Domain for Sale Spam from Google Gmail Part 2

Posted by Dave Yadallee on
> On Fri, 10 Apr 2026, 5:22=E2=80=AFpm , wrote=

:

>

>> Hello,

>>

>> I wanted to let you know that the premium domain

>>

>> VoipEdmonton.com is available for purchase at Godaddy.

>>

>> This domain would be really good for attracting clients looking for your

>> VOIP IN EDMONTON.

>>

>> If the domain is developed or redirected to your current website, it

>> would be extremely beneficial to your company and services in terms of

>> catching more leads and clients while retaining your brand identity.

>>

>> You can get this domain for $650 at www.VoipEdmonton.com right now.

>>

>> Best Regards,

>>

>> Nicholas.

>>

>



--00000000000048bd0c06500da616

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Hello,


>

We sent you an email recentl=

y and never heard back. We=E2=80=99ve scheduled a 24-hour discount for the =

domain name, and we would like to know if there is any interest here.
=



T=

he domain can be developed or redirected to your current website to increas=

e visibility with its keywords in EDMONTON and its environs.

=3D"auto">

We have a=

lso reduced the price of the domain to $550 only.

r>

To get it now, go to=

=C2=A0
Do let me know if you have any q=

uestions!



dir=3D"auto">We await your response.


dir=3D"auto">
Stay Safe.


ass=3D"gmail_quote gmail_quote_container">

ttr">On Tue, 14 Apr 2026, 5:18=E2=80=AFpm Nichoas Louis, <
lto:nicholaslouis.co@gmail.com">nicholaslouis.co@gmail.com> wrote:
r>

-left:1px #ccc solid;padding-left:1ex">
=

Good morning,


=

What do you think about the website domaihn name=C2=A0
iv>

>

Do you have any intere=

st?



=3D"auto">Will you be considering this offer?


div>

You can also let me know =

your best offer, and we=E2=80=99ll work together to find a mutually agreeab=

le price. If no interest please let me know so I don=E2=80=99t follow up fu=

rther.



r=3D"auto">We sincerely appreciate your response.

r>

With best wishes,
v>


">On Fri, 10 Apr 2026, 5:22=E2=80=AFpm , <
s.co@gmail.com" target=3D"_blank" rel=3D"noreferrer">nicholaslouis.co@gmail=

.com> wrote:

gin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">

Hello,

I wanted to let you know that the prem=

ium domain

VoipEdmonton.com is available for purch=

ase at Godaddy.

This domain would be really good f=

or attracting clients looking for your
VOIP IN EDMONTON.

v>
If the domain is developed or redirected to your current w=

ebsite, it would be extremely beneficial to your company and services in te=

rms of catching more leads and clients while retaining your brand identity.=



Best Regards,<=

/div>

Nicholas.

o_gmail_com-dot-mmanalytics2.appspot.com/em_oBUPlK7Pew7e5btd2Kul/comet.gif"=

style=3D"display:none!important">









--00000000000048bd0c06500da616--

Domain for Sale Spam from Google Gmail Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 22 Apr 2026 09:50:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wFZpe-00000000EB1-0RaM

for dave@doctor.nl2k.ab.ca;

Wed, 22 Apr 2026 09:49:42 -0600

Resent-From: The Doctor

Resent-Date: Wed, 22 Apr 2026 09:49:41 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-yw1-f170.google.com ([209.85.128.170]:53369)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wFYuy-000000008hN-2ksE

for root@nk.ca;

Wed, 22 Apr 2026 08:51:16 -0600

Received: by mail-yw1-f170.google.com with SMTP id 00721157ae682-79a2ee65171so73455507b3.2

for ; Wed, 22 Apr 2026 07:50:21 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1776869415; cv=none;

d=google.com; s=arc-20240605;

b=CMNsUprueFZJa3Q6/HENCxDIvzkLxB5U9F3lXjqLniPMgfI8eTPaqkpRVBPsV7Yqwk

jznywDNN9cO8Bzk+/jdoEX61ot5rKsc0FzLrhfPmao0TrrrVncTADs1c4/KowzsQvtaB

DiUYzwa3vzek7NqcMwilh9pY80co9KW7Gsb3P+0zxJkAGTyVlA8Rj6LJEq97SgC9+nUq

svo28xJNoG7bV+Woma1c91yBwdASbTwojsMjLjrXpS8zkdCUFE61x4QK9TA0JAja5RTY

8MARSswabrrmUvmIhdxEMqlZ/fZPlidVALYuALsEKxK7aMpOGEhhcN5wIlJUOUPNwaLZ

9yOg==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;

h=to:subject:message-id:date:from:in-reply-to:references:mime-version

:dkim-signature;

bh=EEcmsmi5Ig/CZHwr430b+LKypvX6Q/EdKQVRx6fdtkk=;

fh=ny7+SATv4n6lSNl0rVMQyaj6POVJTUZJLShjjgjSTJg=;

b=WAnRH363NO6YCpDDDIseIC80xdwFwEWDCUwVif32jeYmDRpCk6XAy71KyW/C6QZq9v

Hf2qNCm4XjAp67cqWbXaYgOTNYCM4Sozin24/8Mhza4JPg/B1heC3cuzuomSjm/xZSyR

JpSovapnGFK4hQQvTzZv6lliSJrpRpYqHq3P0WTgDCjbEiwyEYp4hm9eop8OlLZ1djX7

FS/JvB5iUaiYyt2gMvXsBrKibMckTjdJ5Iw65pgRTeA8kueyMBE40GJ9QBSjcgKXT5In

ilHQCUP1s523s5c6VLPFSvyyrD6yozUBehF8gMWz3D4K0UGdu+n/dLiinX2uqQaKdnAl

jWPA==;

darn=nk.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1776869415; x=1777474215; darn=nk.ca;

h=to:subject:message-id:date:from:in-reply-to:references:mime-version

:from:to:cc:subject:date:message-id:reply-to;

bh=EEcmsmi5Ig/CZHwr430b+LKypvX6Q/EdKQVRx6fdtkk=;

b=Tln7agSWRUBBAb6f8CVsAF8okNtKDETdxTDSMezKwv7W3E2TEzrKfy1n6hqtjUvQ5H

0m/2kxkAQxsQaTom9QJ1jQckiN9bL0e3fYgB+MxwByK0OimwpmCWU7dY7J2owcK+qLDE

ap+7EqywB5RKLdejaX9TU8QwX18KNMfNZ7vVcrzk4N1U2+Fdmg4urbd1a6STr4adRz2f

SQzN8kTjyy/X6prfAQ1hM9b8KY5DL13WTm41QnzJ2DVzkmHqyYBi2jSUJPoissMfz27h

SAsytSpJjsqBK57+zzfC4+1CyW1ajvYkeJRHEaaBuH//0AT5hl9/RUA304YbXywyOOgD

i3cg==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1776869415; x=1777474215;

h=to:subject:message-id:date:from:in-reply-to:references:mime-version

:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id

:reply-to;

bh=EEcmsmi5Ig/CZHwr430b+LKypvX6Q/EdKQVRx6fdtkk=;

b=p/hiYwXQd2WlbF7S7VjZ716bADsuWWT7Ll0MNL55sAW2dvnMC/FL8tyD3D7UekUMNy

z2KhdS96KEe8DxVhK87BwOcbscPadrN6cRuI5GGvizWhevL19jFKmbUeSRJILfQIsn4k

hKVDZlQDccqmUfuLaePGB5k+0Xm+On+9mzzOftpl+gJfjmYtKRymBMVbXqEWOMcmoei9

8eqMw2vtPOkQT/cGkD51Go0iDRlTY4KO6c5ZvBTxg6d7luwNC6Q1FMiL4A2ako09LJf4

q9LWuS6NtnXWQsBQSbaqLubqkDNqyNvRs56znMVA3EwNlh8LIp7sgZJ/+c4pDbivRvSR

TOoQ==

X-Gm-Message-State: AOJu0YyrGcK/37QMNh+djK4Fbjdx1kR1L+/xZdQxCrHOvqHaypUZeMds

r/cJPUXR13yBcfYC4Sai5tTIuzyaOePoJNeOb1Nui26AKveSBbPb+kqRnSFLSwIOCxWY8hqT90S

87qa3SJ5quw57v0IUb0ZkYKgjtoWieASpUTSo

X-Gm-Gg: AeBDieuroyOcWliHgjb8+pJs7dl8DOZa0EZ6Ybphz2S4LczIvZ+j/AfJpsrzkx/mule

FTGHN+qG4aIU4fjPJoSzS96BCa/CYCUv5nCnbDUV2UudXg/gOTx1Kx6qn1fZto7dAhzyyzD4vom

/M78BNjwVwCwLJ13KMNiR4iSyStB4oXSLhxKQaFZyz7AOE7aZzMCICCeaxnYXv0fVhDrFEEEdNS

zOhjPg5kKkHTng+AcQ83pBBHm/P5iHPhw+tao/fMDQG5a25ILJs9hCYCPatxDBPPRWmuGrTaOJn

KxXDuws2NGjFQKkGA03Gb5U=

X-Received: by 2002:a05:690c:112:b0:7a2:ce0e:865c with SMTP id

00721157ae682-7b9ecfdb8efmr229845777b3.37.1776869414844; Wed, 22 Apr 2026

07:50:14 -0700 (PDT)

MIME-Version: 1.0

References:



In-Reply-To:

From: Nichoas Louis

Date: Wed, 22 Apr 2026 15:50:01 +0100

X-Gm-Features: AQROBzBpr3USaUYZ3jnsjfrLIJ38YgjvPZtvqXmQj6-IQjh37VXJB-FLSDSONrk

Message-ID:

Subject: Re: VOIP IN EDMONTON

To: root@nk.ca

Content-Type: multipart/alternative; boundary="00000000000048bd0c06500da616"



--00000000000048bd0c06500da616

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Hello,





We sent you an email recently and never heard back. We=E2=80=99ve scheduled=

a

24-hour discount for the domain name, and we would like to know if there is

any interest here.





The domain can be developed or redirected to your current website to

increase visibility with its keywords in EDMONTON and its environs.





We have also reduced the price of the domain to $550 only.





To get it now, go to

www.VoipEdmonton.com

Do let me know if you have any questions!





We await your response.





Stay Safe.



On Tue, 14 Apr 2026, 5:18=E2=80=AFpm Nichoas Louis,
.com>

wrote:



> Good morning,

>

>

> What do you think about the website domaihn name

> www.VoipEdmonton.com?

>

>

> Do you have any interest?

>

>

> Will you be considering this offer?

>

>

> You can also let me know your best offer, and we=E2=80=99ll work together=

to find

> a mutually agreeable price. If no interest please let me know so I don=E2=

=80=99t

> follow up further.

>

>

> We sincerely appreciate your response.

>

>

> With best wishes,

>

Domain Name Spam from Google Mail Part 2

Posted by Dave Yadallee on
>

> On Fri, 10 Apr 2026, 5:21=E2=80=AFpm , wrote=

:

>

>> Hello,

>>

>> I wanted to let you know that the premium domain

>>

>> VoipEdmonton.com is available for purchase at Godaddy.

>>

>> This domain would be really good for attracting clients looking for your

>> VOIP IN EDMONTON.

>>

>> If the domain is developed or redirected to your current website, it

>> would be extremely beneficial to your company and services in terms of

>> catching more leads and clients while retaining your brand identity.

>>

>> You can get this domain for $650 at www.VoipEdmonton.com right now.

>>

>> Best Regards,

>>

>> Nicholas.

>>

>



--0000000000000008b406500da51c

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Hello,


>

We sent you an email recentl=

y and never heard back. We=E2=80=99ve scheduled a 24-hour discount for the =

domain name, and we would like to know if there is any interest here.
=



T=

he domain can be developed or redirected to your current website to increas=

e visibility with its keywords in EDMONTON and its environs.

=3D"auto">

We have a=

lso reduced the price of the domain to $550 only.

r>

To get it now, go to=

=C2=A0
Do let me know if you have any q=

uestions!



dir=3D"auto">We await your response.


dir=3D"auto">
Stay Safe.


ass=3D"gmail_quote gmail_quote_container">

ttr">On Tue, 14 Apr 2026, 5:18=E2=80=AFpm Nichoas Louis, <
lto:nicholaslouis.co@gmail.com">nicholaslouis.co@gmail.com> wrote:
r>

-left:1px #ccc solid;padding-left:1ex">
=

Good morning,


=

What do you think about the website domaihn name=C2=A0
iv>

>

Do you have any intere=

st?



=3D"auto">Will you be considering this offer?


div>

You can also let me know =

your best offer, and we=E2=80=99ll work together to find a mutually agreeab=

le price. If no interest please let me know so I don=E2=80=99t follow up fu=

rther.



r=3D"auto">We sincerely appreciate your response.

r>

With best wishes,
v>


">On Fri, 10 Apr 2026, 5:21=E2=80=AFpm , <
s.co@gmail.com" target=3D"_blank" rel=3D"noreferrer">nicholaslouis.co@gmail=

.com> wrote:

gin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">

Hello,

I wanted to let you know that the prem=

ium domain

VoipEdmonton.com is available for purch=

ase at Godaddy.

This domain would be really good f=

or attracting clients looking for your
VOIP IN EDMONTON.

v>
If the domain is developed or redirected to your current w=

ebsite, it would be extremely beneficial to your company and services in te=

rms of catching more leads and clients while retaining your brand identity.=



Best Regards,<=

/div>

Nicholas.

o_gmail_com-dot-mmanalytics.appspot.com/em_GrGDVVfCnSWAX8pOmpL6/asteroid.gi=

f" style=3D"display:none!important">









--0000000000000008b406500da51c--

Domain Name Spam from Google Mail Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 22 Apr 2026 09:50:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wFZpZ-00000000EAg-3bUz

for dave@doctor.nl2k.ab.ca;

Wed, 22 Apr 2026 09:49:37 -0600

Resent-From: The Doctor

Resent-Date: Wed, 22 Apr 2026 09:49:37 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-yw1-f169.google.com ([209.85.128.169]:43462)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wFYue-000000008ej-0rVe

for sales@nk.ca;

Wed, 22 Apr 2026 08:50:57 -0600

Received: by mail-yw1-f169.google.com with SMTP id 00721157ae682-79db5e18ac6so67625497b3.1

for ; Wed, 22 Apr 2026 07:50:00 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1776869393; cv=none;

d=google.com; s=arc-20240605;

b=YoUdU330u8w1BuyfJqYVdoEM1ZgPGk5EJhZoLy1y4NJstcC9vQzXKEn7FCq5YnmiSX

lSTwXmYaAEs2FhyxnKAGedmkUaTS44pTSMWhGy7U/zt7X7UiUAUgmsxt5rE4TkhU22B8

Aaz7U5P2f83hsaYFOl9e7+VI0S6Dkw5/Js/y4y1FXMaEqQLgk5AJAUIQwv/GMiNM/CZW

vqBL7PVfZkTDbiOGa4nAW46iLwsEACu5GUSOOPk1uamxfyQ5GPOiHu0owqG7+IGaKk1p

MuF8kOh/YedtDXeezZ71UjjAjNOu7n2yf+a2fzX94jBCyuI0p9SFHhae3xC4yNzw19FJ

3oKg==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;

h=to:subject:message-id:date:from:in-reply-to:references:mime-version

:dkim-signature;

bh=bPAaLiYbvRpEVGFCu/wTZlqwSC7G4/OUkGOJOCQxhLg=;

fh=C4vsnDG7cTH8aa/8f7sygxKSfblX4MPDg6mph8A3jUw=;

b=DRY8+akh52Ngatee0ErPrTs9oKrjMeL50n6PqcIJJpXEfaJIzj7HFd6TXX+vmgmO92

+hmDFoRu04RT64tsCdI7g38IGHb74JspR3h1eDFJE38CLnxnOiYU/tbUDSFvl2I9kJsH

UbByl6Z0V4UlVhwCPWO+0ypRPg5GJYJcPt1A9wg77DDKmcnEwd/jYNS8HYi7e+9cYkor

6KNJG9zeyXRsOZ/FNO7+0UDcCbnw2h1dHKJ9SHgAxWaSh+K4pQ+yeyh5qKY6dNyEP/VD

iB7sxy11YMvTxad5+IxMCvdAJTY4fyIYdRElnU4R+9E8iuVm+flsb3TgqJdxaFVGq6sd

a/UQ==;

darn=nk.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1776869393; x=1777474193; darn=nk.ca;

h=to:subject:message-id:date:from:in-reply-to:references:mime-version

:from:to:cc:subject:date:message-id:reply-to;

bh=bPAaLiYbvRpEVGFCu/wTZlqwSC7G4/OUkGOJOCQxhLg=;

b=FEkDHZD5dn7cI8Lx42iJ+VDc6nNRAA/RK+Bqu1uiBd+l9YDjvcUoHxE2yQgTodcjrV

b6Tz1sDhGczQ+m177aPX7kH9a05egNi5Xjy6ToOJiD5cOdr6bx1+odJpuqil2wwSMgMn

KbomxgXvfC25FFGGNfuWe2mxnabaWdsVGeDx7rPc/UQ3UgC5VmAgK8h14gdkr+g1hATu

/MVj+nXKyohxve5vqSFcdIEE1Ded06F9bT9FDDsM8lXfn9SfMpBUnD6pPqwgdvieNSig

G1KxUA56ztW5eJ3g4ffXhHtyq/Y0Ixed6Gb+XYLX2jWTSSXItTzJS3oeV8nruQhyfOPc

KFuA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1776869393; x=1777474193;

h=to:subject:message-id:date:from:in-reply-to:references:mime-version

:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id

:reply-to;

bh=bPAaLiYbvRpEVGFCu/wTZlqwSC7G4/OUkGOJOCQxhLg=;

b=a9xiEzw8jw9mSwssIsSQqy/oK/5ncdq3trHEdYX+Jz1pshj0V+Zaaarg6tmq2BugHg

idmIWRvLd40EOBDoG9jUa8KfS4GXqnJTVa6t5WMazs2ead90JBGn9+XZ0rjNA6wNFV8P

ekszzYCNnrjHBMSCDXxgmiEvYh13cNbns1Wv/SlzhTkNszMTV+aref5/Zk3WKqh4XA0L

xQ97h+Pnm5wUAZU980OV9tf2XropLTs/8e7eupcv/b1kK2Oc5liJVvKsRBhcIeN7BEST

rwMraQ3/W61AC8aduPKu1b/tkn7yyYq3RG212pRrGl6XBwtilaQEuM1AoVuPC9zzp0fq

lQgQ==

X-Gm-Message-State: AOJu0YxerZ+FuvUlAJhFvVk0PPMW8DMdGC2zsbgYN1Qx3CcJEgGypH5p

MCtDkta2Ca/su9i8cV0s7sm8lt181tbTkm0wC76Qv+DzD7+uui9GVZWx+wIGQ4LL5/uEWnUMyl0

bZdheG3CL9B4yuNxceyrXGqnIx4XpO3LnqOCi

X-Gm-Gg: AeBDiet+8isO5L3tKuAUfPtpokQszp8OMMzMeVuGiwScx+EcCuv6zvRMUbaXIoOXstu

xbA0ck8ntwjxLVcuEYhN+9iUJNKFI1h/g51bVBqb/Y0jUftvGB03GW8Vv24p97GYKFiwGF8+lW2

8DUAe2bg1Txt5fY+WzvIpQg0gJJXVHl/sfhVTks4HmrTgifMeRM420UYtIUXhWAUPNHX6K7CE4B

+Bh8R0AfTuAX3UIIlBKKKWzOINtFOsPFStc5zpnqz7dpBcGrOhOcG+0FalrEkvKdU2FxWgiBYhP

IIyo4t052hM7Ut0gjXzDPFk=

X-Received: by 2002:a05:690c:c50e:b0:7b4:1394:4104 with SMTP id

00721157ae682-7b9ed2c71f9mr175103547b3.9.1776869393302; Wed, 22 Apr 2026

07:49:53 -0700 (PDT)

MIME-Version: 1.0

References:



In-Reply-To:

From: Nichoas Louis

Date: Wed, 22 Apr 2026 15:49:40 +0100

X-Gm-Features: AQROBzA0369IotKTAfcM8MsrZDY2P66gNYQhP9ypChbSxAJgOXMugzZ8st1jvts

Message-ID:

Subject: Re: VOIP IN EDMONTON

To: sales@nk.ca

Content-Type: multipart/alternative; boundary="0000000000000008b406500da51c"



--0000000000000008b406500da51c

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Hello,





We sent you an email recently and never heard back. We=E2=80=99ve scheduled=

a

24-hour discount for the domain name, and we would like to know if there is

any interest here.





The domain can be developed or redirected to your current website to

increase visibility with its keywords in EDMONTON and its environs.





We have also reduced the price of the domain to $550 only.





To get it now, go to

www.VoipEdmonton.com

Do let me know if you have any questions!





We await your response.





Stay Safe.



On Tue, 14 Apr 2026, 5:18=E2=80=AFpm Nichoas Louis,
.com>

wrote:



> Good morning,

>

>

> What do you think about the website domaihn name

> www.VoipEdmonton.com?

>

>

> Do you have any interest?

>

>

> Will you be considering this offer?

>

>

> You can also let me know your best offer, and we=E2=80=99ll work together=

to find

> a mutually agreeable price. If no interest please let me know so I don=E2=

=80=99t

> follow up further.

>

>

> We sincerely appreciate your response.

>

>

> With best wishes,

Paypal Cryptocurrency phishing from Microsoft Outlook Part 3

Posted by Dave Yadallee on
0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[haressaznzxrrsxaxz321(at)gmail.com]

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[haressaznzxrrsxaxz321(at)gmail.com]

0.3 LONGWORD BODY: Uses overlong words

0.6 MEGALONGWORD BODY: Uses really overlong words

0.1 TW_RW BODY: Odd Letter Triples with RW

0.1 TW_VJ BODY: Odd Letter Triples with VJ

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.2 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and EnvelopeFrom

freemail headers are different

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.6 LONG_INVISIBLE_TEXT Long block of hidden text - bayes poison?

0.1 TO_IN_SUBJ To address is in Subject

Subject: {SPAM?} =?UTF-8?Q?Pozv=C3=A1nky=3A_Order_Processing_Notice_=2D_Payment_Confirm?=

=?UTF-8?Q?ed_=40_st_22=2E_apr_2026_=28cynthiaperez389903=40groups=2Eoutlook=2Ecom=29?=





Haresasz Nxysarwsa has invited you to Order Processing Notice – Payment Confirmed

Title: Order Processing Notice – Payment Confirmed

Location: https://meet.google.com/yqr-oyab-vjx

When: April 22, 2026

Organizer:

Haresasz Nxysarwsa

Description: Dear Customer,



Thank you for your payment. We confirm that your PayPal transaction has been successfully verified and your Bitcoin (BTC) order is now in the confirmation stage.



Transaction ID: X4N8Q2J7T5

Date: April 22, 2026

Amount: $410.00

Payment Method: PayPal

Order Status: Pending Verification



Blockchain confirmation times may vary depending on overall network demand. You will be notified once your order has been finalized.



If you have any questions, please contact our support department.



Customer Support: +1(843) 367-5992



Thank you for your continued support.



Best Regards,

Billing Department



-::~:~::~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~::~:~::-

Pripojiť sa cez Google Meet: https://meet.google.com/yqr-oyab-vjx



Viac o službe Meet sa dozviete na https://support.google.com/a/users/answer/9282720



Túto sekciu neupravujte.

-::~:~::~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~::~:~::-

Attendees:



cynthiaperez389903@groups.outlook.com





Pripojiť sa cez Google Meet

Odkaz na stretnutie

meet.google.com/yqr-oyab-vjx

Dear Customer,



Thank you for your payment. We confirm that your PayPal transaction has been successfully verified and your Bitcoin (BTC) order is now in the confirmation stage.



Transaction ID: X4N8Q2J7T5

Date: April 22, 2026

Amount: $410.00

Payment Method: PayPal

Order Status: Pending Verification



Blockchain confirmation times may vary depending on overall network demand. You will be notified once your order has been finalized.



If you have any questions, please contact our support department.



Customer Support: +1(843) 367-5992



Thank you for your continued support.



Best Regards,

Billing Department

Kedy

streda 22. apr 2026

Organizátor

Haresasz Nxysarwsa

haressaznzxrrsxaxz321@gmail.com

Hostia

(Zoznam hostí bol na žiadosť organizátora skrytý)

Odpoveď na cynthiaperez389903@groups.outlook.com

Áno



Nie



Možno

Ďalšie možnosti



Pozvánka z Kalendára Google



Túto správu ste dostali, pretože ste účastníkom danej udalosti.



Ak túto pozvánku prepošlete, ktorýkoľvek jej príjemca bude môcť odoslať odpoveď organizátorovi, byť pridaný do zoznamu hostí, pozývať iných bez ohľadu na ich vlastný stav pozvánky alebo meniť vaše potvrdenie účasti. Ďalšie informácie

Paypal Cryptocurrency phishing from Microsoft Outlook Part 2

Posted by Dave Yadallee on
=?utf-8?B?OXBleHZkNGorK3VQc1ZEbkZXVUZqV0VTdlZiWHFPWktqZGE0c29ac0Z3d3Y4?=

=?utf-8?B?bDBrMHMvMXh0WXBoajVvQ20wZEVwQ1dqSFJLb3N6aTJSOWNqYXdRRDdVVnBt?=

=?utf-8?B?Rkh3V2FJNkZxMTdETlpvUGpTUDRaWUtTc3VJc0dWbU5nR01uMWhLWldVbU1N?=

=?utf-8?B?ZDhacWJZVHBEczk4WkRmaWMwMHFFZWkzam9HY2xCMFlTSURYWjkyUm83dnQ3?=

=?utf-8?B?RDcrN09RemQvVW1qMVhLU0x5N3pNTHBTNzVPcmVEc0pOMTBJLzQxOEpyYURZ?=

=?utf-8?B?VGRoSGdldHB1ckRmZGZSNWhoZkpXdnEyMlVYbjNuVUxKaE1Ic2JtRjRFOFRj?=

=?utf-8?B?V1VKTFljMkl6U1orTkVpTmdrckhQSW5XNTJ5UXh2OEI5UXFBZUVwc0duVGlr?=

=?utf-8?B?dnJBdHkxejMyNkU3Ynorakg2YVlwMUNTRW81MUdPc1RLZnNsME11Y2ROM1My?=

=?utf-8?B?Y3ZzT3NHUWFyUDlibGdFRW9iSy96SVozc3hKNEpJdVdCa2pZZXVkNE1iK3Rw?=

=?utf-8?B?QU1GaEkwRnF2cndhT0Fzd0luWml3eDBUWDBLNGZzUG8xN1d2OWlXMVAzVWVZ?=

=?utf-8?B?WGsrNndFVmI5ZGN4cm5OaE1TRWpZRFdGRkJrbTBEeGgyaXhhdWYxUC9ZUTBF?=

=?utf-8?B?R2l2QmJ0Q052VFdqUmhEZUdYNzNISzBIY0d3c000cnpTOUExOWtmUGZWWnBp?=

=?utf-8?B?cDhNOEhWZFhtK1ZZZWFkM2JNQ0g1R0FWQklrdUdZU2xjeFZJZ3craUp6djU1?=

=?utf-8?B?VUlhSGp4UEZkYTdIeVNualkvaWdNbGpycEswWFIrMFE5eXR6QVdwOGluRmMr?=

=?utf-8?B?bGhIUUxtMXMvNjQwQzlOSjAvc1Q4K0U1cVRhMC96dDlJVTdNaEVLY1RIRVVt?=

=?utf-8?B?ODg4WXhiWDhVeHRQOFZhTmF3RTdrQlNsT21jU0RDb3dNdlY2RnFqYm9MZWpx?=

=?utf-8?B?N2JKZjB6c0FiZnRTc3I1QXpjUE44QVlld09mdDcyZGpTTTEwM1VPYXZSNEky?=

=?utf-8?B?V3VIWUJpQUFOVkd3OVNIRWNqS0FyRStxeXJ6VGVVSHc0V1RoZzJSVmRmUGtN?=

=?utf-8?B?SXlGWkhkUTRoNUh6dG92NVVrOHBzVEI1ZERIcGd1Q0lJN1JsZlBxcmY5MzNY?=

=?utf-8?B?WUppWnBGOE5QUkM5SXZBRGJ3WVhlNlZKaGp0R2Z1NzR3L0pCektXVWYwb091?=

=?utf-8?Q?p0QJ4MclJnyQpFlnodoMpI4MBl6VC5aUt?=

X-Auto-Response-Suppress: DR, OOF, AutoReply

X-OriginatorOrg: sct-15-20-9412-4-msonline-outlook-090a5.templateTenant

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 22 Apr 2026 14:45:21.3282

(UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id: bf3d12cb-f271-4597-be26-08dea07dc79c

X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-AuthSource: DM2PEPF00003FC2.namprd04.prod.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: Internet

X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH0PR18MB3848

X-Spam_score: 11.4

X-Spam_score_int: 114

X-Spam_bar: +++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Order Processing Notice – Payment Confirmed streda 22. apr

2026 Pripojiť sa cez Google Meet https://meet.google.com/yqr-oyab-vjx?hs=224

Dear Customer,



Content analysis details: (11.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[40.93.1.2 listed in dnsbl.ahbl.org]

[40.93.1.2 listed in dnsbl.ahbl.org]

[40.93.1.2 listed in dnsbl.ahbl.org]

[40.93.1.2 listed in dnsbl.ahbl.org]

[209.85.161.74 listed in dnsbl.ahbl.org]

[209.85.161.74 listed in dnsbl.ahbl.org]

[209.85.161.74 listed in dnsbl.ahbl.org]

[209.85.161.74 listed in dnsbl.ahbl.org]

[2603:10b6:610:e7:0:0:0:35 listed in]

[dnsbl.ahbl.org]

[2603:10b6:610:e7:0:0:0:35 listed in]

[dnsbl.ahbl.org]

[2603:10b6:610:e7:0:0:0:35 listed in]

[dnsbl.ahbl.org]

[2603:10b6:610:e7:0:0:0:35 listed in]

[dnsbl.ahbl.org]

[2603:10b6:610:e7:cafe:0:0:50 listed in]

[dnsbl.ahbl.org]

[2603:10b6:610:e7:cafe:0:0:50 listed in]

[dnsbl.ahbl.org]

[2603:10b6:610:e7:cafe:0:0:50 listed in]

[dnsbl.ahbl.org]

[2603:10b6:610:e7:cafe:0:0:50 listed in]

[dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[40.93.1.2 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[40.93.1.2 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[40.93.1.2 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[40.93.1.2 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.161.74 listed in will-spam-for-food.eu.org]

[209.85.161.74 listed in will-spam-for-food.eu.org]

[209.85.161.74 listed in will-spam-for-food.eu.org]

[209.85.161.74 listed in will-spam-for-food.eu.org]

[209.85.161.74 listed in will-spam-for-food.eu.org]

[209.85.161.74 listed in will-spam-for-food.eu.org]

[209.85.161.74 listed in will-spam-for-food.eu.org]

[209.85.161.74 listed in will-spam-for-food.eu.org]

[2603:10b6:610:e7:cafe:0:0:50 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:e7:cafe:0:0:50 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:e7:cafe:0:0:50 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:e7:cafe:0:0:50 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:e7:cafe:0:0:50 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:e7:cafe:0:0:50 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:e7:cafe:0:0:50 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:e7:cafe:0:0:50 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:e7:0:0:0:35 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:e7:0:0:0:35 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:e7:0:0:0:35 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:e7:0:0:0:35 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:e7:0:0:0:35 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:e7:0:0:0:35 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:e7:0:0:0:35 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:e7:0:0:0:35 listed in]

[will-spam-for-food.eu.org]

[40.93.1.2 listed in will-spam-for-food.eu.org]

[40.93.1.2 listed in will-spam-for-food.eu.org]

[40.93.1.2 listed in will-spam-for-food.eu.org]

[40.93.1.2 listed in will-spam-for-food.eu.org]

[40.93.1.2 listed in will-spam-for-food.eu.org]

[40.93.1.2 listed in will-spam-for-food.eu.org]

[40.93.1.2 listed in will-spam-for-food.eu.org]

[40.93.1.2 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[40.93.1.2 listed in list.dnswl.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.5 FROM_LOCAL_NOVOWEL From: localpart has series of non-vowel letters

3.5 VOWEL_FROM_7 Impronouncable from header (7+ consecutive vowels)

1.0 HK_RANDOM_REPLYTO Reply-To username looks random

1.0 HK_RANDOM_FROM From username looks random

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[40.93.1.2 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[40.93.1.2 listed in bl.score.senderscore.com]

Paypal Cryptocurrency phishing from Microsoft Outlook Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 22 Apr 2026 09:50:03 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wFZpN-00000000E9O-41gn

for dave@doctor.nl2k.ab.ca;

Wed, 22 Apr 2026 09:49:25 -0600

Resent-From: The Doctor

Resent-Date: Wed, 22 Apr 2026 09:49:25 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-westusazlp17010002.outbound.protection.outlook.com ([40.93.1.2]:43322 helo=BYAPR05CU005.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wFYqS-000000008K6-0e9f

for doctor@doctor.nl2k.ab.ca;

Wed, 22 Apr 2026 08:46:40 -0600

Received: from CH0PR03CA0240.namprd03.prod.outlook.com (2603:10b6:610:e7::35)

by PH0PR18MB3848.namprd18.prod.outlook.com (2603:10b6:510:2b::24) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9846.20; Wed, 22 Apr

2026 14:45:22 +0000

Received: from DM2PEPF00003FC2.namprd04.prod.outlook.com

(2603:10b6:610:e7:cafe::50) by CH0PR03CA0240.outlook.office365.com

(2603:10b6:610:e7::35) with Microsoft SMTP Server (version=TLS1_3,

cipher=TLS_AES_256_GCM_SHA384) id 15.20.9791.48 via Frontend Transport; Wed,

22 Apr 2026 14:45:21 +0000

Authentication-Results: spf=pass (sender IP is 209.85.161.74)

smtp.mailfrom=gmail.com; dkim=pass (signature was verified)

header.d=google.com;dkim=pass (signature was verified)

header.d=gmail.com;dmarc=pass action=none header.from=gmail.com;compauth=pass

reason=100

Received-SPF: Pass (protection.outlook.com: domain of gmail.com designates

209.85.161.74 as permitted sender) receiver=protection.outlook.com;

client-ip=209.85.161.74; helo=mail-oo1-f74.google.com; pr=C

Received: from mail-oo1-f74.google.com (209.85.161.74) by

DM2PEPF00003FC2.mail.protection.outlook.com (10.167.23.20) with Microsoft

SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.9846.18

via Frontend Transport; Wed, 22 Apr 2026 14:45:21 +0000

X-IncomingTopHeaderMarker:

OriginalChecksum:0A597A57D272C789A52AE46B09C8BBA62646102A41C8E30A2EB1E83E6A05F3AA;UpperCasedChecksum:0331458022BE88BC4608EB18A567A9D5BB9B0C77D54299CCD77FDD2EB8D0B567;SizeAsReceived:3383;Count:15

Received: by mail-oo1-f74.google.com with SMTP id 006d021491bc7-6946dfca922so4677615eaf.1

for ; Wed, 22 Apr 2026 07:45:21 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=google.com; s=20251104; t=1776869121; x=1777473921; darn=groups.outlook.com;

h=to:from:subject:date:message-id:sender:reply-to:mime-version:from

:to:cc:subject:date:message-id:reply-to;

bh=Qcznrz6dMXfhK6mVdeLuj7BHSjZW9UCiByt6meB7GPA=;

b=TWfE+xcEeLX8aGJK7wxuGkHga1C4qefZp7TalhfS+YUMcgafZuWFqy+6ntMZOQGrZO

A/+gPX8HeDyVzobvlIfVs/rwQXtv0EdQbEr1fEHbSHQtw2VoKa/pl7IwcmX3vGcxnXu/

vXkFXBeLneKtBPatO/nmvHey6BUyg04gZ58f+ecAYqUjSAfwGKK5dpCRHKViFqXMleIK

YHfVMJWFHy+iH9gVJTYyw6Ln0XDjOUTuUu15/UyDc6btSkFRWBhjt7V55Pk62+Dd21ao

O4jysIMbSJG11pMh3xDa/m1EOd65ovtigcdLy1uH3chY+Ks1lX4p89EkcNFkkCfgNr2l

srUw==

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1776869121; x=1777473921; darn=groups.outlook.com;

h=to:from:subject:date:message-id:sender:reply-to:mime-version:from

:to:cc:subject:date:message-id:reply-to;

bh=Qcznrz6dMXfhK6mVdeLuj7BHSjZW9UCiByt6meB7GPA=;

b=Cg2v9o5jDXNgKAPf/ZsUD4qeyXSoFGf9Fz8eerHYu59BKbEUIUJNW3afJqofkdwkL1

Pq0sH6Gw6/GtACdVfu7CRSa5d3TwqOTUt/TZlhH0fdPu2aO7A+FzBnvSTtU84Fc7QmN0

I4/tOFIKAsV2uBmSewtKUtDMziCiwpa6fHmL18BgB5pNniBC4KEqkKiWv6vKfJUTZ6fv

BVeowY40Fo6wuCo/GNGIJ5dvKmNFI4XaPaBrxkwmm0FtEADF8r4Z3YlKs4C0jpPFhb9X

rb5vL15x+EcihpeMbAbHIawQph/2WXF61bITMhG6r5SmYdLm8PlfDtT7SfB/Z8MJdjkZ

uS6g==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1776869121; x=1777473921;

h=to:from:subject:date:message-id:sender:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=Qcznrz6dMXfhK6mVdeLuj7BHSjZW9UCiByt6meB7GPA=;

b=a8qZ8wQ0Uj+zyIpTC5IaohI9yRKuj4/FhQpjgzorwOLu/aLJj71aCDHPUbPXaiw+zr

nwmjkfPekz+eoblBzO4j09paA2z/FM3+0fiElFZs/9jTqkmHOyV0wTloFabqZmJmE6Hx

RziBLgrAkLleF41p+HVpOJgryczbF68I2NT67HGQI2J026BNyNoebbva/7ltB4L90nnl

G/yKw1UIc5Jnh+R/11hqaZXWsK+rgwg1oXGwzUU0gygiLfZyDAREhB73IXV3Lp8Da06S

I4YLCVKsvLM9ZJdRecCHVtIyFVA99HMLAm9kMXR/WgnT+g/a1QvKp9yw/WKaLviGQ4LD

HEng==

X-Gm-Message-State: AOJu0YxEtN6M80n+S7JKi9wzxzGHepOJ7wkAdBaO5ukdkdBHScLPic9+

k2gzLbly3kP1+njgqOzXd+//n/4RJrVH5jflcZYvgcM+uTmqDslnrmYK7f3qi2q7chDKMl4q25A

4qrD2zgcaoDbGq9VH20+21aHIZfx+RV9C+QA=

MIME-Version: 1.0

X-Received: by 2002:a05:6820:4c06:b0:694:8f3a:3f41 with SMTP id

006d021491bc7-6948f3a4683mr5431110eaf.41.1776869120784; Wed, 22 Apr 2026

07:45:20 -0700 (PDT)

Reply-To: Haresasz Nxysarwsa

Sender: =?UTF-8?Q?Kalend=C3=A1r_Google?=

Message-ID:

Date: Wed, 22 Apr 2026 14:45:20 +0000

Subject: =?UTF-8?Q?Pozv=C3=A1nky=3A_Order_Processing_Notice_=2D_Payment_Confirm?=

=?UTF-8?Q?ed_=40_st_22=2E_apr_2026_=28cynthiaperez389903=40groups=2Eoutlook=2Ecom=29?=

From: Haresasz Nxysarwsa

To: cynthiaperez389903@groups.outlook.com

Content-Type: multipart/mixed; boundary="000000000000c1c0f406500d94f8"

X-IncomingHeaderCount: 15

X-EOPAttributedMessage: 0

X-EOPTenantAttributedMessage: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa:0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: DM2PEPF00003FC2:EE_|PH0PR18MB3848:EE_

X-MS-Office365-Filtering-Correlation-Id: bf3d12cb-f271-4597-be26-08dea07dc79c

X-MS-Exchange-EOPDirect: true

X-Sender-IP: 209.85.161.74

X-SID-PRA: HARESSAZNZXRRSXAXZ321@GMAIL.COM

X-SID-Result: PASS

X-MS-Consumer-Group-Expansion-Loop: cynthiaperez389903@groups.outlook.com

X-MS-Exchange-Group-Expansion-Loop: cynthiaperez389903@groups.outlook.com

X-Microsoft-Antispam:

BCL:0;ARA:1444111002|16200799027|9020799019|24102599021|6092099016|461199028|9000799056|26130799006|3151999006|9400799043|29080799006|6019299003|6149299003|1680799066|26000799027|5139299004|4040799016|4302099013|3412199025|440099028|2145499017|30041999003|26104999006|22062799003|18021999003|1380799030|1360799030|1370799030|21002599022;

X-Microsoft-Antispam-Message-Info:

=?utf-8?B?V2dJM0NtdC9Odk9XazJzWGwzaE03V2lwY1E4NG9rdEo1cGZhMVlCTDdYcHhu?=

=?utf-8?B?U1RqWFkxaWN2NWhjQ2NKSHlVajNGZmNXbWdtRlR0ZXV5SENsL2dxZGgwZEMz?=

=?utf-8?B?ZUdQc3dhOHgzSTgxMWtFSUhBOFZhdVN0RHY2YS9kN0h4OTZlcjJ0ellZQVlo?=

=?utf-8?B?OFhNT0d2eTlHOEhqYXRzL1Q4T3hWcy90Z2R1N0UwanFrWHR2YkxUSFZNdU9j?=

=?utf-8?B?ZW5FMWlaMWJRbi83UU1GeHpzVFNWcVV2K1c3WE0ya3dNQkFrSGF2SC9hK0ZI?=

=?utf-8?B?OWd4aEJKQ0M2dmdWWVAwVTFzbmRDNzZqalhYTTB1NVZpQTZuSHVZM1luc2pp?=

=?utf-8?B?cGIwNkhubk1aVisxRjh1VmgzYUFsdDNoMmpyYXJ4S1l5NFZFNDVsWTVmRnRL?=

=?utf-8?B?NG5uWHMwazFBR052dVY0alBTL2Iyak5zRjJsQUQxYWllUThVWlgxTmdpODFr?=

=?utf-8?B?QjgvdEI1dHA1blBwdElzcFVhb0c1NU1sYlN5dzB1bWZvQkRYM0RESTE2aWs5?=

=?utf-8?B?N1p0allPb1owem5BL0w1VGN3ay9ZOEJTN2d2VXplOEMzU0d4ZDNnTWV5OFBx?=

=?utf-8?B?NHlYK2tuS1dOT0hvQzhqQ2hIdXhIQ2hsMldIUyt4KytKQzNyTmRTcU1PQnk3?=

=?utf-8?B?dUY3STVVeXVtYXlsVUwrZ0xwUkxEWUxUMnJ0enExOC9FbGxuakcxN1Y5QnAw?=

=?utf-8?B?T0F6VkhoSklQNmZCNkpNUkRwOWNjY2dEVWlFR0o5TVNmVlJENUFmcjhpK1Z6?=

=?utf-8?B?SkI4NCtrak91QlNsSFZTUE5BTzhzSHRzd2JYYUVVcDV4R244YnpraGVSYjdi?=

=?utf-8?B?aDBVejRrcHdWSnU0WTJJbDAxdXNjcVhCb3ZsZmo0dDlTclhCTXVySmUwYXBC?=

=?utf-8?B?Umw1T21LY3dudmFULzRJQ29RYjRCZWdkemQrTUgxZlhPTTRqR2hHbTBTUEI4?=

=?utf-8?B?eVpWZmoxdFVmdDZRdFBhSHVWSlZFWlZRa3pxV0c3ZVlNSktuU1ZaUzBQeC93?=

=?utf-8?B?NHVsY3RzM3pJVW9DandVKzB1N3V1ODhQaWRjc0dyRUI3RVJKcnM2VDRiWXFI?=

=?utf-8?B?ZStHbzVzUVEwZGRDNmJDb3BXNkNwTHlYcHpTZlNDeXFOczZKSUkzbWxsNU5D?=

=?utf-8?B?OS9xdGwxNFJVdTUxbWhraXJVOVErbURFK3JVRHdIYWJzTzU5cUJ6dGlYd1B6?=

=?utf-8?B?eDVxdHRlcldyV3FKakU5K25tMUI4NjRUU0dzMXVCV3pSeU4vWURhWlJuVHhs?=

=?utf-8?B?ZEtTQ0hrNmpQZzQ1R3JPM0JSbTFJVzJ5b2hWLzI3NFliVHA5NFZvVXdEaVlr?=

=?utf-8?B?R2RkUUtyZ3B0eDZtY1Fnd29QbEpMUlM2V1NER0Fnampua0NRZUZxb3F5Z0Zj?=

=?utf-8?B?Z2JGZEhRYitWUjl1bktFMGdQRjVYcVRlNGE1ZURjTXRSRXQ4emREWk1lb1FJ?=

=?utf-8?B?V01ZT3pTTGw0aDUyaEZKL2RyVHNtTG40UkhKeGhqQ3ljaGxtQXF6R2ZZWE1W?=

=?utf-8?B?QnNDRE9ETEh4QU1xQWN0TTlNdGlGMVBZZm1vS3J6TkorUEhDTFpJbTl5MVdy?=

=?utf-8?B?SVNGMDIrT3RjSUNEQnp1TXhpTFRQVUplOUpGcjNxVVh0cW5qNjE4a284K1A4?=

=?utf-8?B?Qzl2WnU2NkRWaWZ1bW4xT2hycmw4bU5LYk1uUEh4U28wc25qdGIwNnQ1bmIv?=

=?utf-8?B?d2JJdndZK3I4b2pZaElzdVp1SFZWNmJiQm9sQk1FdVNRTXdsM3AvWWlidnN0?=

=?utf-8?B?d3pIUTVRc2x2cFZ0Z3hwdm1TZktkTmo0QjlJVjQ3WTFCOVBDa2lXOWNqdUcw?=

=?utf-8?B?ZG1mWFBJMHlaK1djYVhSaGkwcDB0V3A0Skh4dTJIVitNUlNtcEc2VWlEVDBn?=

=?utf-8?B?N1AzU0Izc2d0Qzh2cTVKTlAxWkR3MXVybnRyUUpjYmo5L0xnbldwcy9tS09S?=

=?utf-8?B?cG5rRHFLVkJVYVBnd3BBRGNFTVQvbnBNc3lUSE9rUHAvNDFwWElWNTZxQ2Ji?=

=?utf-8?B?eEIyNDJCMHJLRG5HMGFidGZYN3lUQW5MSjhHbGpoZDRQdWJKR2pOcy9lcVJk?=

=?utf-8?B?U0VQN3FINWxKTCtoWmhnbkhhbUlzZmRWYkdnNm41elBJbzRvYmhXbkx2NU55?=

=?utf-8?B?enowZXJwS29KRzg0Wmtpb09DU1NJZW1KZE90OThnVWNBTnB6Q3VzanVzQUtL?=

=?utf-8?B?b1VuTTNReUZVNHNXMWxtR2ZJSmNGcEQ5UU05c0UyWUpoRWdXZkJxRWdsRnAz?=

=?utf-8?B?UURNcVA5dUxsUFM1VCtqeWhIemdVNTk1WkxUTU9CcnVqMzk4ellrOUt2TTgw?=

=?utf-8?B?SWVkVDlTazJTd2NNRkYzTTFzQXJINDRlS3NISmZwQVByS1FHOFl0OENHVG5y?=

Norton Phish from Google Gmail Part 3

Posted by Dave Yadallee on
























































































--===============1534604035356672217==--

Norton Phish from Google Gmail Part 2

Posted by Dave Yadallee on