsMLpzaldek2toEsdGYYgyQPoQHryD7sil+9ijWQw6QH5ZNI2ij/YMzPNEz0NevtVGl4W96W5jMvUw==

Received: from PN2P287MB2122.INDP287.PROD.OUTLOOK.COM (2603:1096:c01:1ca::12)

by PN3P287MB1020.INDP287.PROD.OUTLOOK.COM (2603:1096:c01:17c::11) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9611.8; Tue, 10 Feb

2026 18:53:13 +0000

Received: from PN2P287MB2122.INDP287.PROD.OUTLOOK.COM

([fe80::2e32:8774:260b:8d4f]) by PN2P287MB2122.INDP287.PROD.OUTLOOK.COM

([fe80::2e32:8774:260b:8d4f%4]) with mapi id 15.20.9611.006; Tue, 10 Feb 2026

18:53:13 +0000

From: Seo Gibson

To: Seo Gibson

Subject: Re: Send

Thread-Topic: Send

Thread-Index: AQHcl5hiOqP4GoHhHkK6hz4H7cGugbV2Aa4igAGWeTCAAY3LToABlV0+gAGScis=

Date: Tue, 10 Feb 2026 18:53:13 +0000

Message-ID:



References:



























































































































Coinbased phish from Google Gmail Part 3






background-color: transparent; border-collapse: collapse; padding: 0;">














style=3D"vertical-align: middle; padding: 10px 0; text-align: left; =

font-family: Arial, sans-serif; font-size: 25px; color: #333333; padding: =

0px;">

Invoice

style=3D"vertical-align: middle; padding: 10px 0; text-align: right; =

padding: 0px;">



36px;">k
style=3D"color: rgb(41, 105, 176);">Pay

172, 210);">Pal

255);">s



background-color: transparent; border-collapse: collapse; padding: 0;">












style=3D"padding: 5px 0; font-family: Arial, sans-serif; font-size: 14px; =

color: #333333;">Invoice Number: RDS73XSE
Date =

of Issue:
February 10,2026



background-color: transparent; border-collapse: collapse; padding: 0px; =

margin-top: 10px; margin-left: calc(0%);">














Arial, sans-serif; font-size: 14px; color: #333333; vertical-align: top; =

text-align: left;">Stripe=


2660 Monterey Rd,
San Jose, CA =

95111

USA  


padding: 5px 0; font-family: Arial, sans-serif; font-size: 14px; color: =

#333333; vertical-align: top; text-align: left;">Billed =

to


PayPal Stripe User



background-color: transparent; border-collapse: collapse; padding: 0; =

margin-top: 20px;">












sans-serif; font-size: 18px; color: #333333; text-align: =

left;">$657.99 USD due February 10,2026



border-collapse: collapse; padding: 0; margin-top: 20px;">












style=3D"padding: 5px 0; font-family: Arial, sans-serif; font-size: 16px; =

color: #333333; text-align: left;">YOU'VE SENT A PAYMENT OF =

$657.99 USD  TO COINBASE
, Times, serif;">CORPORATION



background-color: transparent; border-collapse: collapse; padding: 0;">
















font-family: Arial, sans-serif; font-size: 12px; color: #333333; =

text-align: left;">It may take a few =

moments for this transaction to appear in your statement.
Issues=

with this transaction?

If you have any questions about your =

order, please contact us within 12 hr by calling at 

style=3D"font-size: 17px;">
201);">+1 859-913-0940
.=




collapse; font-family: Arial, sans-serif; font-size: 14px; color: #333333; =

margin-top: 20px;">


































#333; padding-bottom: 5px;">Description

style=3D"text-align: center; border-bottom: 1px solid #333; padding-bottom:=

5px;">Qty

border-bottom: 1px solid #333; padding-bottom: 5px;">Unit price

solid #333; padding-bottom: 5px;">Amount
Btc Purchased 1 $657.99 USD $657.99 USD



collapse; font-family: Arial, sans-serif; font-size: 14px; color: =

#333333;">






























10px 0; border-bottom: 1px solid #ccc;">Subtotal

solid #ccc;">$657.99 USD

10px 0; border-bottom: 1px solid #ccc;">Total

style=3D"text-align: right; border-bottom: 1px solid #ccc;">$657.99 =

USD

10px 0; border-bottom: 1px solid #ccc;">Amount due

solid #ccc;">$657.99 USD



border-collapse: collapse; font-family: Arial, sans-serif; font-size: 12px;=

color: #333333; margin-top: 20px;" class=3D"fr-table-selection-hover">


















style=3D"padding: 10px 0; text-align: left; font-size: 13px; font-weight: =

bold;">Don’t recognize this =

transaction? Contact PayPal+1 859-913-0940 

style=3D"font-weight: normal; font-size: 17px;">For =

dispute/claim

font-size: 11px; color: #666666;">
14px;">Copyright © 1999-2025 PayPal, Inc. All rights reserved. PayPal =

is located at 2660 Monterey Rd,San Jose, CA 95111.










----_NmP-31af29c271b0ab28-Part_1--

Coinbased phish from Google Gmail Part 2

----_NmP-31af29c271b0ab28-Part_1

Content-Type: text/plain; charset=utf-8

Content-Transfer-Encoding: 7bit















ppl



body

font-family: Arial, sans-serif;

background-color: #f9f6f4;

margin: 0;

padding: 0;





.header

max-width: 210mm;

margin: 10px auto;

background-color: #ffffff;

padding: 20px;

border-collapse: collapse;



















Invoice

kPayPals













Invoice Number: RDS73XSEDate of Issue: February 10,2026













Stripe2660 Monterey Rd,San Jose, CA 95111USA  

Billed toPayPal Stripe User













$657.99 USD due February 10,2026







----_NmP-31af29c271b0ab28-Part_1

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: quoted-printable




height:0px;max-width:0px;opacity:0;overflow:hidden;">Hey! Check this out...=

 ‌ ‌ ‌ ‌ ‌ ‌&nb=

sp;‌ ‌ ‌ ‌ ‌ ‌ =












content=3D"width=3Ddevice-width, initial-scale=3D1.0">

ppl



Coinbased phish from Google Gmail Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 10 Feb 2026 11:59:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vpswc-00000000B00-17Iz

for dave@doctor.nl2k.ab.ca;

Tue, 10 Feb 2026 11:58:42 -0700

Resent-From: The Doctor

Resent-Date: Tue, 10 Feb 2026 11:58:42 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pl1-f169.google.com ([209.85.214.169]:49583)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vprcl-000000004u3-2Kbq

for doctor@doctor.nl2k.ab.ca;

Tue, 10 Feb 2026 10:34:16 -0700

Received: by mail-pl1-f169.google.com with SMTP id d9443c01a7336-2aae146b604so18876165ad.3

for ; Tue, 10 Feb 2026 09:33:20 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=cmdsantofagasta.cl; s=google; t=1770744794; x=1771349594; darn=doctor.nl2k.ab.ca;

h=mime-version:date:message-id:subject:reply-to:to:list-unsubscribe

:precedence:from:from:to:cc:subject:date:message-id:reply-to;

bh=WwrL/nR67gQHoJwD+Xzu2TuzOuU5o05Jzh440394BXc=;

b=f+3QPdlnFaMuMq+JtysgiiXFmdsDKQMUJEOWdnEav9bEvyY4fm5HesVV/kJQ0YzKBs

YLM0f6qqaoSRbktHyLFTPCA6qsr8Ih62nkXk8UjloAPMVeJ+tjZ3SpGBp9WUqtJz8dQX

bWEFzg8BfUqC1bz5nlUkBdVQl7gPyearS3GrFMkGzaIY23npMvK1y79E84EM1+5v2SVs

wQpPq5ScQd12u5iMXIyA/rRs9uF0IYTmVMkwCerGnmTpVLlPCU60tHd/MHSGjXIg7Gfq

tNfHDIXlkfLwpPqNtjDYVTkQqeUzkmVKuaPbCs1HowJDuiz2EHD1+grE55vRnga+xiFJ

Rb0w==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1770744794; x=1771349594;

h=mime-version:date:message-id:subject:reply-to:to:list-unsubscribe

:precedence:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to;

bh=WwrL/nR67gQHoJwD+Xzu2TuzOuU5o05Jzh440394BXc=;

b=ppDzMlQAGlHwLK/GdA0ey98r8anOTBzRA2SHRPoMZGm2pwsXhHlGMAI+gMTMb2A09a

SSOUURjBDDCBLvsObacoWc/n7CtaomD37Wg6Vr0YfM3+XTFN4T8+Nb93o4d2akgQOyWf

et0EGIrEjkBgNrwkZ4Y1GsOn2d1seY6YMpfjRepORhQZBDkxcPreTmXpyxtBDM6wyEZv

FAc3qGbv5wyhaZrnNzv/f53I2Kl/SiuGvgDf6TF/kve/DGHrtlr9wERgecKnB++F3Lh/

iip6uW8GDbeF8NrtZEvXjmGWf7oeGGCdgNiQy/9JF7/qomsA2xy3GMa9cKJ8dtvwtJUK

C+1A==

X-Gm-Message-State: AOJu0YyCRRjlJB8l4v2F3UYfrl/UPraNHash/YFEc9UKb0u+elw5Awoe

2H8IY6gzzgCZmy/nG7tqAA+EyJQjUbGfoFliRT/C1sk333xUN1EDVaRrJNPGjosIEWZmnA+bIi0

GKgKq

X-Gm-Gg: AZuq6aIKo6F6iqB+mYrVZe4VztAe692pdUljXYq9yrAZmy4u3wERG9vNjeQB4YLyM/2

QKWYXG87wump/xJfrwh2k5rh6sLiyBEKovlRQZWWB9FTvq6Oz9I1FjPMiYuTBXmnyDR8y2U5LgU

QY2QEYvrE9ef7I0AFWs1Q/wbs6tJ4Q/UfA/JgElhji/QUBxllWITbmNzEaBkWTHag72y3gryUOt

bt4ZlG5E4kzdmFtOYe3xrBXN7SdM0egf/N/h7ESB1Aa4prGNhBIIj5mcotHvOpG6xrF6IYykoyV

1gF1xZoSrqxcxIuzj1yfVSuf1j89suG+dfyBNCoHaw7g53oDZjrY30itoFuZj8qIwWKrkqidXZv

PWB4FPAs4anzUTRFK0jE8K+f/tbLB3IZ1eIUMGGQxNW7uZaUSnz3lIYItSYCezB4JHIokImfxA8

Va2ljvw3akEQPV5g4uWdk3eOu9ePZYX6isAANHm2R1Avh/Kmcv+LgH

X-Received: by 2002:a17:902:e547:b0:2aa:d600:d03e with SMTP id d9443c01a7336-2ab105899c7mr35329345ad.18.1770744794239;

Tue, 10 Feb 2026 09:33:14 -0800 (PST)

Received: from [127.0.0.1] ([59.153.16.175])

by smtp.gmail.com with ESMTPSA id d9443c01a7336-2a9521f8cb6sm150405295ad.79.2026.02.10.09.33.12

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Tue, 10 Feb 2026 09:33:13 -0800 (PST)

From: Invoice PayPal

X-Google-Original-From: Invoice PayPal

X-Entity-ID: 1770744813792

Precedence: bulk

List-Unsubscribe:



X-Mailer: ThreadMailer v2 (Thread 24)

To: doctor@doctor.nl2k.ab.ca

Reply-To: Jasmine.Mills@cmdsantofagasta.cl

Subject: Good news! Your code G4S6ND is ready.

Message-ID: <2d8f8b5b-0043-f1a3-8d59-546a1805ee10@cmdsantofagasta.cl>

Date: Tue, 10 Feb 2026 17:33:09 +0000

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="--_NmP-31af29c271b0ab28-Part_1"

X-Spam_score: 13.1

X-Spam_score_int: 131

X-Spam_bar: +++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: ppl body font-family: Arial, sans-serif; background-color:

#f9f6f4; margin: 0; padding: 0;



Content analysis details: (13.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[59.153.16.175 listed in will-spam-for-food.eu.org]

[59.153.16.175 listed in will-spam-for-food.eu.org]

[59.153.16.175 listed in will-spam-for-food.eu.org]

[59.153.16.175 listed in will-spam-for-food.eu.org]

[59.153.16.175 listed in will-spam-for-food.eu.org]

[59.153.16.175 listed in will-spam-for-food.eu.org]

[59.153.16.175 listed in will-spam-for-food.eu.org]

[59.153.16.175 listed in will-spam-for-food.eu.org]

[209.85.214.169 listed in will-spam-for-food.eu.org]

[209.85.214.169 listed in will-spam-for-food.eu.org]

[209.85.214.169 listed in will-spam-for-food.eu.org]

[209.85.214.169 listed in will-spam-for-food.eu.org]

[209.85.214.169 listed in will-spam-for-food.eu.org]

[209.85.214.169 listed in will-spam-for-food.eu.org]

[209.85.214.169 listed in will-spam-for-food.eu.org]

[209.85.214.169 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.214.169 listed in dnsbl.ahbl.org]

[209.85.214.169 listed in dnsbl.ahbl.org]

[209.85.214.169 listed in dnsbl.ahbl.org]

[209.85.214.169 listed in dnsbl.ahbl.org]

[59.153.16.175 listed in dnsbl.ahbl.org]

[59.153.16.175 listed in dnsbl.ahbl.org]

[59.153.16.175 listed in dnsbl.ahbl.org]

[59.153.16.175 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.214.169 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.214.169 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.214.169 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.214.169 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.214.169 listed in list.dnswl.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[59.153.16.175 listed in sbl-xbl.spamhaus.org]

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Listed by XBL, see ]

-0.0 SPF_PASS SPF: sender matches SPF record

0.6 J_CHICKENPOX_23 BODY: 2alpha-pock-3alpha

2.5 TVD_DOLLARS_US BODY: No description available.

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.214.169 listed in wl.mailspike.net]

0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to

background

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 NO_RDNS2 Sending MTA has no reverse DNS

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

Subject: {SPAM?} Good news! Your code G4S6ND is ready.

Geek squad phish from Google Gmail Part 3



=20



=20



=20



=20



Geek squad phish from Google Gmail Part 4














/InformAction">
emtype=3D"http://schema.org/EmailMessage">
ntent=3D"Gwendolyn Scheidemantel: Dear Member, Transaction update details s=

tored"/>

a.org/Event">
entScheduled"/>
hema.org/Organization">
>

G3UKwjMmfh2w"/>
ine-height: 1px; height: 0; max-height: 0; width: 0; max-width: 0; opacity:=

0; overflow: hidden;" itemprop=3D"name">Dear Member, Transaction update de=

tails stored

spacing=3D"0" role=3D"presentation" align=3D"center" style=3D"width:100%;" =

class=3D"body-container">

">
 

"0" cellspacing=3D"0" role=3D"presentation" align=3D"center" style=3D"width=

:100%;" class=3D"">
>

n itemscope itemtype=3D"http://schema.org/EmailMessage">


ription">Dear Member, Transaction update details stored


le=3D"presentation" align=3D"center" style=3D"width:100%;" class=3D"">
y>

: rtl; font-size: 0; padding: 24px 32px; text-align: left; vertical-align: =

top;" class=3D"main-container-inner"><=

div class=3D"" style=3D"font-size: 13px; text-align: left; direction: ltr; =

display: inline-block; vertical-align: top; width: 100%;overflow: hidden; w=

ord-wrap: break-word;">
"0" role=3D"presentation" width=3D"100%" class=3D"main-column-table-ltr" st=

yle=3D"padding-right: 32px; padding-left: 0;;table-layout: fixed;"><=

tr><=

/tr>=


d style=3D"font-size: 0; padding: 0; text-align: left; word-break: break-wo=

rd;;padding-bottom:24px;">

t-style: normal; font-weight: 400; font-size: 14px; line-height: 20px; lett=

er-spacing: 0.2px;color: #3c4043; text-decoration: none;" class=3D"primary-=

text" role=3D"presentation">

able border=3D"0" cellpadding=3D"0" cellspacing=3D"0" role=3D"presentation"=

width=3D"100%" style=3D"table-layout: fixed;">

0; padding: 0; text-align: left; word-break: break-word;;padding-bottom:2px=

;">

t-weight: 400; font-size: 22px; line-height: 28px;color: #3c4043; text-deco=

ration: none;" class=3D"primary-text" role=3D"presentation">
=3D"name">Dear Member, Transaction update details stored

: break-word;;padding-bottom:24px;">

-serif;font-style: normal; font-weight: 400; font-size: 14px; line-height: =

20px; letter-spacing: 0.2px;color: #3c4043; text-decoration: none;" class=

=3D"primary-text" role=3D"presentation">Tuesday Feb 10,=

2026 =E2=8B=85 9:29pm (Eastern Time - New York)

word;;padding-bottom:24px;">

ont-style: normal; font-weight: 400; font-size: 14px; line-height: 20px; le=

tter-spacing: 0.2px;color: #3c4043; text-decoration: none;" class=3D"primar=

y-text" role=3D"presentation">

GeekSquad Transaction Date: Tue=

sday, 10 February 2026
Transaction No: RX40933BSX0278
Custome=

r Support Call
: 1(859) 312-3507

Me=

mbership updated for continued access

Dear Member
trong>,

Your membership renewal is queued for processing today with a=

charge of USD446.33.

Order Summary Screen
- Quan=

tity: 3x
- Product: Premium Core Plan
- Warranty Coverage: 48 Months<=

br>- Payment Status: Auto Debit
- Paid Amount: USD446.33
- Client ID:=

XL2LU5EP0X
- Activation Code: cea4ad18-caae-47e9-be09-2ba0827eefdb

<=

p>Auto-renewal applies annually unless cancelled at least 48 hours before r=

enewal.

For assistance, reach 1(859) 312-3507.

<=

p>Much appreciated,,
Geek Squad By Best Buy
Accounts head: James Mark=

eting
Assistance Phone Line: (865) 201-3278
Billing=

Team: 5701 El Camino Real Baytown Tx 77522 USA
Service Availability: 6 =

AM =E2=80=93 6 PM


"GeekSquad Transaction Date: Tuesday, 10 February 2026Transaction No: RX409=

33BSX0278Customer Support Call: 1(859) 312-3507Membership updated for cont=

inued accessDear Member,Your membership renewal is queued for processing to=

day with a charge of USD446.33.Order Summary Screen- Quantity: 3x- Product:=

Premium Core Plan- Warranty Coverage: 48 Months- Payment Status: Auto Debi=

t- Paid Amount: USD446.33- Client ID: XL2LU5EP0X- Activation Code: cea4ad18=

-caae-47e9-be09-2ba0827eefdbAuto-renewal applies annually unless cancelled =

at least 48 hours before renewal.For assistance, reach 1(859) 312-3507.Muc=

h appreciated,,Geek Squad By Best BuyAccounts head: James MarketingAssistan=

ce Phone Line: (865) 201-3278Billing Team: 5701 El Camino Real Baytown Tx =

77522 USAService Availability: 6 AM =E2=80=93 6 PM"/>

ng=3D"0" role=3D"presentation" style=3D"padding-bottom: 4px;">


lass=3D"primary-text" style=3D"font-size: 14px;color: #3c4043; text-decorat=

ion: none;font-weight: 700;-webkit-font-smoothing: antialiased;margin: 0; p=

adding: 0;">Guests

(Guest list has been hidden at org=

anizer's request)

--[if mso | IE]>
r>

--00000000000003649d064a783fe8--

Geek squad phish from Google Gmail Part 2

















Geek squad phish from Google Gmail Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 10 Feb 2026 07:39:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vposm-00000000EBn-01ep

for dave@doctor.nl2k.ab.ca;

Tue, 10 Feb 2026 07:38:28 -0700

Resent-From: The Doctor

Resent-Date: Tue, 10 Feb 2026 07:38:27 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-oo1-f73.google.com ([209.85.161.73]:60622)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vpnow-00000000GSM-1tPG

for doctor@nl2k.ab.ca;

Tue, 10 Feb 2026 06:30:35 -0700

Received: by mail-oo1-f73.google.com with SMTP id 006d021491bc7-6630d58662aso4212892eaf.0

for ; Tue, 10 Feb 2026 05:29:39 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=google.com; s=20230601; t=1770730174; x=1771334974; darn=nl2k.ab.ca;

h=from:subject:date:message-id:sender:reply-to:mime-version:from:to

:cc:subject:date:message-id:reply-to;

bh=Qiiky1y0c8XrupOV098o4Otkydwoq1ZNgKokRgJYRz8=;

b=Z4DnPWYw+4Vh1/jyuy8yRydob1IvhE3YDqwTIRp6pvpceI96jO8FCQ+gYjKw625pcs

vk9oyA2TeqswOEt0OQesnxj/VW1E2N/xOhVZHeNTseZsOwTNf7DAqcjVXx/E+7uFygEj

9w+ANXi8PgUPZM7dnI9rUNXbyclzxHTP0Yj/UmMkehXp56cM5lBMr1QkJO7gA9yXzJL8

Ekx9V60pKzIqWkSpmu8qYfq8/VLC7uhf/YZXDvp6bqt1jYEJD9nNCsnyNVSmJAmvhNGB

ViPgBhlwlFRAF8wWshmyLz1NxAzvtuZXJ/Sktcs+iRhxYUbl9GHBngHW+1KdPgyy+XEJ

4pIg==

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=userttcj-org.20230601.gappssmtp.com; s=20230601; t=1770730174; x=1771334974; darn=nl2k.ab.ca;

h=from:subject:date:message-id:sender:reply-to:mime-version:from:to

:cc:subject:date:message-id:reply-to;

bh=Qiiky1y0c8XrupOV098o4Otkydwoq1ZNgKokRgJYRz8=;

b=kf5DwD2klIKlN+NRjKA74UOomQ4mLLveL0D30P7esN1DqrwEjs+rk6yttjh2TXCADj

GQORafT2au34voD1Kb7eBZljbjOY+eYQxNZlPla12h9ky+AL1drWZEVEG1eA4BwnDDIp

ps5C1tTdqGKpBfU2vQ1h2bSnRi4epvTwP4460eUhiBTj/mYk9egIHFexgWwCHo1sRtD9

fe43QyNUy3UE9kib0jf7+2lsjtJxlZVR3Cwy8c7Ab1VFjanVQRPiI43vd/vohz5/oYsK

NafeI/3ZREPtHEzj2tuubVvDYdMnlR5Sv6pesPZirlhGTO7yW4+too2l26K78TtbKc8c

hyMA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1770730174; x=1771334974;

h=from:subject:date:message-id:sender:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=Qiiky1y0c8XrupOV098o4Otkydwoq1ZNgKokRgJYRz8=;

b=V1A6U/+S9EVfK5N2BW2oKUPliElx3CAQLK6m12CSD9aN/hQN/ES6ZnmIRgj9/Ry5Xx

7vUbIvTrs6MZ8PrBOjleZ0XZ11YYG/HZ4lXSDQS1MydzeHhxkYmZx2GmZKozHk7ToaMx

nH3MmUapuhkVZg2vnopCZGf04P0ouqhqbfCAsg6gxRuSxVaCkfKjA1Fu9mpiR3Au4Kns

mwT3kYHWb+N4/enW8EGl7WwVdYIQbTc1F3CJG/UWHx5rpIJwCDKeVAFdTh0QI0Ya9jEX

dW4Ofc/AV9XN8yxzjDLSU5noH6GKF8TV2uobc+sizbLULB236ABLZzB/0rmVPWHNGXds

3Ysw==

X-Forwarded-Encrypted: i=1; AJvYcCUIVIktINiFU/zj0cytpXn0XeKgqX7QzH8ynDnXxvB4ru4t1M+/nAKEF7aCt9UWNTjZ59wicAo=@nl2k.ab.ca

X-Gm-Message-State: AOJu0YzP2T0BRF/64LDswow2uwnf5bLNsnfhubZZ+UPyrc6DmhHfnsRZ

4k1ul0wToNeVqXulFa4/xHGQpPhMkwNwGLzI+y2NW8Yxj+TKBOknYto9T7mOe6XP3W7F0+IpBn9

8Nt/vVp8T7lNDi47shIowI1riUTbpQLL2qYwPvffs3caB2g==

MIME-Version: 1.0

X-Received: by 2002:a05:6820:3088:b0:66a:1886:e4d8 with SMTP id

006d021491bc7-66d0c285b04mt8155759eaf.56.1770730173785; Tue, 10 Feb 2026

05:29:33 -0800 (PST)

Reply-To: Gwendolyn Scheidemantel

Sender: Google Calendar

Message-ID:

Date: Tue, 10 Feb 2026 13:29:33 +0000

Subject: Dear Member, Transaction update details stored

From: Gwendolyn Scheidemantel

Content-Type: multipart/alternative; boundary="00000000000003649d064a783fe8"

X-Spam_score: 18.5

X-Spam_score_int: 185

X-Spam_bar: ++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear Member, Transaction update details stored Dear Member,

Transaction update details stored Tuesday Feb 10, 2026 â‹… 9:29pm Eastern

Time - New York GeekSquad Transaction Date: Tuesday, 10 February 2026Transaction

No: RX40933BSX0278Customer Support Call: 1(859) 312-3507Membership updated

for continued accessDear Member,Your membership renewal is q [...]



Content analysis details: (18.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.161.73 listed in list.dnswl.org]

2.7 RCVD_IN_PSBL RBL: Received via a relay in PSBL

[209.85.161.73 listed in psbl.surriel.com]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.161.73 listed in will-spam-for-food.eu.org]

[209.85.161.73 listed in will-spam-for-food.eu.org]

[209.85.161.73 listed in will-spam-for-food.eu.org]

[209.85.161.73 listed in will-spam-for-food.eu.org]

[209.85.161.73 listed in will-spam-for-food.eu.org]

[209.85.161.73 listed in will-spam-for-food.eu.org]

[209.85.161.73 listed in will-spam-for-food.eu.org]

[209.85.161.73 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.161.73 listed in dnsbl.ahbl.org]

[209.85.161.73 listed in dnsbl.ahbl.org]

[209.85.161.73 listed in dnsbl.ahbl.org]

[209.85.161.73 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.161.73 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.161.73 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.161.73 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.161.73 listed in dnsbl.ahbl.org]

1.2 MISSING_HEADERS Missing To: header

0.6 J_CHICKENPOX_64 BODY: 6alpha-pock-4alpha

0.1 TW_FD BODY: Odd Letter Triples with FD

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.161.73 listed in wl.mailspike.net]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.9 REPLYTO_WITHOUT_TO_CC No description available.

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.0 LOTS_OF_MONEY Huge... sums of money

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.5 VOWEL_FROM_5 Impronouncable from header (6 consecutive vowels)

1.5 IMPRONONCABLE_2 Too much mixed numbers and lower-case letters

3.0 LONG_INVISIBLE_TEXT Long block of hidden text - bayes poison?

Subject: {SPAM?} Dear Member, Transaction update details stored



--00000000000003649d064a783fe8

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes

Content-Transfer-Encoding: base64



RGVhciBNZW1iZXIsIFRyYW5zYWN0aW9uIHVwZGF0ZSBkZXRhaWxzIHN0b3JlZA0KDQpEZWFyIE1l

bWJlciwgVHJhbnNhY3Rpb24gdXBkYXRlIGRldGFpbHMgc3RvcmVkDQpUdWVzZGF5IEZlYiAxMCwg

MjAyNiDii4UgOToyOXBtDQpFYXN0ZXJuIFRpbWUgLSBOZXcgWW9yaw0KDQoNCg0KR2Vla1NxdWFk

IFRyYW5zYWN0aW9uIERhdGU6IFR1ZXNkYXksIDEwIEZlYnJ1YXJ5IDIwMjZUcmFuc2FjdGlvbiBO

bzogIA0KUlg0MDkzM0JTWDAyNzhDdXN0b21lciBTdXBwb3J0IENhbGw6IDEoODU5KSAgMzEyLTM1

MDdNZW1iZXJzaGlwIHVwZGF0ZWQgZm9yICANCmNvbnRpbnVlZCBhY2Nlc3NEZWFyIE1lbWJlcixZ

b3VyIG1lbWJlcnNoaXAgcmVuZXdhbCBpcyBxdWV1ZWQgZm9yICANCnByb2Nlc3NpbmcgdG9kYXkg

d2l0aCBhIGNoYXJnZSBvZiBVU0Q0NDYuMzMuT3JkZXIgU3VtbWFyeSBTY3JlZW4tIFF1YW50aXR5

OiAgDQozeC0gUHJvZHVjdDogUHJlbWl1bSBDb3JlIFBsYW4tIFdhcnJhbnR5IENvdmVyYWdlOiA0

OCBNb250aHMtIFBheW1lbnQgIA0KU3RhdHVzOiBBdXRvIERlYml0LSBQYWlkIEFtb3VudDogVVNE

NDQ2LjMzLSBDbGllbnQgSUQ6IFhMMkxVNUVQMFgtICANCkFjdGl2YXRpb24gQ29kZTogY2VhNGFk

MTgtY2FhZS00N2U5LWJlMDktMmJhMDgyN2VlZmRiQXV0by1yZW5ld2FsIGFwcGxpZXMgIA0KYW5u

dWFsbHkgdW5sZXNzIGNhbmNlbGxlZCBhdCBsZWFzdCA0OCBob3VycyBiZWZvcmUgcmVuZXdhbC5G

b3IgYXNzaXN0YW5jZSwgIA0KcmVhY2ggMSg4NTkpICAzMTItMzUwNy5NdWNoIGFwcHJlY2lhdGVk

LCxHZWVrIFNxdWFkIEJ5IEJlc3QgQnV5QWNjb3VudHMgIA0KaGVhZDogSmFtZXMgTWFya2V0aW5n

QXNzaXN0YW5jZSBQaG9uZSBMaW5lOiAoODY1KSAgMjAxLTMyNzhCaWxsaW5nIFRlYW06ICANCjU3

MDEgRWwgQ2FtaW5vIFJlYWwgQmF5dG93biBUeCA3NzUyMiBVU0FTZXJ2aWNlIEF2YWlsYWJpbGl0

eTogNiBBTSDigJMgNiBQTQ0KDQpPcmdhbml6ZXINCkd3ZW5kb2x5biBTY2hlaWRlbWFudGVsDQpr

YW5haXRoYWt1cjEyMTNAdXNlcnR0Y2oub3JnDQoNCkd1ZXN0cw0KKEd1ZXN0IGxpc3QgaGFzIGJl

ZW4gaGlkZGVuIGF0IG9yZ2FuaXplcidzIHJlcXVlc3QpDQoNCg==

--00000000000003649d064a783fe8

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable




schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-microsoft-com:office:offi=

ce">
t=3D"text/html; charset=3DUTF-8">
=3Ddevice-width,initial-scale=3D1">
ight dark">

Intelcom Phish

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 10 Feb 2026 07:39:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vposa-00000000EBA-30ui

for dave@doctor.nl2k.ab.ca;

Tue, 10 Feb 2026 07:38:16 -0700

Resent-From: The Doctor

Resent-Date: Tue, 10 Feb 2026 07:38:16 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from 6017177.cicinsurancegroup.com ([162.215.13.43]:50872)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vpndz-00000000FwI-0BNo

for sales@nk.ca;

Tue, 10 Feb 2026 06:19:19 -0700

Received: from careers by 6017177.cicinsurancegroup.com with local (Exim 4.99.1)

(envelope-from )

id 1vpnd9-000000003Jc-43T7

for sales@nk.ca;

Tue, 10 Feb 2026 16:18:16 +0300

Date: Tue, 10 Feb 2026 13:18:15 +0000

To: sales@nk.ca

From: Intelcom

Subject: Important: Your Package Requires Customs Clearance - 2.96 CAD Due

Message-ID:

List-Unsubscribe: mailto:bounce457-P1rm3XYbdw1zXle@intelcom.com?subject=list-unsubscribe

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="1f8f7e104b421c01f99087fa2972164bc"

Content-Transfer-Encoding: 8bit

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - 6017177.cicinsurancegroup.com

X-AntiAbuse: Original Domain - nk.ca

X-AntiAbuse: Originator/Caller UID/GID - [1018 981] / [47 12]

X-AntiAbuse: Sender Address Domain - 6017177.cicinsurancegroup.com

X-Get-Message-Sender-Via: 6017177.cicinsurancegroup.com: authenticated_id: careers/only user confirmed/virtual account not confirmed

X-Authenticated-Sender: 6017177.cicinsurancegroup.com: careers

X-Source:

X-Source-Args: php-fpm: pool careers_cicinsurancegroup_com

X-Source-Dir: careers.cicinsurancegroup.com:/public_html

X-Spam_score: 5.7

X-Spam_score_int: 57

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Intelcom - Customs Notification Action Required: Customs

Clearance



Content analysis details: (5.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[162.215.13.43 listed in will-spam-for-food.eu.org]

[162.215.13.43 listed in will-spam-for-food.eu.org]

[162.215.13.43 listed in will-spam-for-food.eu.org]

[162.215.13.43 listed in will-spam-for-food.eu.org]

[162.215.13.43 listed in will-spam-for-food.eu.org]

[162.215.13.43 listed in will-spam-for-food.eu.org]

[162.215.13.43 listed in will-spam-for-food.eu.org]

[162.215.13.43 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[162.215.13.43 listed in dnsbl.ahbl.org]

[162.215.13.43 listed in dnsbl.ahbl.org]

[162.215.13.43 listed in dnsbl.ahbl.org]

[162.215.13.43 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[162.215.13.43 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[162.215.13.43 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[162.215.13.43 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[162.215.13.43 listed in dnsbl.ahbl.org]

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.7 HTML_IMAGE_ONLY_20 BODY: HTML: images with 1600-2000 bytes of words

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_REMOTE_IMAGE Message contains an external image

Subject: {SPAM?} Important: Your Package Requires Customs Clearance - 2.96 CAD Due



This is a multi-part message in MIME format.



--1f8f7e104b421c01f99087fa2972164bc

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit







Intelcom - Customs Notification



























Action Required: Customs Clearance



Dear Customer,



Your international shipment (Tracking #INTL7845923) has arrived and requires customs clearance documentation to proceed.



Access Customs Portal



Please complete within 48 hours to avoid delays.

For assistance, contact: 1-888-744-1155









Intelcom Logistics Inc. • 1-888-744-1155

© 2024 Intelcom. All rights reserved.























--1f8f7e104b421c01f99087fa2972164bc

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: 8bit







Intelcom - Customs Notification











































Intelcom


Action Required: Customs Clearance





Dear Customer,





Your international shipment (Tracking #INTL7845923) has arrived and requires customs clearance documentation to proceed.









Please complete within 48 hours to avoid delays.


For assistance, contact: 1-888-744-1155





Intelcom Logistics Inc. • 1-888-744-1155


© 2024 Intelcom. All rights reserved.

















--1f8f7e104b421c01f99087fa2972164bc--

Web/SEO/App Spam from Google Gmail Part 2

--000000000000636c65064a77f66c

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Good day,



To assist you further, I can send you a Proposal, Package & price list.

Just let me know if you'd like to receive it.



Best Regards,

Logan

Business Development Executive





On Wed, Jan 7, 2026 at 6:25=E2=80=AFPM wrote:



> Hi, sales@nk.ca

>

> Sending my sincere hopes for your amazing success.

>

> Before I send anything further, just wanted to check.

>

> We support campaign execution across SEO, PPC, SMM, AEO & GEO =E2=80=94 d=

esigned

> to help teams scale smoothly.

>

> If reviewing pricing makes sense, I can send it right away.

>

> Best regards,

> Logan

> Business Development Executive

>



--000000000000636c65064a77f66c

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable





=3D"gmail_signature" data-smartmail=3D"gmail_signature">

>Good day,





To assist you further, I

can send you a Proposal, Package & price list. Just let me know if

you'd like to receive it.





Best Regards,


Logan


Business Development Executive




s=3D"gmail_quote gmail_quote_container">

r">On Wed, Jan 7, 2026 at 6:25=E2=80=AFPM <
gy@gmail.com">loganwatsdvgy@gmail.com
> wrote:

lass=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px soli=

d rgb(204,204,204);padding-left:1ex">Hi,
get=3D"_blank">sales@nk.ca


Sending my sincere hopes for your ama=

zing success.

Before I send anything further, just wanted to check.<=

br>
We support campaign execution across SEO, PPC, SMM, AEO & GEO =

=E2=80=94 designed to help teams scale smoothly.

If reviewing pricin=

g makes sense, I can send it right away.

Best regards,
Logan
B=

usiness Development Executive




--000000000000636c65064a77f66c--

Web/SEO/App Spam from Google Gmail Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 10 Feb 2026 07:39:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vposT-00000000EAV-0o0e

for dave@doctor.nl2k.ab.ca;

Tue, 10 Feb 2026 07:38:09 -0700

Resent-From: The Doctor

Resent-Date: Tue, 10 Feb 2026 07:38:09 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pl1-f178.google.com ([209.85.214.178]:42318)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vpnVJ-00000000FQK-05BQ

for sales@nk.ca;

Tue, 10 Feb 2026 06:10:18 -0700

Received: by mail-pl1-f178.google.com with SMTP id d9443c01a7336-2aaecf9c325so14268295ad.1

for ; Tue, 10 Feb 2026 05:09:22 -0800 (PST)

ARC-Seal: i=1; a=rsa-sha256; t=1770728956; cv=none;

d=google.com; s=arc-20240605;

b=drrQHZOrKt37KtjycZ58XBxW9Qn1dEMFTZpAQ34PXWyFCgwxbPfAq75gCuhLwIKsJP

VdrNGOzKM2S4rx96Hic7m4Lz7+0XHfn2VwnfBhoQEGKY0f/tUsXW9mRy8GAZGG/+3IIL

VItySo800fqc4qKi6UgwcSTkoZxshMVXdGXK8Xd0SiYxGo1rVMpmNhWpF6Z/mc68kyDh

h9Tkam76sRoc5nJBAdFhSBTVKvWwPpVS89T6R5Tj8TrUpQlqOMynBx2apEgyVT1bGZCC

nD2CAN5g2equHfGRFqlCro03VIA/zkEoax5H37HJYHiF6mIU7N0w+MrCdsxiOMb6Ib52

pjjA==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;

h=to:subject:message-id:date:from:in-reply-to:references:mime-version

:dkim-signature;

bh=SPTTPUY5wifMhdMyl0qbK/l44i3ZxSU0s1mw1FSbgL4=;

fh=C4vsnDG7cTH8aa/8f7sygxKSfblX4MPDg6mph8A3jUw=;

b=JY0dKdhGzV6Fy6Zv7EZRIpusg/k/cOXWC4Vy0kkXL5xDAjx/Efw2Xgv6sYEUiaFyvU

TAGv+mMhUaAZO2TrYbaH6KvZTLT2hiYRHoa8elFUkdrOTDA83WQOzPdc49IxmKG3bNaf

yldHOxuwCTrz6aP9uVCmjaz200/JlGfbTSwcx2Z0whoIBEVNmIRUC15NYWGZZN+BZ8KZ

/AV4tFHaUhm8Fnl3naZqbfU8C4IRuLVU5lLohQUYFV+M7couXRiVmVZOgnwBZd8ZJD5L

DHcb7gtIEwnvDL/SbYZ6BybylB/Vidt9ojFm6/qy30dQaaaI4807flE/z0a33+ZH54eM

P+Ag==;

darn=nk.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20230601; t=1770728956; x=1771333756; darn=nk.ca;

h=to:subject:message-id:date:from:in-reply-to:references:mime-version

:from:to:cc:subject:date:message-id:reply-to;

bh=SPTTPUY5wifMhdMyl0qbK/l44i3ZxSU0s1mw1FSbgL4=;

b=dtfZihHbL1HxInBWfbUi68/5ZcOsn/Zkt0/7Hk6dLgjr/ZwiV3uZFbo5Zkpq+iPAI5

+3oFrF3hGU7/2ETLAaGIP9OzWQ7XQwtBmSn1otMYtW/RgLsVAaZI0JdSikkcsoPm8FxY

RkI4s6J0hAmDg11/h7fSbnXWdDQZgqZjz+hflRHuwxhunuIiKR8H2f3GCFdwNMoHJ5pT

kGKmIuqDP5OBBCI0+7R4iVPTBOOqYm9j9hLsA0VkakXcEKaVUWCHFy5oXOkfROXY21ye

9IJMXTP0VA3iCj776oYWZJiQqSCmYHum26Oq9+Gy4DMK1tsUegFEPySnvIQPoQEHH3iI

nOdg==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1770728956; x=1771333756;

h=to:subject:message-id:date:from:in-reply-to:references:mime-version

:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id

:reply-to;

bh=SPTTPUY5wifMhdMyl0qbK/l44i3ZxSU0s1mw1FSbgL4=;

b=VEG/FiwuFmpxaOTNnhkTVCVlTDQbWvWND7EiEoBTTyzxgsSeeWeaShjBmTh8Z45WMa

IjynBoPR3DoyNPe2e+P417RtlNEyO6/clhVN1d5OU8f4eZ/l7yykw6u+AEzo0SGZ/pct

owDQrXkRWUGW55L8XjNAQhFXrN0tQJCCe3GUHl2xJzIdXHIS9mHu/K/xTYlqfSIirRVT

TGi9+tTl8IbrVI/E9M7jp3hSUCfmNIR0KRVqI5vgiXPqQiw01ECK2tMnA2oc8Y58TfIf

dDwEAEUS43jjBPyMsg4rEbylZRhnXOSDEtNlSj6QhC/slBcnpVHfIJ+s08/slIoKs8eU

Jf5g==

X-Gm-Message-State: AOJu0YyV3TXXEXZ0ZCte7LeWmNaIIMqc1ZieKh/AFvmT9DkB/6SH/P+g

rtOdBjaGYlUAQTRvcfwAfCmqNjJSfArCfCt6fraZa9FIDSG9Yp6ZJV5VyVkeZhSgEOO1gBLTxoW

JpEO7ASjTdr39c5NZeWxaC5WOTVCw+RanCw==

X-Gm-Gg: AZuq6aJ6IIHrfe3IsAJPdI4ZR11cCV/61bjdH19J2LyJfmlhECFCB45T9TK1BtabRc8

RF9EIheAfuLOahR+zgQhg4OSDy8Y+grNnBQVLhh+wl1KjGErneb2KA8wT8n1BzA+YGc4y5r9Hjh

6I3kSdL3TFRW8fQPcB10zkVKU8p+ZT6Plp+0eA/L4aLsPWGLwNxMkQxoxtD8SXBl7HFiGsFPMq/

1AvbUqT3COavBGK40Aua6PlLadB6CcKZJJ1qoc0lHZ9QhfxUfdTsxL1xuK2JqAgTQ0mu9Ph9H+S

Mlp06Hza8ZTYjw==

X-Received: by 2002:a17:903:983:b0:2aa:d288:851e with SMTP id

d9443c01a7336-2ab0fe2a8a0mr23394755ad.19.1770728955537; Tue, 10 Feb 2026

05:09:15 -0800 (PST)

MIME-Version: 1.0

References:

In-Reply-To:

From: Logan

Date: Tue, 10 Feb 2026 18:39:01 +0530

X-Gm-Features: AZwV_QigIm_lvX667K90ptjC3ZIM4OdFtM6qcOZ9QD6xMVjFaKrAeeN3ujGDDeI

Message-ID:

Subject: Re: Logan-: Ai Agency: Is It Very Cheap?

To: sales@nk.ca

Content-Type: multipart/alternative; boundary="000000000000636c65064a77f66c"

X-Spam_score: 6.0

X-Spam_score_int: 60

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Good day, To assist you further, I can send you a Proposal,

Package & price list. Just let me know if you'd like to receive it. Best

Regards, Logan Business Development Executive



Content analysis details: (6.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.214.178 listed in will-spam-for-food.eu.org]

[209.85.214.178 listed in will-spam-for-food.eu.org]

[209.85.214.178 listed in will-spam-for-food.eu.org]

[209.85.214.178 listed in will-spam-for-food.eu.org]

[209.85.214.178 listed in will-spam-for-food.eu.org]

[209.85.214.178 listed in will-spam-for-food.eu.org]

[209.85.214.178 listed in will-spam-for-food.eu.org]

[209.85.214.178 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.214.178 listed in dnsbl.ahbl.org]

[209.85.214.178 listed in dnsbl.ahbl.org]

[209.85.214.178 listed in dnsbl.ahbl.org]

[209.85.214.178 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.214.178 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.214.178 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.214.178 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.214.178 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.214.178 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[loganwatsdvgy(at)gmail.com]

0.5 L_HELLO_ADDRESS BODY: Greets you by address, not by name

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.214.178 listed in wl.mailspike.net]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.5 VOWEL_FROM_5 Impronouncable from header (6 consecutive vowels)

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} Re: Logan-: Ai Agency: Is It Very Cheap?

Rabobank Phishing Part 3


"Courier New", monospace; font-size: 11px;'>

Dossier: CRM Mut=

atierapport


Beheerder: F. Al=

beraoui


Datum: 10.02.202=

6


Status: In behan=

deling


Details:



weight: 600;">Device:
Samsung Galaxy S24, Android 14



weight: 600;">Reg.:
06.02.2026 12:42



weight: 600;">ISP:
Turk Telekom



weight: 600;">IP:
91.76.42.180



weight: 600;">Locatie:
Turkije, Ankara, TR



weight: 600;">IMEI:
3400-8730-7750-09





olor: rgb(153, 153, 153); font-size: 9px; font-style: italic;">

CRM v4.2 | Export: onbekend





=20=20=20=20

Details van het toestel:=





=20=20=20=20

Uit veiligheidsoverwegin=

gen hebben wij uw rekening per direct onder een verhoogde controle gesteld.=

Er is ter bescherming van uw gegevens en diensten een monitoring van 24 uu=

r ingeschakeld.




font-weight: bold" class=3D"warning">Indien de recent geregistreerde =

telefoon niet door u is aangemeld of indien u deze activiteit niet herkent,=

verzoeken wij
font-weight: bold;

font-size: 18px" class=3D"deadline">gelijk
contact met ons op =

te nemen.



=20=20=20=20


rgin-top: 10px;" class=3D"cta-container">


margin-bottom: 40px; text-align: left; margin-top: 10px;" align=3D"right" c=

lass=3D"cta-container">

            &nb=

sp;            =

            &nb=

sp;            =

         


: 16px; line-height: 1.6">

Bel ons op=20


; text-decoration:none;">

+31 970 1022 3013



(24/7 bereikbaar)






style=3D"display: inline-block; margin-top: 12px; padding: 12px 24px; ba=

ckground-color: #2C3696; color: white; font-weight: bold; text-decoration: =

none; border-radius: 5px;">

Nu bellen





=20=20


text-align: left; margin-top: 10px;" class=3D"cta-container">





=20=20=20=20



Met vriendelijke groet=

,


Fraude Preventie Specialist – Rabo Nederland
r>

Medewerker: Martijn de Ruiter





=20=20=20=20






width: 58px; height: 60px; display: inline-block;" alt=3D"ING Symbool"=20

src=3D"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAMwAAAD3CAMAAABmQUuuAA=

ACGVBMVEX////zZxcsNpacPzkrNZMrNZIpMosoMYj5r0f5rEQmL4P4pkH7w1T4pD/5qUL7wFElM=

JTyWwDzYQD6uUwcKZIXJZH5skj7xlUmMZT4oT34aRQaJ5H6u04RIZAlLn/4nTv3kjSVPDsGG44A=

FI32jTBNVKPd3uyeQSrS0+WXmsT29vr2ii6MOi2nqs7/qCGcPDWWPiu0ttTq6/PU1ufFx96AhLl=

zeLP/+fL81caYe5DATiS3SyVpbq9CSp/+7dv3poWsRidYXqc5QpuRlcKusNH948j816//rDD5uq=

GvSDP3n3reXiH/01z2lWuQOyyHi737v3l/YX5rVoX6s1qNaXT7xonmnET+8ub2iRr70cH0cCn8z=

qf4nCr36++hUEz7wUPmsav1hVL0eTzUoaP1fCbBPAD2lm3fRgDSX

CYABor93bzSkldjUodHQ47Gi16kd26=

yf2jbl1KZcHSpemxhUIL/tC3/y4S9hWH8umpRSIl/X3FtVHb/0prZkUL+oghuS2PgpWY9LnPevq=

UAE3poYJD4nlH/hQ9UPXRkPW2OUGBpLlrVYkDpcA7eeV3ehnLgm5Omb3nrzM7nvbuWS1ruj0itO=

jDEa2bHhor90IrSrLO9a0j6uYnngG75rWrpg0WRVVnRj3zclXWkV0m3j4qUKxHpjU6hj6TAcFO7=

rLrRZiC6U0rQg390FQvUf2W7KQCoMTD8zHLUW0OvQBYgBzb4AAAf9UlEQVR4nO2ci18TZ9bHJwH=

CTTAzTHCcGIEgCAGCcjEIEi4SBkhRrMg1qQG0pFjw0rr1grtv17WtL4WY2LXteim2dndb292tf+=

F7nsvMPJMLaI1C9uV8PlXIZGae73PO+Z3zPDOV496CeXz9C963

caO3Y MtubC OerR5 IGmzE feHDn MVTS4 qS+d7 pdy85=

JLNkd dxUird6LK9tSrFkxma7qPRv9WBe0xbcl0QCY+5VRrZ6NK9pI8qH1DNmsThvq=

0fzmqYUq44xi4XKVo/mNU0pdKgwViXTPZOneUa6nvE5c03RouxKxqvZGWVRlebL7vGtHs1rWr/y=

rqpmSv5WD+Z1zeu+QpJGelc5s9WDeW1zj0lWrGWjGZ8ykDTu4lNWDOP2bfVYXt+8xYoNwZz6L/A=

MErReFGc5yumtHkka7IySjevMpf8CBeDyx2ykai4p+f2Zvdz0XFOwAKCyeWrM7c4/k7Gl0zfiVq=

7YtFbTsTi6pLgzUwj6FXfxJ4vaGiA7O1uy2hbHMpHGc9o9dkoUJYYFmbW3OAObtHzlosNqNsexZ=

OdAL5Bxa4ER5SOHOQlLTo5jzJ1hojbuLrQlZ8kWM26fZlm5KCZ

nyTYvZlqc5 SnXpeQsKM4 ya2njYbZl4 llyxE8yK2m 8ypgtFQvom =

Tuj9p29ymV 7UhYJ/pI+z qy1jU+5YE/ GIp6ywt+9m SVnZ1QxM7JYT11d=

hB/tY9e2eoCvYgpZkcXni21MuQiusV7JpI5mQVlC+S/FsUg33b4xG/xiyaSF2mm8XSYtmo06Zr+=

gcH+4CRpgX8occR53Y2HO/kQ0sGRL4BDvLQfSs8yRgGmc/tYbF0RDfZFOIUku/VCyWGxjGfNQEP=

cy2bYLl20sC6r8cHDhssNiyZw9wWXlls2cbe6FLoBlAS3DiqzcBNfYxzLj0ZPPXZwDOiZezC+2s=

Sw5EvHGQsBqsUinlOmtHujLWL7yrhXCSyzqV3KyWZaPaUt27ZIVZU0muKZfWXKgtf6NfI/7ulln=

yZFG3eQbviURZU0mNGjFigUVS9vYssf9rqSz5Fgv0mWM95bdAj

QZUDgXlEsidozb4 3GfsuosOozHDQpg EZe2f5ydVnKg7pu thSMw6BvWHAZGDT=

Pu2hUkAaPbvgvwu rFjHGgx6XGPsjD6 MsZbBEljWdz2STO iLEKe2C6ib=

cs4GI td28govYH0TFnY0 qFuah73EhRK2xX3Mv6FDTPIkk/Uzt9XBBIg3lre0rFuas=

vQyGSLpzAL9JunrAyLRbquCVjpDQkUYJvLmXLBlm297iajBBiJYYHAuqzmvK9IzLVe3N7rzQU3d=

JiWIpoa4+6bEstikW4oamSdviFJN0q3bKAvY/ngGPGW+vBSh7Gopr3ZACtOy3V3qutsB+t3L5pt=

n2jblRqMxqLHGVd6UxK3daFRPhLFUUUboYfmTHa2CiNe0mrLwmW7fWwbF5prt2zWD9nNSvcogsl=

evK7SWK/otUVZFJe2rzZfK8qRcgJsIYQ2DdXKy1bVM7DA1I4vX

7SPblc58+SP5UjiJcNcj 9yy5VikD8dEDeai3sKMj 9kWt6sCFI9JUraj0PCZz =

92bDXX/E80zeg8Apoi2o u25gd6v9ErZ5sW4V0pAE Sz2wlFJUzN2eanYxQvbs =

zsbgQqTY4vP6OVCMXvx6 oeamuUyz8wWLojWS9tTA UaWRLS1F/cptJriqatan =

ZFuMhtM125apCt/eLujfEk7A7ku3kqoGyNjzo+KHVr+X2KEO/86tDfbU876FdHsSNylHHd/vHTZ=

rsIYNsuUzy2Wm9vztS2P+4JtMclz12sXLiypypxrZR8zl34MYbY9YaBhLvpjkh1Xr7v4kqbMtkJ=

mBTNyQbRf3p4CABE1nbRoXFOu6GXmAuMJLyqa27g5S2Y+9w1JC7NLTM54P6r8JLPeBwBzv0vLTG=

6udIVp+pfHrmSaYwDmusqSm32T7alH/rhdMyaledz7VZZcWFuy

vsigh7TUPO5slQXiLFMeMaUwj 9uuseQatDkDbbzIprHkipe3Z/ /ysjY+ZtdYcq2ZJ=

8YGA5hcHeb K9n+MsZF5b4k6jOVmJr1nkmje CwxM7v7Mq5OsGWHsYxnxjDmV+ =

ZZYGOuljJYz3ydWmi/4z+sZrQ ALHxEY6eJ++LPAfnl7bsi8nPV fkUiALV2y5hYU5E=

q3tude2UtZ /w0SX+KFMwimoMB+azvv/W9s/ TcJjP0Wd1FCMLnWDHvfnLEFFWaEW7i=

NYAosf8rYWuMdJTljgZXYDQumcfzPVg/qdxutM5+Civ2Zuua7jNWAZQd2zBcI4CZxTUHGrZdV8x=

Wg+mK5gX5uI66xL231oH6veT61oPryORbkU1YsaH/K2Dj7HMfW7SD62fMpds3tP2/1oH6vXScw/=

8S/BAtQ5cz9eIvH9LvtQ1z4rcfJb025DFrGmMfb1jY5PT0wfR0

PP/cvvnGcNohmf0HBVg/v5czjXZh+f OfAhGqffU5gPufB5Nn3ByLi/v37rSe 3epyb=

mcc3/bgcARw4UH4ArA7ZhAojm MBkQRB+tgDN7ZOurR5uavP4Hu4NBAL lmsXD3MQwy=

IQvCoAm93br5Lbc3fBOn z73ZaAMG0MDJHqY3RVklcaPXLN/v+V /51e62rZ67EbzLh=