AAA Safety kit phish from Microsoft Outlook Part 4





Millions across the US north-east remain under a state of emergency after a severe winter storm brought nearly two feet of snow in some places, along with high winds and cold temperatures. Parts of Canada's Atlantic Coast have also been affected.



New York's Central Park recorded almost 20in (51cm) of snow, according to the National Weather Center, and Providence, Rhode Island, received 33in (83cm) of snow, smashing the existing record for the single greatest snowstorm, 28.6in (72.6cm) set in February 1978.



The snow has started to taper off, but with so much on the ground, it could take several days for life to return to normal on the East Coast.



Here is where things stand at the moment:



In New York, a travel ban that brought the city of over 8 million to a near standstill has been lifted

NYC Mayor Zohran Mamdani - who has been in office for only two months and has already experienced two major snow storms - announced that millions of students are taking a full snow-day off, meaning they did not have to attend online instruction or in-person school

No deaths have been recorded in New York as a result of the storm, Mamdani said at a news conference. The last storm in New York in January left 19 people dead

In neighbouring Connecticut and New Jersey, there are concerns that falling trees and branches loaded down by snow could lead to dangerous road conditions and more power outages

Massachusetts appears to have been hit the hardest with power outages. More than 284,000 households and businesses are without power, according to blackout tracker PowerOutage.us

Thousands of flights in and out of the affected area have been cancelled

In Rhode Island and Connecticut, state bans on non-essential travel are in place until further notice

Massachusetts Governor Maura Healey, who activated the state's National Guard ahead of the storm, told residents to check on neighbours and the elderly and "stay off the roads"



We are ending out live coverage for today, but you can read more about the blizzard and its aftermath here: More than 5,000 flights cancelled as US east coast digs out of record snow



'A very unique experience' - New Yorkers and visitors react to winter stormpublished at 22:25 23 February

22:25 23 February

Berliner Peggy Ferber speaks to Reuters from Times SquareImage source, Reuters

Image caption,



Berliner Peggy Ferber woke up early to visit Times Square in the snow



New Yorkers are no strangers to snow, but resident Mickey Blank says it "doesn't happen too often in the city that the road is covered and you have to go through mountains of snow".



Speaking to news agency Reuters, she describes today's conditions as "a very unique experience".



Some visitors to the city have been charmed by the conditions too.



Berliner Peggy Ferber is temporarily living in New York, and describes it as a "very special moment". She says she "woke up early" this morning to visit Times Square. It is "crazy" to see it "so empty", she says.



Sylvain Roy is visiting from Lille in France, and describes seeing snow in New York as "perfect".



Here are some pictures from around the city today:

A New York Street blanketed in snow with the skyscrapers of Lower Manhattan in the backgroundImage source, Getty Images

Image caption,



A thick blanket of snow left parts of Manhattan eerily quiet

People building a snowman in Times SquareImage source, Getty Images

Image caption,



People building a snowman in Times Square

A person in grey hooded coat and backpack walks through the snow outside Radio City Music HallImage source, Getty Images

Image caption,



There was no stopping some New Yorkers

A car coming through a large arch at the end of a bridge during a blizzardImage source, Getty Images

Image caption,



A travel ban meant there were very few cars on the road

People sledding on fresh snowImage source, Reuters

Image caption,



And a full snow day allowed many children to take to the parks with sleds

Cape Cod worst-hit by power outages in Massachusettspublished at 22:21 23 February

22:21 23 February



In Massachusetts, the county that contains the wealthy seaside enclave of Cape Cod is struggling to restore electricity.



More than 156,000 customers were without power in Barnstable County as of Monday evening, according to PowerOutage.us.



Entire neighbourhoods are without power, according to local media, due to strong winds blowing down trees laden with heavy snow, severing power lines.



Local power utility companies say they are working to rapidly restore service, but are being hampered by blowing snow and poor visibility. They plan to bring in work crews from neighbouring states.









--_0a435d48-51ac-44dd-ae80-3a94c99c8273_--

AAA Safety kit phish from Microsoft Outlook Part 2

Content preview: Your AAA safety kit reservation is available. Confirm your

delivery details while supplies remain. 🚗 AAA Member Safety Rewards Your

Roadside Kit Is Ready AAA members may qualify for a complimentary roadside

safety kit designed to help you stay prepared wherever you travel. Secure

your kit now while this member benefit is still available.



Content analysis details: (16.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[52.101.193.75 listed in dnsbl.ahbl.org]

[52.101.193.75 listed in dnsbl.ahbl.org]

[52.101.193.75 listed in dnsbl.ahbl.org]

[52.101.193.75 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[52.101.193.75 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[52.101.193.75 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[52.101.193.75 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[52.101.193.75 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[52.101.193.75 listed in will-spam-for-food.eu.org]

[52.101.193.75 listed in will-spam-for-food.eu.org]

[52.101.193.75 listed in will-spam-for-food.eu.org]

[52.101.193.75 listed in will-spam-for-food.eu.org]

[52.101.193.75 listed in will-spam-for-food.eu.org]

[52.101.193.75 listed in will-spam-for-food.eu.org]

[52.101.193.75 listed in will-spam-for-food.eu.org]

[52.101.193.75 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[52.101.193.75 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

3.5 VOWEL_FROM_7 Impronouncable from header (7+ consecutive vowels)

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[support.wfwp3jh1u7cwtexvhzgsfl0dypmv9m(at)harvardmedical84243.onmicrosoft.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[52.101.193.75 listed in wl.mailspike.net]

0.7 MPART_ALT_DIFF BODY: HTML and text parts are different

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 MIME_HTML_ONLY_MULTI Multipart message only has text/html MIME parts

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.0 VOWEL_URI_6 URI hostname with 6 consecutive vowels

0.0 FROM_MISSP_FREEMAIL From misspaced + freemail provider

1.8 COMBO_IMAGEONLY1 Appears to be an image only message

Subject: {SPAM?} Confirmation Needed For Your AAA Kit



--_0a435d48-51ac-44dd-ae80-3a94c99c8273_

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: 7bit

















Your AAA safety kit reservation is available. Confirm your delivery details while supplies remain.




































style="max-width:600px;background:#ffffff;border-radius:10px;

border:1px solid #e4e7ef;">































































































































🚗 AAA Member Safety Rewards













Your Roadside Kit Is Ready













AAA members may qualify for a complimentary roadside safety kit designed to help you stay prepared wherever you travel.



Secure your kit now while this member benefit is still available.



















🧰 Emergency Tools & Essentials















🔦 Safety Equipment for Roadside Situations















🚗 Compact Kit For Your Vehicle















⭐ Trusted By Thousands Of Drivers




















style="background:#e21b23;

color:#ffffff;

padding:16px 42px;

text-decoration:none;

border-radius:7px;

font-weight:bold;

font-size:17px;

display:inline-block;">



🚗 GET MY AAA KIT













✔ Simple request process

✔ Limited supply available

✔ One per household













⭐ AAA drivers appreciate the convenience and reliability of this safety kit for everyday travel.







AAA Member Services










style="color:#ffffff;text-decoration:underline;">



Unsubscribe























AAA Safety kit phish from Microsoft Outlook Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 24 Feb 2026 13:17:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vuyph-00000000PV5-0jQU

for dave@doctor.nl2k.ab.ca;

Tue, 24 Feb 2026 13:16:37 -0700

Resent-From: The Doctor

Resent-Date: Tue, 24 Feb 2026 13:16:37 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-northcentralusazon11020075.outbound.protection.outlook.com ([52.101.193.75]:57203 helo=CH1PR05CU001.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vuvVe-0000000016S-0t6w

for doctor@doctor.nl2k.ab.ca;

Tue, 24 Feb 2026 09:43:50 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=ZDgGSu30BbFuXv+3NTwgxtOoEhya8/fSVDDtwgjEX/W8KQJ/iUfXNlyrmcGCXsswikyJqa5dvHpMXCeYfdmUh62UX7TrOFIZB0cvq4auRDdlfLJpuxRjJ1r6f8EaH8EYUozvs6cP5mwwpBCEUZaQLrSeuxGGkahhCUWcQD3EOLtGrfJXJBm5fJj2sjn9xcFAT/E61S+qDkb3qC1+ibc6OYACTDFj5GNs1FumBAIfNqU423NZ7o/fNwMxHq4OrDJOzauFw7ZMj/D9Hs/bbqCc+j5Ed189GCo0noDd/StCQXhnSZRnrm95KszMDA4EsgkVguxE6GPumq1g23ZIuX+IWg==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=1RpGIMcdiXS2jYoPBWGyl2NGyjcBs7UtIy0HN0alNDA=;

b=rngjxfE8EwTXZwwYO+X4RizV3a++eQr7iD19Dwm720YKfhsCI3S1KExQamUdfiL9ehv2muEK0hjCJO+Z2WbOhMmPzfX6sEZtsQqOM1It8t+/mk62VzPh9kVCkUZtzNAUWH6PExdTdoflSIh7AnX4aXPZhYQX6X+s5MngTscZNu+AKwuawHEk42x4pRUzbEvtLmId5jcXWXb2u5JNKbvsjPlD0fSYaFc6htpEeCcEEx+ZKgEjt+s/C96xP6YzNXz60rYTS571lgwIJfH/ay/3tj041ODAIGE4JVRupk4Bc8u2JG3XLOaTrJjwGmi5B049qwOo3C1H5k6wI881Nh93fA==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=fail (sender ip is

185.139.228.109) smtp.rcpttodomain=doctor.nl2k.ab.ca

smtp.mailfrom=harvardmedical84243.onmicrosoft.com; dmarc=none action=none

header.from=harvardmedical84243.onmicrosoft.com; dkim=none (message not

signed); arc=none (0)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=harvardmedical84243.onmicrosoft.com;

s=selector1-harvardmedical84243-onmicrosoft-com;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=1RpGIMcdiXS2jYoPBWGyl2NGyjcBs7UtIy0HN0alNDA=;

b=JpOQ6JJn/pfDyILpfJt+SPs1PoWEQmx9UskiviKJYYukcHMCVnTXWfsOOPtjzYxeerTFZQNguHQ8NDOTKfvdwELfNHRVA5IXejtbsk5B5L6Y8CQ1FGqnde6XPK58uq8b8+vWGLbZwupakRSbXhZsSkX/jOQr6L5rP4SapI+Dex3G+o93e1SyNnltKNNwtaXobqiXgoR+Cr52yMiPvOfhjIe2W24GNmwclADQuJu4jXDB2lta5OzIlZcI76mjCwyTCWJnwy+fpJa1Zl9BtqM32LfPgDaI1MNG+mbtvVRVQKRB+d9rycrDuxcv7klCoy1vTRQx9HWeH/On2/HHLKFtMg==

X-MS-Exchange-Authentication-Results: spf=fail (sender IP is 185.139.228.109)

smtp.mailfrom=harvardmedical84243.onmicrosoft.com; dkim=none (message not

signed) header.d=none;dmarc=none action=none

header.from=harvardmedical84243.onmicrosoft.com;

Date: Tue, 24 Feb 2026 17:40:16 +0100

From: AAA Member Notice

To: doctor@doctor.nl2k.ab.ca

Subject: Confirmation Needed For Your AAA Kit

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="_0a435d48-51ac-44dd-ae80-3a94c99c8273_"

Precedence: bulk

X-Feedback-ID: 7748:44291301:campaign:sailthru2dnjisd

X-TM-ID: 20260224052743.44291301.4068652dnjisd

X-Info: Message sent by sailthru.com customer Morning Brew 2dnjisd

X-Info: We do not permit unsolicited commercial email 2dnjisd

X-Info: Please report abuse by forwarding complete headers to 2dnjisd

X-Info: abuse@ linkedin.com

X-Mailer: linkedin.com

X-JMailer: aws-campaign-mailer-4.sailthru.cloud

List-Unsubscribe-Post: List-Unsubscribe=One-Click

X-Unsubscribe-Web: https://link. linkedin.com/oc/r94eejqcrn3ggjvvup1cmhekwqa5begtudfd8y45ei3hvs3ywv1h2lfblfhewxofavew8qthuvcme8.2f7e7/97443e94

List-Unsubscribe: ,

X-rpcampaign: stlma4429132dnjisd

Message-ID:

<8409c410-033a-406d-b536-531fb7cfe4e9@BN1PEPF00006002.namprd05.prod.outlook.com>

X-EOPAttributedMessage: 0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: BN1PEPF00006002:EE_|LV5PR17MB7818:EE_

X-MS-Office365-Filtering-Correlation-Id: 875a082a-e759-4358-021f-08de73c3bda8

X-MS-Exchange-SenderADCheck: 1

X-MS-Exchange-AntiSpam-Relay: 0

X-Microsoft-Antispam:

BCL:0;ARA:13230040|4022899009|61400799027|376014|36860700013|34070700014|82310400026|85622059|54012099003|8096899003;

X-Microsoft-Antispam-Message-Info:

=?utf-8?B?YWxQQTNWUXNuM2l5MENGV1FTWHExbm82NnY3V01sQUJoM0xqemxPQWxwV2M2?=

=?utf-8?B?T2dXUjJhdzcvbk1CNGJXNUh5S0wwQzlOVDBFRnZKL09mckY5cHpoNi9xOWZi?=

=?utf-8?B?bnIxSjhNS2UvdGMwVjF0bzdiV0lXeUlvYmF4OWpJYU03UkkxeGhYaW8rdVNH?=

=?utf-8?B?eVpvTzJLUy9SZ09BN01iY096VGFaZlhsdFByMERNWXluN2prUXdqVzV3cFlY?=

=?utf-8?B?Zm9xWVdYeThpYitCUE9zeFVWRTJNSnRic0E0bnpubEJvZlB6eFRmYjNZMlB4?=

=?utf-8?B?WGdybzkzT1lkWUxTaVlETThtZE1XODMwVmhuNThzb2haUkFFVzc5YlNER2Ra?=

=?utf-8?B?bmRpSjBPWmFiK2p5N3B5cUNYQVRtRnlTYjVOYzJhNnJTTDFocWFhMndTTXE0?=

=?utf-8?B?QmYvcjN6ci9DNmtTMkkzQnIwT2RDc2FKZVpCMnBrU0N4VjVXRVZyNzNTWjZN?=

=?utf-8?B?bDQ5eFJ0aCt2OHpIaXlWdyt0eWszL3B3NEswMXUvYXlSMURBbGRHUmlCZ21w?=

=?utf-8?B?dlVDS0VLRW9xc3ErYlFZS3JxMWpNQjg3UTVIcHJVQ0NDTFFwY0ZpblJJZWRY?=

=?utf-8?B?TXZMMnZGejkraE1mU2VkTXJqUE43VVdrZ0pQeFJHRHlJcTU4bHk2aVpNNDFo?=

=?utf-8?B?S1h0VTdLZm80TFN6NXZMQ3hGZ1Y1bGtUd3liYVllaDJ1bEZWRTNVd1QzclRU?=

=?utf-8?B?QjVUNE1McEthU1F1S3VqSWtQT3BXaUtOTkFkeXR0WGVJd1ZOUmdObFo0aGt0?=

=?utf-8?B?aDB4RDdpUUlUU1VTSmlTVklTNDV1UTRPdHA3ckVyVXhnSGhYdk9Sa2xrb0Yr?=

=?utf-8?B?Uk9ZRXBaWityV01aV3JGdWdxV0pPY2Z1dDh1b3dEcGN1QmVPaXNqYzN2UFFC?=

=?utf-8?B?MVd1cjRldTJRd2t3WXpvSlBtOUIxN0tqQVJCYVh2N094SFNuUE05T2NGZlp6?=

=?utf-8?B?NEpiajRpdS9kZmYraHRBRGtuaVhGQ2xjSmJLS3llbXU4WlRabXE4SW0vNER4?=

=?utf-8?B?VUtwMUZ4eGhFb0Q3ZWdkNHp2cjg2ODl6TThjYWdpWUxEd3BIUzVVejZVTEJN?=

=?utf-8?B?NXNQUGZZd3Z4bi8rSzUxU1VwZDdTejB2VUhZSk5vWERKbXl6TnBqc1ZhYVFp?=

=?utf-8?B?RkM0UlVOLzhtU0c0NWVSLzRaVzlRTUxRU3EzenFlOWlQa3dXeXYwV09nUVli?=

=?utf-8?B?aWpmTk16S0hrRE8xdVFZYzJPblNCaisvdmhiV2VyU1UydGNQcHpWeG91MGU3?=

=?utf-8?B?NlJQcEZoa28yVjJxVHd6c2pHampUK3FEM2hJSDllZmhnY1Z5VmpsTmxIelEx?=

=?utf-8?B?MzhRRG51NUhZVmNqYjdmRHZZbmx4NFpSYnErTHVXcHE2RVNDdzZSclF2VXRQ?=

=?utf-8?B?Z3YxYndKa3JmRDcrZVliYUFLS1ZwQkV5dDlUQkFiL1B4N29yTzR5c2c5VENQ?=

=?utf-8?B?SFFYb2JjT2ZUWlVkSURYbFdKbnZQT0V2Yjg3bW9mdFRxUjVJNkRuN2dnU1lZ?=

=?utf-8?B?MVFVaDR1RlUxTTBibXJGTHhtbnNqSG16MENvWmJ0NlJwS3NIMFlWei9OOFR4?=

=?utf-8?B?OUlsenVocEdhT3hqYXNzTUU5Wit2T2tYME50ZnY4emp1NHNIQ0dFTzdXc3dH?=

=?utf-8?B?VCtBdlA3QjM2WmJ1ZG1Md0xqaDdzWG5UMTBUcitKNjhqc1FMNUxYd29oWndj?=

=?utf-8?B?RzVyV0RyV0hSWnA0Q2p1RHdOeWdKYTNESXRHam5RRDR1T3YvbDlVTDZHa2dr?=

=?utf-8?B?bEZuZmRzbWF6WkJVWHc2SXdRU3g4ODFQVVlRZERPTFErdlhLc2EwQ2lBNUpr?=

=?utf-8?B?MXZkbDllN2hYdzk2N3NkTE5DaGpTWUk0RjRGZ1F6aTFmOXA5RUdQa2R4bUhp?=

=?utf-8?B?VFNVblAzcFozNEJPRmpucThpOUwrdDdjbzlOT013SEthRDhHYmpkS0szT2Jl?=

=?utf-8?B?NC9JWE5YZnJ6ZmZPWCtySG5TMlkrbHdXazBGakJXb3EraGVUd2U1eGFQbHBO?=

=?utf-8?B?cnltdzFPR3RmMFZmSDlpTFcrRDBZT1o3Um95S0xzYXRTYkE0TGk3M0NSeDl0?=

=?utf-8?B?OHhrUDJLQUFZVmlWUFpscVVRR3lpV1NPZnJkbnNjME9pVWw1eXM2SGtqYnVG?=

=?utf-8?B?V1ZjckVEL1lTRjlrQ2V0ZVYwZTFBOFE1c1NSYVBCTkRJMEs0eE1ka3NBSG9S?=

=?utf-8?Q?6LVrc6m0PcgDaqRdDDGxIOs=3D?=

X-Forefront-Antispam-Report:

CIP:185.139.228.109;CTRY:SE;LANG:en;SCL:1;SRV:;IPV:CAL;SFV:NSPM;H:harvardmedical84243.onmicrosoft.com;PTR:InfoDomainNonexistent;CAT:NONE;SFS:(13230040)(4022899009)(61400799027)(376014)(36860700013)(34070700014)(82310400026)(85622059)(54012099003)(8096899003);DIR:OUT;SFP:1102;

X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1

X-MS-Exchange-AntiSpam-MessageData-0:

/Uea6cvhnFpbsyo6SlJtQLIKdywj+DjrFlPraY/Wc1JpTj1OscgBKQfjLl1kkM5JD6oHCHbbpxNjNEepzAyJCOYkncYrIw+pN9G12XgHPE7Kls9Ql2jHWeLEnpGldfVEGWVkSe0T9IFTOKkplWII+/EYOUCGNiaGMx4x4P9rxmXDUQpAl69JpfJJfHPYesxEVwSBZ6W/jEqqqMQRE+gOP0AxmVwLVlD7ocWMfCxhziQTA/1gpbGlrrc4qZBWk8fumto9XSl9QAsTfwDEdY7an248rwIn7QzP3gGHlThYq97CHniYRPLa+RC8WJAKl1i/Km/by5OAnmUauCydS9rSSQ8PkpPr/cN0vV60vwGog3GPc2blZ2Kr1E/L5E9L7MQo/NruQDK48aBLAbs0h6P9p5H7RA8mPlh4EtDxHaBGz9I/ykrAuYcIQy98JV7runJl

X-OriginatorOrg: harvardmedical84243.onmicrosoft.com

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 24 Feb 2026 16:42:46.7836

(UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id: 875a082a-e759-4358-021f-08de73c3bda8

X-MS-Exchange-CrossTenant-Id: 387640f3-cfd3-49db-9cf9-c3c38e0301c1

X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=387640f3-cfd3-49db-9cf9-c3c38e0301c1;Ip=[185.139.228.109];Helo=[harvardmedical84243.onmicrosoft.com]

X-MS-Exchange-CrossTenant-AuthSource:

BN1PEPF00006002.namprd05.prod.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem

X-MS-Exchange-Transport-CrossTenantHeadersStamped: LV5PR17MB7818

X-Spam_score: 16.1

X-Spam_score_int: 161

X-Spam_bar: ++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Paypal Cryptocurrency phish from Google Gmail

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 24 Feb 2026 13:16:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vuyov-00000000PSw-0fN6

for dave@doctor.nl2k.ab.ca;

Tue, 24 Feb 2026 13:15:49 -0700

Resent-From: The Doctor

Resent-Date: Tue, 24 Feb 2026 13:15:49 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pl1-f196.google.com ([209.85.214.196]:41988)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vuuim-00000000P8X-41ju

for doctor@doctor.nl2k.ab.ca;

Tue, 24 Feb 2026 08:53:23 -0700

Received: by mail-pl1-f196.google.com with SMTP id d9443c01a7336-2ad21f437eeso39498705ad.0

for ; Tue, 24 Feb 2026 07:52:26 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=kb-ac-th.20230601.gappssmtp.com; s=20230601; t=1771948340; x=1772553140; darn=doctor.nl2k.ab.ca;

h=mime-version:subject:from:to:date:message-id:from:to:cc:subject

:date:message-id:reply-to;

bh=D0XUpaHNaNjS5BkxHPnYVtDCV8uAVqfgEi5nVg/IkuM=;

b=bocjgltOgZQq7FYeFS/HTZOxnXrpVCfv/AhrUkiflyrdHTf/VKk63gxoEdN7xjKELL

ls4xoX4XTbAUwbA4WEeDqZ0EBiFDEOm/Lk+HT1BB6dpK/Zwrdke5bsInmMtO5FFnF+bv

wcJmeSiexaMfmnA3nhbQQivDwVdMimfhgp5InDa3Mqr288jJnsm0a38yQsxrZglV95GV

yg6a40s3Oi91r0OcZaQWQGMjISKJbAArx4nj636tWDQ8nEOffzxRtJAeBpv/DiwvbHAV

a+aC/dTxsR/MWJgD946RMSTQ/5qwsmGnf97Ow8HhfZ3xVnb8sKzXCCAgT/Z4WvewTTT0

QucA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1771948340; x=1772553140;

h=mime-version:subject:from:to:date:message-id:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=D0XUpaHNaNjS5BkxHPnYVtDCV8uAVqfgEi5nVg/IkuM=;

b=bv4PsZgFi/7pgUaFWU1rlLmDZ9zd8S18Acd+wDPN/xWI9Txz5ySi4haXuzzwKYc9zb

Jge5x1hg8nanoFNR+HZlJwUWU13vgfnLOahyRcpdZA6IxTv3MWP889BbpwprbBcUnSLA

4oonTERgtLkK5aVFiQvPVXNq9o1yKHtDTq0xbyAYpL0wOr6HP6MNygkFEiafVpkmJ0tt

/18IY0zGSBkW2q4b13Tm5kHd2ANUxD0T2Q7/T26tEo+F8EEHrGzmd1J3AckenKq4C3/I

WZiTP1ArFTF/6E/Fxpx4Reh0A0c7vVpRju5wpOwD3D+wXnCucSTMz+n33F5LwjQg26pw

Hdpg==

X-Gm-Message-State: AOJu0YztwfIiUSVrY62juyDvth3uJ5Tu/xR0boJbWArgo2SqpN09cdzR

xxLalIsEW3ke3Ric2NcGVWTUnEu6GqfNDZ4xTXSie3wA7QS3V9GhnCBf2WIl59jUr0le9RemekU

l/g4zcFRsjmoK

X-Gm-Gg: ATEYQzwiVrGzp1JEE9YcGjjREpEa22Ftf8QiGAmRGMJMC3JYH9P/wKUQrI0n6vFR12T

kFm3YZwrU0kadIuCZFRFTkCRO63pV0WJNfxHzCdraTPWzKaWAPBPuZJTRqchit3BQ+URFATHYBL

qGVzdCGB1mprCvIeMOE26n8La+Xc24LrZJkjA/Bs/Az41TWSQZaByZT014h/LubT0zE5nHgSSuK

gg7c2rH8zD9qjv8ku26EXY5pJEuHXqRfxlNaZ0X/jTwGrPCPxfUBvXT0xumGr+4lKuo3Sa+nV8o

ISE2QheyJUmB1/FnLjwn6RDIXzakFwj2V8bM98kG3HxETx7yW6yMgqdgn9CgTAP9nJeXqECl7Si

BElbCN6BDn+Mvm9pv/4U1/k5kw2OdQSXgPU5TKQ1yWuFslHxDHbkKedsOb/T6IvAfvZC5L/ZhfA

est2vzzeSWfo42TjpVb/dYG7dc6w==

X-Received: by 2002:a17:903:478d:b0:2a0:9934:a3f3 with SMTP id d9443c01a7336-2adbde00864mr2684575ad.24.1771948339658;

Tue, 24 Feb 2026 07:52:19 -0800 (PST)

Received: from pc ([59.153.17.129])

by smtp.gmail.com with ESMTPSA id d9443c01a7336-2ad7500e19fsm114409795ad.59.2026.02.24.07.52.17

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Tue, 24 Feb 2026 07:52:19 -0800 (PST)

Message-ID: <699dc933.170a0220.22d14e.f48d@mx.google.com>

Date: Tue, 24 Feb 2026 07:52:19 -0800 (PST)

To:

From: Invoice PayPal

Subject: System Update: NUJ4DZE is Active

MIME-Version: 1.0

Content-Type: multipart/mixed; boundary=ouVax78zTtUVLvLZvM1utJ

X-Spam_score: 16.4

X-Spam_score_int: 164

X-Spam_bar: ++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: ppl Invoice



Content analysis details: (16.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.214.196 listed in dnsbl.ahbl.org]

[209.85.214.196 listed in dnsbl.ahbl.org]

[209.85.214.196 listed in dnsbl.ahbl.org]

[209.85.214.196 listed in dnsbl.ahbl.org]

[59.153.17.129 listed in dnsbl.ahbl.org]

[59.153.17.129 listed in dnsbl.ahbl.org]

[59.153.17.129 listed in dnsbl.ahbl.org]

[59.153.17.129 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.214.196 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.214.196 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.214.196 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.214.196 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[59.153.17.129 listed in will-spam-for-food.eu.org]

[59.153.17.129 listed in will-spam-for-food.eu.org]

[59.153.17.129 listed in will-spam-for-food.eu.org]

[59.153.17.129 listed in will-spam-for-food.eu.org]

[59.153.17.129 listed in will-spam-for-food.eu.org]

[59.153.17.129 listed in will-spam-for-food.eu.org]

[59.153.17.129 listed in will-spam-for-food.eu.org]

[59.153.17.129 listed in will-spam-for-food.eu.org]

[209.85.214.196 listed in will-spam-for-food.eu.org]

[209.85.214.196 listed in will-spam-for-food.eu.org]

[209.85.214.196 listed in will-spam-for-food.eu.org]

[209.85.214.196 listed in will-spam-for-food.eu.org]

[209.85.214.196 listed in will-spam-for-food.eu.org]

[209.85.214.196 listed in will-spam-for-food.eu.org]

[209.85.214.196 listed in will-spam-for-food.eu.org]

[209.85.214.196 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.214.196 listed in list.dnswl.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[59.153.17.129 listed in zen.spamhaus.org]

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Listed by XBL, see ]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[59.153.17.129 listed in sbl-xbl.spamhaus.org]

[59.153.17.129 listed in sbl-xbl.spamhaus.org]

0.6 J_CHICKENPOX_23 BODY: 2alpha-pock-3alpha

0.6 J_CHICKENPOX_33 BODY: 3alpha-pock-3alpha

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.214.196 listed in wl.mailspike.net]

2.0 BASE64_LENGTH_79_INF BODY: base64 encoded email part uses line length

greater than 79 characters

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to

background

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.5 VOWEL_FROM_5 Impronouncable from header (6 consecutive vowels)

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

Subject: {SPAM?} System Update: NUJ4DZE is Active







Invoice





kPayPals

Invoice Number: RDS73XSE

Date of Issue: February 24,2026

Stripe

2660 Monterey Rd,

San Jose, CA 95111

USA

Billed to



PayPal Stripe User

$657.99 USD due February 24,2026

YOU'VE SENT A PAYMENT OF $657.99 USD TO COINBASE CORPORATION

It may take a few moments for this transaction to appear in your statement.

Issues with this transaction?

If you have any questions about your order, please contact us within 12 hr by calling at +1 803-368-4347.

Description Qty Unit price Amount

Btc Purchased 1 $657.99 USD $657.99 USD

Subtotal $657.99 USD

Total $657.99 USD

Amount due $657.99 USD

Don’t recognize this transaction? Contact PayPal+1 803-368-4347 For dispute/claim

Copyright © 1999-2026 PayPal, Inc. All rights reserved. PayPal is located at 2660 Monterey Rd,San Jose, CA 95111.

Paypal cryptocurrency phish from Google Gmail Part 4


/InformAction">
emtype=3D"http://schema.org/EmailMessage">
ntent=3D"Alex Mateer: PayPal Paypal LLC Exchange Confirmation Hi, Your exch=

ange request for Coinbase valued at $547.29 has been verified. Reference Co=

de: 6f161356b3d9 Date & Time: 2026-02-24 23:04:51 Wallet Address: 12606=

0dd-439a-4c0e-8c35-b85918977a4d Qty: 0.019 If this activity was not initiat=

ed by you, please notify us immediately. Customer Service Line: { 1-810- 29=

3-0364 } Paypal Support Team . . . . . . . . . . . . . . . . . . . . . . . =

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .=

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . =

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .=

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . =

. . . . . . . . . . . . ."/>

type=3D"http://schema.org/Event">
http://schema.org/EventScheduled"/>
temtype=3D"http://schema.org/Organization">
=3D"Google Calendar"/>

ent=3D"t8u4aj78hfdb91s5cinmqu4r48"/>
: 1px; color: #fff; line-height: 1px; height: 0; max-height: 0; width: 0; m=

ax-width: 0; opacity: 0; overflow: hidden;" itemprop=3D"name">An arrangemen=

t no. {5cc1743 was made by member

ellpadding=3D"0" cellspacing=3D"0" role=3D"presentation" align=3D"center" s=

tyle=3D"width:100%;" class=3D"body-container">=


ss=3D"" align=3D"left">
=

 

=3D"0" cellpadding=3D"0" cellspacing=3D"0" role=3D"presentation" align=3D"c=

enter" style=3D"width:100%;" class=3D"">

" align=3D"left">
">

PayPal
Paypal LLC Exchange Confirmation

=

Hi,

Your exchange request for Coinbase valued at $547.29 has been verifie=

d.

Reference Code: 6f161356b3d9
Date & Time: 2026-02-24 23:04:51
r>Wallet Address: 126060dd-439a-4c0e-8c35-b85918977a4d
Qty: 0.019

If t=

his activity was not initiated by you, please notify us immediately.

Cust=

omer Service Line: { 1-810- 293-0364 }

Paypal Support Team
.
.
.=


.
.
.
.
.
.
.
.
.
.
.
.
.
.
.=


.
.
.
.
.
.
.
.
.
.
.
.
.
.
.=


.
.
.
.
.
.
.
.
.
.
.
.
.
.
.=


.
.
.
.
.
.
.
.
.
.
.
.
.
.
.=


.
.
.
.
.
.
.
.
.
.
.
.
.
.
.=


.
.
.
.
.
.
.
.
.
.
.
.
.
.
.=


.
.
.
.
.
.
.
.
.
.
.
.
.
.
.=


.
.
.
.
.
.
.
.
.
.
.
.
.
.
.=


.
.
.
.
.
.
.
.
.
.
.
.
.
.
.=


.
.
.
.
.
.
.
.
.
.
.
.
.
.
.=


.
.
.
.
.
.
.
.
.
.
.
.
.
.
.=


.
.
.
.
.
.
.
.
.
.
.
.
.
.
.=


.
.
.


lpadding=3D"0" cellspacing=3D"0" role=3D"presentation" align=3D"center" sty=

le=3D"width:100%;" class=3D"">

dce0; border-radius: 8px; direction: rtl; font-size: 0; padding: 24px 32px;=

text-align: left; vertical-align: top;" class=3D"main-container-inner">
-[if mso | IE]>
=3D"presentation">

text-align: left; direction: ltr; display: inline-block; vertical-align: t=

op; width: 100%;overflow: hidden; word-wrap: break-word;">

0" cellpadding=3D"0" cellspacing=3D"0" role=3D"presentation" width=3D"100%"=

class=3D"main-column-table-ltr" style=3D"padding-right: 32px; padding-left=

: 0;;table-layout: fixed;">

"padding:0; vertical-align:top;">
spacing=3D"0" role=3D"presentation" width=3D"100%" style=3D"table-layout: f=

ixed;">

eak: break-word;;padding-bottom:2px;">

e Sans', Roboto, sans-serif;font-weight: 400; font-size: 22px; line-hei=

ght: 28px;color: #3c4043; text-decoration: none;" class=3D"primary-text" ro=

le=3D"presentation">An arrangement no. {5cc1743 was=

made by member

g: 0; text-align: left; word-break: break-word;;padding-bottom:24px;">

style=3D"font-family: Roboto, sans-serif;font-style: normal; font-weight: 4=

00; font-size: 14px; line-height: 20px; letter-spacing: 0.2px;color: #3c404=

3; text-decoration: none;" class=3D"primary-text" role=3D"presentation">
an aria-hidden=3D"true">

style=3D"font-size: 0; padding: 0; text-align: left; word-break: break-word=

;;padding-bottom:24px;">

style: normal; font-weight: 400; font-size: 14px; line-height: 20px; letter=

-spacing: 0.2px;color: #3c4043; text-decoration: none;" class=3D"primary-te=

xt" role=3D"presentation">
=3D"0" role=3D"presentation" style=3D"padding-bottom: 4px;">


ss=3D"primary-text" style=3D"font-size: 14px;color: #3c4043; text-decoratio=

n: none;font-weight: 700;-webkit-font-smoothing: antialiased;margin: 0; pad=

ding: 0;">Organizer


pan class=3D"notranslate">
e=3D"display: inline-block;;color: #3c4043; text-decoration: none;" href=3D=

"mailto:supramaikal4@accesskeymf.org">Alex Mateer

=3D"organizer" itemscope itemtype=3D"http://schema.org/Person">
op=3D"name" content=3D"Alex Mateer"/>
pramaikal4@accesskeymf.org"/>

class=3D"secondary-text underline-on-hover" style=3D"display: inline-block=

;;color: #70757a; text-decoration: none;" href=3D"mailto:supramaikal4@acces=

skeymf.org">supramaikal4@accesskeymf.org

tyle=3D"font-size: 0; padding: 0; text-align: left; word-break: break-word;=

;padding-bottom:24px;">

tyle: normal; font-weight: 400; font-size: 14px; line-height: 20px; letter-=

spacing: 0.2px;color: #3c4043; text-decoration: none;" class=3D"primary-tex=

t" role=3D"presentation">
=3D"0" role=3D"presentation" style=3D"padding-bottom: 4px;">


ss=3D"primary-text" style=3D"font-size: 14px;color: #3c4043; text-decoratio=

n: none;font-weight: 700;-webkit-font-smoothing: antialiased;margin: 0; pad=

ding: 0;">Guests

(Guest list has been hidden at organ=

izer's request)


--000000000000f1f978064b93352e--

Paypal cryptocurrency phish from Google Gmail Part 3



=20



=20



=20



=20

















Paypal cryptocurrency phish from Google Gmail Part 2

--000000000000f1f978064b93352e

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes

Content-Transfer-Encoding: base64



UGF5UGFsIFBheXBhbCBMTEMgRXhjaGFuZ2UgQ29uZmlybWF0aW9uIEhpLCBZb3VyIGV4Y2hhbmdl

IHJlcXVlc3QgZm9yICANCkNvaW5iYXNlIHZhbHVlZCBhdCAkNTQ3LjI5IGhhcyBiZWVuIHZlcmlm

aWVkLiBSZWZlcmVuY2UgQ29kZTogNmYxNjEzNTZiM2Q5ICANCkRhdGUgJiBUaW1lOiAyMDI2LTAy

LTI0IDIzOjA0OjUxIFdhbGxldCBBZGRyZXNzOiAgDQoxMjYwNjBkZC00MzlhLTRjMGUtOGMzNS1i

ODU5MTg5NzdhNGQgUXR5OiAwLjAxOSBJZiB0aGlzIGFjdGl2aXR5IHdhcyBub3QgIA0KaW5pdGlh

dGVkIGJ5IHlvdSwgcGxlYXNlIG5vdGlmeSB1cyBpbW1lZGlhdGVseS4gQ3VzdG9tZXIgU2Vydmlj

ZSBMaW5lOiB7ICANCjEtODEwLSAyOTMtMDM2NCB9IFBheXBhbCBTdXBwb3J0ICANClRlYW0gLiAu

IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g

LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu

IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g

LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu

IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g

LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu

IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4NCg0KQW4gYXJyYW5nZW1lbnQgbm8uIHs1Y2MxNzQz

IHdhcyBtYWRlIGJ5IG1lbWJlcg0KTW9uZGF5IEZlYiAyMyDii4UgMTFwbSDigJMgVHVlc2RheSBG

ZWIgMjQsIDIwMjYg4ouFIDEwOjMwcG0NCkNlbnRyYWwgVGltZSAtIENoaWNhZ28NCg0KDQoNCk9y

Z2FuaXplcg0KQWxleCBNYXRlZXINCnN1cHJhbWFpa2FsNEBhY2Nlc3NrZXltZi5vcmcNCg0K

--000000000000f1f978064b93352e

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable




schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-microsoft-com:office:offi=

ce">
t=3D"text/html; charset=3DUTF-8">
=3Ddevice-width,initial-scale=3D1">
ight dark">

















Paypal cryptocurrency phish from Google Gmail Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 24 Feb 2026 08:40:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vuuVn-00000000OdZ-1Gso

for dave@doctor.nl2k.ab.ca;

Tue, 24 Feb 2026 08:39:47 -0700

Resent-From: The Doctor

Resent-Date: Tue, 24 Feb 2026 08:39:47 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ot1-f74.google.com ([209.85.210.74]:53372)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vutyv-00000000NP7-3rDF

for root@nk.ca;

Tue, 24 Feb 2026 08:06:00 -0700

Received: by mail-ot1-f74.google.com with SMTP id 46e09a7af769-7d4beae6581so64841032a34.2

for ; Tue, 24 Feb 2026 07:05:03 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=google.com; s=20230601; t=1771945497; x=1772550297; darn=nk.ca;

h=from:subject:date:message-id:sender:reply-to:mime-version:from:to

:cc:subject:date:message-id:reply-to;

bh=iHd9gDhz8w72phiMZvBMkDyzb1LEmL+hi70aFq0j+nQ=;

b=r/+wzgA8KL4PxfUR2EpfdgTQzlh2FKY3WFYEJo6YJRwU0/dC27/MLm8YTOfAak7dQn

A7mqUa0bhS3y+nLoUlS02kv+ybPD89NOTgOtJdF1OBg5woeLjgATYkAmDl/LDDS1zYpP

IHAlVxPVDtgjrKba34hdulKkhn0kS9aF3nvZ3sCbwbPLb7hFJTBQZXhDdDRCqsNEcR3M

hVTUfrpG0jRb6sytR3ze8FQgimBTe7ovuuR3Vff+J/9ybmDPtfJP9SnkodtbO2HPRS7h

iizsYZnbC5LxDoZqFvslYQRmVugihtaC6F9LmwVhwblAl754aLby+r3ZnAKQ5lUmlHXl

NzlQ==

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=accesskeymf-org.20230601.gappssmtp.com; s=20230601; t=1771945497; x=1772550297; darn=nk.ca;

h=from:subject:date:message-id:sender:reply-to:mime-version:from:to

:cc:subject:date:message-id:reply-to;

bh=iHd9gDhz8w72phiMZvBMkDyzb1LEmL+hi70aFq0j+nQ=;

b=O+sKP9T48JjoGl2iRbizuRAETHNTQ7J0tREQvzo0udkQm2gC10RQZXTedazVado75g

xf3lBvnHC0M7LMTTyGT/9/psRxO6bTQEZ0qkcRNL32/dffBwEEcHuETjqX52+Nft6hJD

n2MGqDMgLtxXyvXLuktJG1pHcVoGuB1YdLOWxnFy2CJcPmvLJGgyUcugt+2peBhhqXvI

EvIQp9B8waAayDcW/ErJvD7vrIQXRdG8+ouCZ5Boq3NeN4v6ty2WIPKDVD6o5dT62yIK

W8O1s7BYZnrHDlNF01rUYDmldW6GuqCxXLc/nP29HC8onqOBa2iPtImBxslgdVLHn6S9

PZeQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1771945497; x=1772550297;

h=from:subject:date:message-id:sender:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=iHd9gDhz8w72phiMZvBMkDyzb1LEmL+hi70aFq0j+nQ=;

b=suwreVVHLDsA6lGO/QXN+0FadZPDM/RKFDTmKo/37tuD2GFi478PhitHOeYMEhlMG9

52PYkFAVIA/dPUD9mWPy8XCRz9d/CyIYaJxvJyUTaPRtztX23lmcpS1Yn2G4KRIqB7O+

ZjzgJ3FuX211zZ8HeIWAYqgQRUlXpJmKWzPSnQHc9eV/KDVvVckQZPJsAV6caQevgO+r

sz4D05R2Pq3AkMsy4BGwY7jv5UMSaTQZoEtSpcu39Li6VUIRwLW8uMsvtr9drHtBmi4g

1eEmEe+ugCukhPf9XKEUmnVwPcmM+EZjVosF/SvpSjUUDTlI7rFX1kMMenJMVcbFNQmg

xtpQ==

X-Forwarded-Encrypted: i=1; AJvYcCXMqJYrGVRlrnNfSYbRU55NV8npc4920DiZn1iCJAA4PHzCPj4epyXgcvndodmoLoG9JW+E@nk.ca

X-Gm-Message-State: AOJu0YwxfZFo5QgezrKKIzMd74A20x/fDIMEKy59ovS+1BA+JpVXQU3r

xgixmW5AOfW7LWHMxa1uWF2JgHB4TvMHWpsV6gFo95S1imVMPWe0F+sXKtxigPfwkg0JJ2MJi2v

u0w8EnXxGhDIPnSvwYOqGSpXajP8m5qiICCyCC1zhVR5Oqw==

MIME-Version: 1.0

X-Received: by 2002:a05:6820:80c6:b0:678:1941:c633 with SMTP id

006d021491bc7-679c4257804mt10035432eaf.12.1771945497331; Tue, 24 Feb 2026

07:04:57 -0800 (PST)

Reply-To: Alex Mateer

Sender: Google Calendar

Message-ID:

Date: Tue, 24 Feb 2026 15:04:57 +0000

Subject: An arrangement no. {5cc1743 was made by member

From: Alex Mateer

Content-Type: multipart/alternative; boundary="000000000000f1f978064b93352e"

X-Spam_score: 9.4

X-Spam_score_int: 94

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: PayPal Paypal LLC Exchange Confirmation Hi, Your exchange

request for Coinbase valued at $547.29 has been verified. Reference Code:

6f161356b3d9 Date & Time: 2026-02-24 23:04:51 Wallet Address: 126060 [...]





Content analysis details: (9.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.210.74 listed in dnsbl.ahbl.org]

[209.85.210.74 listed in dnsbl.ahbl.org]

[209.85.210.74 listed in dnsbl.ahbl.org]

[209.85.210.74 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.210.74 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.210.74 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.210.74 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.210.74 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.210.74 listed in will-spam-for-food.eu.org]

[209.85.210.74 listed in will-spam-for-food.eu.org]

[209.85.210.74 listed in will-spam-for-food.eu.org]

[209.85.210.74 listed in will-spam-for-food.eu.org]

[209.85.210.74 listed in will-spam-for-food.eu.org]

[209.85.210.74 listed in will-spam-for-food.eu.org]

[209.85.210.74 listed in will-spam-for-food.eu.org]

[209.85.210.74 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.210.74 listed in list.dnswl.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[209.85.210.74 listed in sa-accredit.habeas.com]

0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The

query to Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[209.85.210.74 listed in sa-trusted.bondedsender.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.2 MISSING_HEADERS Missing To: header

0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[209.85.210.74 listed in bl.score.senderscore.com]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.210.74 listed in bl.score.senderscore.com]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.210.74 listed in wl.mailspike.net]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.9 REPLYTO_WITHOUT_TO_CC No description available.

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

3.0 LONG_INVISIBLE_TEXT Long block of hidden text - bayes poison?

Subject: {SPAM?} An arrangement no. {5cc1743 was made by member

Web/SEO/App spam from Microsoft Outlook Part 3

--_000_SJ2P220MB161036B68AC4DEA5E3D744EE8B74ASJ2P220MB1610NAMP_

Content-Type: text/html; charset="us-ascii"

Content-Transfer-Encoding: quoted-printable




osoft-com:office:office" xmlns:w=3D"urn:schemas-microsoft-com:office:word" =

xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" xmlns=3D"http:=

//www.w3.org/TR/REC-html40">




>








break-word">



Hi,
span>



 
>



Hope you are doi=

ng well. I am still waiting for your response.



 
>



Do let me know i=

f you are interested and I would be happy to share with you more details ab=

out our past work client testimonials and price list.



 
>



I am looking for=

ward to a positive response from you soon.



 
>



Thanks & Reg=

ards,



 
>



From: Sakshi Sin=

gh


Sent: Monday, January 26, 2025 5:01 PM


To: 'dave@doctor.nl2k.ab.ca' <dave@doctor.nl2k.ab.ca>


Subject: RE: Website Design & Development Proposal at low Cost
p>



 
>



Hello, &nbs=

p;        



  &nbs=

p;        



Hope you have a =

great day!!          
>



  &nbs=

p;        



We are a profess=

ional website development company, based in India with a str=

ength of 150+ employees and a great portfolio to boast about. We are differ=

ent because we provide the resources you need on a

short-term, long-term and hourly basis.      =

;    



  &nbs=

p;        



If you're really=

looking to build a pixel perfect decent website or want to re-de=

velop your previous website, then please share the details with us. We=

can assure you for a great design.      =

;    



  &nbs=

p;        



Our Develop=

ment Services/Resources include: -      =

    



  &nbs=

p;        



• &nb=

sp;   Website Design/Revamp/Upgrade   &n=

bsp;      



  &nbs=

p;  



• &nb=

sp;   Custom Web Based Software     =

;     



  &nbs=

p;  



• &nb=

sp;   Portal/Marketplace      =

    



  &nbs=

p;  



• &nb=

sp;   E-commerce development    &nb=

sp;     



  &nbs=

p;        



Just keep an ope=

n mind and If any of this sounds something of your interest, then feel shar=

e your requirements and I would be happy to send you details about our comp=

any, pricing along with an estimated

timeline for your project/s.       &nbs=

p;  



  &nbs=

p;        



Looking forward =

to hearing from you.         &=

nbsp;



  &nbs=

p;        



Warm Regards,&nb=

sp;         
=



Sakshi
>



Business Develop=

ment manager



 
>











--_000_SJ2P220MB161036B68AC4DEA5E3D744EE8B74ASJ2P220MB1610NAMP_--

Web/SEO/App spam from Microsoft Outlook Part 2

Content preview: Hi, Hope you are doing well. I am still waiting for your response.

Do let me know if you are interested and I would be happy to share with you

more details about our past work client testimonials and price list.



Content analysis details: (5.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[52.103.11.17 listed in dnsbl.ahbl.org]

[52.103.11.17 listed in dnsbl.ahbl.org]

[52.103.11.17 listed in dnsbl.ahbl.org]

[52.103.11.17 listed in dnsbl.ahbl.org]

[2603:10b6:a03:595:0:0:0:14 listed in]

[dnsbl.ahbl.org]

[2603:10b6:a03:595:0:0:0:14 listed in]

[dnsbl.ahbl.org]

[2603:10b6:a03:595:0:0:0:14 listed in]

[dnsbl.ahbl.org]

[2603:10b6:a03:595:0:0:0:14 listed in]

[dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[52.103.11.17 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[52.103.11.17 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[52.103.11.17 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[52.103.11.17 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[2603:10b6:a03:595:0:0:0:14 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:595:0:0:0:14 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:595:0:0:0:14 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:595:0:0:0:14 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:595:0:0:0:14 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:595:0:0:0:14 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:595:0:0:0:14 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:595:0:0:0:14 listed in]

[will-spam-for-food.eu.org]

[52.103.11.17 listed in will-spam-for-food.eu.org]

[52.103.11.17 listed in will-spam-for-food.eu.org]

[52.103.11.17 listed in will-spam-for-food.eu.org]

[52.103.11.17 listed in will-spam-for-food.eu.org]

[52.103.11.17 listed in will-spam-for-food.eu.org]

[52.103.11.17 listed in will-spam-for-food.eu.org]

[52.103.11.17 listed in will-spam-for-food.eu.org]

[52.103.11.17 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[52.103.11.17 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[allin.sakshi1420(at)hotmail.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[allin.sakshi1420(at)hotmail.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[52.103.11.17 listed in wl.mailspike.net]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} RE: Website Design & Development Proposal at low Cost



--_000_SJ2P220MB161036B68AC4DEA5E3D744EE8B74ASJ2P220MB1610NAMP_

Content-Type: text/plain; charset="us-ascii"

Content-Transfer-Encoding: quoted-printable



Hi,







Hope you are doing well. I am still waiting for your response.







Do let me know if you are interested and I would be happy to share with you=

more details about our past work client testimonials and price list.







I am looking forward to a positive response from you soon.







Thanks & Regards,







From: Sakshi Singh

Sent: Monday, January 26, 2025 5:01 PM

To: 'dave@doctor.nl2k.ab.ca'

Subject: RE: Website Design & Development Proposal at low Cost







Hello,







Hope you have a great day!!







We are a professional website development company, based in India with a st=

rength of 150+ employees and a great portfolio to boast about. We are diffe=

rent because we provide the resources you need on a short-term, long-term a=

nd hourly basis.







If you're really looking to build a pixel perfect decent website or want to=

re-develop your previous website, then please share the details with us. W=

e can assure you for a great design.







Our Development Services/Resources include: -







Website Design/Revamp/Upgrade







Custom Web Based Software







Portal/Marketplace







E-commerce development







Just keep an open mind and If any of this sounds something of your interest=

, then feel share your requirements and I would be happy to send you detail=

s about our company, pricing along with an estimated timeline for your proj=

ect/s.







Looking forward to hearing from you.







Warm Regards,



Sakshi



Business Development manager

Web/SEO/App spam from Microsoft Outlook Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 24 Feb 2026 05:59:00 -0700

Received: from mail-eastusazolkn19012017.outbound.protection.outlook.com ([52.103.11.17]:60835 helo=BL0PR03CU003.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vurzr-00000000B64-3YJq

for dave@doctor.nl2k.ab.ca;

Tue, 24 Feb 2026 05:58:51 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=q43rI8jriubICbixTr4A1kxLPy/izaLsLd1KIC7IdW36hl49yrIxJpw9BSVSQKFVrEh93llgsz9uWGHe5OQZQjGGCoWlMElNEjg4tV0kcxDsvvGETx4cwekPo9QUzcOXdhSzHJ0/Bwuje/hhblvghDp1J/CoKZLnUp5paRp2WLC1NO0aWTYtM9OxNTrqfQJgJAq/vUWfalJT3/thOXSQbkjyLnY7mtQfiMzIGuefwWlC8XgGORXcKPuwdOB3GlMc5ZmxIFV8ypkRq0KQmNWKd9c19wgyxs46ihUvjat2luqSNNwZASY5Y294OEcNVd8UMndgrLW/OgQI3exUA5G7sg==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=elSKaicmkYw5Zl5HbRTd8xT0zAqKcO3jsmoYYKJHavM=;

b=HvgFfjsiXSaqqhJLKKC5vuauCnvgGYgI8JmWD3KTh4eCrIc2Bdt1ZruQqmAhzVa/yXWBal+5Lh5cFUMRiN1NAseko4PfQ77ZP9YibTpDA/doFwX5PFnrlLZMGQqD5ehcHtbZtgXfkHJ6CF8yIwl1brwB7zCw0ItQaNoqZbQRWazpuAD6zQFjsahHXSb/ec8AtrA5Exx4UeIqus5gKmr4pZ/3qs3Ck5P/FqsRPdSL0fZkPSHBemHAv2H0bsZkz1UPXccgNlgQiV6gSkvRqk0zOWLxIf2uET+aKcYn/Wd2X713iXpoEyWx1NJ7J36cjcxj3giH1rzHUXq9KZoRrJCgWQ==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hotmail.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=elSKaicmkYw5Zl5HbRTd8xT0zAqKcO3jsmoYYKJHavM=;

b=HJPpUb+POKIoITDtBZZXIm6wVhAS/MR5eO/YfeEg4xh3MlP3NilX65tXGFZXUcstRVEsEr0K1F+upvprakl0xOb7SXBhMYEEURyI/4wM/ha8aYCl9uGfYuJ/fnomPvFGoVbfQ1vTNTWaRHw1hpkPK67pMu8X1ck5EK67jcRrHv3KWpRmOMsIqbxjajpa1BQvfTobvp21wZom+zrq44gqkHYccDd1fLpf7BXlVP1qNQMJXwnEMsW0nVfZTKjTk0SrH0X96S1DucWiS7sHNdB++nm70mCx5MRKyX/tN55FM6xD0XUVr8ZD9UPkRAVj96IPOlCuLEnn1piZro8oud1A0Q==

Received: from SJ2P220MB1610.NAMP220.PROD.OUTLOOK.COM (2603:10b6:a03:595::14)

by SJ2P220MB1509.NAMP220.PROD.OUTLOOK.COM (2603:10b6:a03:58b::12) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9632.21; Tue, 24 Feb

2026 12:57:44 +0000

Received: from SJ2P220MB1610.NAMP220.PROD.OUTLOOK.COM

([fe80::625c:b565:bddb:bb72]) by SJ2P220MB1610.NAMP220.PROD.OUTLOOK.COM

([fe80::625c:b565:bddb:bb72%4]) with mapi id 15.20.9632.017; Tue, 24 Feb 2026

12:57:44 +0000

From: Sakshi Singh

To: "dave@doctor.nl2k.ab.ca"

Subject: RE: Website Design & Development Proposal at low Cost

Thread-Topic: RE: Website Design & Development Proposal at low Cost

Thread-Index: Adylh6hUBdFuE0jdSOKp40AS5/UUkA==

Date: Tue, 24 Feb 2026 12:57:44 +0000

Message-ID:



Accept-Language: en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: SJ2P220MB1610:EE_|SJ2P220MB1509:EE_

x-ms-office365-filtering-correlation-id: e0a0dcbe-9999-40a9-e68a-08de73a44d57

x-ms-exchange-slblob-mailprops:

gMiuAN0LASIPtJFHWBzvUtRfhjUdI+tGMwFFhjYo7H32GoFMenFLtq6rRTvnUdMdDYOB6hAnYmvAYaSxUpprFVUdk4vQJ/W+zgpCgapIISrZuLnDs2u8aXLgKyy7ZFu0idmnfpkcqpdvQ2NmHscVizR5pCLKRZSYZs1vs8VufXEGT6YN4t/YsJ8fEdQ9S2adf1a+g3mDuHn23tdi0onjPtxFfLmjTM5HsIwbGiklvbItg+dfY7Cd+OqwxUU6BpiDbWV4GOxgmU9d1bpmNal89ceFZVY2pz9EwsXXH4YiLR+Can4/RrHQixPWHf1XYwQmHGuX22JiZxYLHM48Yu5U7A3STdamtnn7Ipk89kGUsAHAQ742PWGYVL4fXRZay5nqBceUAaYhEKqqFOgIgrD7HAQ97RazDEyS3E9WSkGqJtlbW5rj6vMcIjGmuoZoKat86Q/PqqHz/ySmSOIipnr4zDNHib30vtcNJciB3BK2zaZj4MsJ+OFA3Ca7CCF1RIPQQCRl06u063XqfN2Lnzh6Hz50QxhdJEAy6SND34nSJPwzTRZl/WLUcfbVD6QDTFt7CTcZr0HToI1PK6QNX5KZVx1qMorOYcxTjp5T6rrDJv0NrPhloEhPJUYrkK3QaTlxXz9ZEcT1Cqwqs6oo7HxN88mEyobg7D8wTfOakDYM9PeIQOiNRPsRxbYyJrc2rv9Rhrn+QeRwydgM2VjUvMsD/w==

x-microsoft-antispam:

BCL:0;ARA:14566002|5062599005|461199028|12121999013|39105399006|13091999003|20031999003|19110799012|31061999003|8060799015|8062599012|15080799012|3412199025|440099028|102099032|30101999003|35041999009|40105399003|29125399003;

x-microsoft-antispam-message-info:

=?us-ascii?Q?YRK+u7wRp9f4nHVaS7BeXEDxHCnsuFAB/o1CI8JXznivbD5dJLr/7Bzw4Z5/?=

=?us-ascii?Q?WnZODhQtKxZTOanCANHozkGVFbi3zqJOPcgZrk7TKy/3chrYxEsg6bwB0OQh?=

=?us-ascii?Q?b9pLfi56O1oJrNbPm81YJr9X0NtAxFPki+mwXdep8OhQVTYaWzMkFDRPXRoR?=

=?us-ascii?Q?RFneGr97LEpTapDXi4f6SCAyy9THCv40bOf7WQOIfF2wEIVP6FmBXVYb5fyr?=

=?us-ascii?Q?w9f5JgsHTkYRY7Kkt5omlHNa9HhTQDX+JcwiQQTx2OTQggHyeDe91pWhFJEd?=

=?us-ascii?Q?fU8ck5kKC8iNyP6azL/4650NY4n/Yk9bYGubgqEC4qDp2D175EpLVl+jZcG+?=

=?us-ascii?Q?LI8STeSEUbBxR0SY7jodjmviWBrpjVLGA9tuqfhVmWchWgiCjL6bMltKTFdi?=

=?us-ascii?Q?a6La2gysRo0+UeBL8B2jvRhEGqHr1KWkkkSooUBc8752JSCLcKpJFk8fZcBg?=

=?us-ascii?Q?yNBMTJ/nT6ZDb9RcI7hWcCRyAvagPCIZDvnUmzFx1gsC4AMA0YM/5qTv//oX?=

=?us-ascii?Q?sRm3OCRWAp5OJz37QcyoWMCPSRHBFIg10qonOdxuHPNG1zzVwPZV1UVhQKjV?=

=?us-ascii?Q?XHUm4ei0zsK9a4KL/KOFp1yMhJW+PKaQ9Dt3n2ahhwOXfE7npm+RbED9yjq6?=

=?us-ascii?Q?EfnkIiiRP8178FqX1G3+K1OY6xbE2olLcAe9v0JKlWpiNRVqu8SnKaLiCXsC?=

=?us-ascii?Q?joJgUejPigC3u1bQIyb5TTlx079IqOyRn6d2tseA7czKqpFY1joJAnfla20z?=

=?us-ascii?Q?utz1bgnQj4Rv19QDImr5E3JFWWGg1iVzSzTv6u7hCPrVnsWOwuv7A44A0lcd?=

=?us-ascii?Q?v4u12XsTc28c215CEQi/UXB8KCt0rv9VxQAObSsgM4c4KFGw3cjN9J6+bOjV?=

=?us-ascii?Q?yltyBSsCE3QLbadK+Ve2+05pSz1ICT2T/CjgdJMLUf5TdB3AWAb66ai2q1S/?=

=?us-ascii?Q?55j4eUJnYM9PecL0JDUBfW+s6rVSIIP0tWhXU4K/K9U4sI8aA98FoL0tnWGR?=

=?us-ascii?Q?hzjT/4W708/iWAIqA2HhzcoHky4HBXcNRidY3ISKVIarBqK1eCpIhU4R9Xqk?=

=?us-ascii?Q?VYQrkDojNGeTSJOnly6spejYV5foxknZ2zxWCEav6zH8drR1UVCG+wlOEA61?=

=?us-ascii?Q?LYXIt7vsZmCJ3k0mBh3z0gA/xHTfthPXhpBq7uh2VUPCi0Hc8m3l9+bp30r6?=

=?us-ascii?Q?tBHVd37d2U5vd8gJRFDpUbAWGnrc07lmk2SyUKT7kzlmpoWKHitQXYUakiEt?=

=?us-ascii?Q?lAP50eoH8hCJv5Mm5fiRhoCIQSagakszuTNKRhIG2wHTjawhPaBp6PG9exoY?=

=?us-ascii?Q?cONhBxPZsB9uaqh2Ga4VTbfWhfLmOZCloX7PgqGmp53huFh38D86+Wt28Mb1?=

=?us-ascii?Q?1Zhd0ePb63PlK+Rf4jz9Bf+t5z3jBM1OledOKpqfqW1t4TIf6g=3D=3D?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?us-ascii?Q?rxmVwBqvTxEfFXsHUpsbI0GU+SxuTUWfJ0AqRM595uwISw6Fc4rzFIWo/qyj?=

=?us-ascii?Q?tAWsFYXWjsKvcUy6opjePewDY+P3pxAW9zkzf3UMaZdy4rE+TtPoWGY8TSlB?=

=?us-ascii?Q?fcl5skkKln4yn5gPekOX2cP0C1ELhpKILE6YpJdVAnXocKMM8v3xqpt9v40M?=

=?us-ascii?Q?jR9j4jRv8T4anUHF8rqP/7c+JXChD+dMC706lshU6EvFCkXk+n1NuMxULClW?=

=?us-ascii?Q?txUtsUWb78y7IgWRzefxRKlhjJCXxDUyt6HgblsTumFIhBoZ+gflazp+GHvk?=

=?us-ascii?Q?AaY87joFHgVb/lVK99CIpJnYy1KQ7QHua3LvH1MNZSP8urTH3/sNyeNG0LjJ?=

=?us-ascii?Q?8Z+/SzfHS6J/aiszGt84P8zoUM4vQorPTsbIDSjxQukhXYrhm7yG3tMQX4nf?=

=?us-ascii?Q?IMdZq1xtzLml3LOhsKPFrxhmkGbawqLb3bHiZobcu3qM8UkgjHGDGUYco9wC?=

=?us-ascii?Q?BLbfThWuF8xD13V4ED/TpOT/ZJtYUEhfKB3ESe5obmZ1bn3qqfInvX0Mneko?=

=?us-ascii?Q?6iCpLZRe2gMI7bsw9gGvack2W6zYnn8GdPDG3IPszzG0xUsJnp5h7HHbDsxI?=

=?us-ascii?Q?pt83HEHv1rjm+pN7JMgWuUxRg2DY2SHEcC21A/lUxwALU61XJBGLMBZ3XXIt?=

=?us-ascii?Q?2HLLbksxieoZHWshoGi0oLENnZktYhD47LFiY2MKpfeGhwjLMAziuD27tvxq?=

=?us-ascii?Q?jdV6qdQ9aHgW7c+Nc+WvpafS07U4bYVsRrc050j3TtGBvoyixUMHxLUo7E5z?=

=?us-ascii?Q?ENBKdI2V8gduqzmD+rE4sHpxbmzLOAZEwxebOTedySf+c6dcMag7576iDJnE?=

=?us-ascii?Q?+NtYd56rg9BH8ZfIQM2pr3d0AOIPbO1HR/N4TGn2Tvymx13KyKlfgu9l4g7S?=

=?us-ascii?Q?xqJS5Y94fxuh+AzcW19vwHddID2W9Xb8rnykh5MGZwyiXU0Aq46OGU2WS9kK?=

=?us-ascii?Q?TV4FC3HGHoj5fG5HNozmoHta8HgzaYLxDiOOHnYFWk+rdMx31UGFQbSiI2iq?=

=?us-ascii?Q?15tVTYR69FitaB97Ax91LJJy+qjxKuYK9Vbf7kewb6v/lpbi/o/UfTC01MAM?=

=?us-ascii?Q?bEc/cyAswrORHHB1eq3QopVvkWC3C7Z/x4skB0NEhaWm15KO8UcwtBMf/1S0?=

=?us-ascii?Q?6H9rzjx5rCBbuIYThZ82gZUqo1LrjnmETv5dG0qFGODpYHdn6FJljm/REup1?=

=?us-ascii?Q?/19/sFFzlo35U7uJkx1syTBuDUMXyJwATMtqK0LC5HdpgT27E4zYFRSQkPrU?=

=?us-ascii?Q?qJWRG7b4Gp4tOVberNdXV7djxALc1QisukVFoKU9S/YlRVw1Pud8LMWlOapZ?=

=?us-ascii?Q?LyT3DLXXYfxWlNfvz+SFjTAD+0VHwKX9gB2H5wZlL42IPm0z4dDpY4v5+zsN?=

=?us-ascii?Q?2GjjB4e9BpjU0ov9SadFdDQFN5Dd?=

Content-Type: multipart/alternative;

boundary="_000_SJ2P220MB161036B68AC4DEA5E3D744EE8B74ASJ2P220MB1610NAMP_"

MIME-Version: 1.0

X-OriginatorOrg: sct-15-20-9412-4-msonline-outlook-df853.templateTenant

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: SJ2P220MB1610.NAMP220.PROD.OUTLOOK.COM

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: e0a0dcbe-9999-40a9-e68a-08de73a44d57

X-MS-Exchange-CrossTenant-originalarrivaltime: 24 Feb 2026 12:57:44.2338

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: SJ2P220MB1509

X-Spam_score: 5.1

X-Spam_score_int: 51

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

McAfee Phish from Google Gmail Part 4


/InformAction">
emtype=3D"http://schema.org/EmailMessage">
ntent=3D"Ellen Johnson: Status update notice Transaction"/>

mprop=3D"object" itemscope itemtype=3D"http://schema.org/Event">
rop=3D"eventStatus" content=3D"http://schema.org/EventScheduled"/>
mprop=3D"publisher" itemscope itemtype=3D"http://schema.org/Organization"><=

meta itemprop=3D"name" content=3D"Google Calendar"/>

=3D"eventId/googleCalendar" content=3D"Zv3Ee81v0KHI46014GxDYaI8Wf"/>
tyle=3D"display: none; font-size: 1px; color: #fff; line-height: 1px; heigh=

t: 0; max-height: 0; width: 0; max-width: 0; opacity: 0; overflow: hidden;"=

itemprop=3D"name">Status update notice Transaction

=3D"true">

ble border=3D"0" cellpadding=3D"0" cellspacing=3D"0" role=3D"presentation" =

align=3D"center" style=3D"width:100%;" class=3D"body-container">=


a-hidden=3D"true">  

tation" align=3D"center" style=3D"width:100%;" class=3D"">

yle=3D"" class=3D"" align=3D"left">
a.org/EmailMessage">

Status update notice Transa=

ction


=3D"0" cellspacing=3D"0" role=3D"presentation" align=3D"center" style=3D"wi=

dth:100%;" class=3D"">
>

rder-radius: 8px; direction: rtl; font-size: 0; padding: 24px 32px; text-al=

ign: left; vertical-align: top;" class=3D"main-container-inner">

ign: left; direction: ltr; display: inline-block; vertical-align: top; widt=

h: 100%;overflow: hidden; word-wrap: break-word;">
adding=3D"0" cellspacing=3D"0" role=3D"presentation" width=3D"100%" class=

=3D"main-column-table-ltr" style=3D"padding-right: 32px; padding-left: 0;;t=

able-layout: fixed;">
>

ng:0; vertical-align:top;">
g=3D"0" role=3D"presentation" width=3D"100%" style=3D"table-layout: fixed;"=

>

reak-word;;padding-bottom:2px;">

', Roboto, sans-serif;font-weight: 400; font-size: 22px; line-height: 2=

8px;color: #3c4043; text-decoration: none;" class=3D"primary-text" role=3D"=

presentation">Status update notice Transaction
n>

ft; word-break: break-word;;padding-bottom:24px;">

: Roboto, sans-serif;font-style: normal; font-weight: 400; font-size: 14px;=

line-height: 20px; letter-spacing: 0.2px;color: #3c4043; text-decoration: =

none;" class=3D"primary-text" role=3D"presentation">
ue">
itemprop=3D"endDate" datetime=3D"20260225T012231Z">
Tue=

sday Feb 24, 2026 =E2=8B=85 8:22pm (Eastern Time - New York)

td>

reak: break-word;;padding-bottom:24px;">

sans-serif;font-style: normal; font-weight: 400; font-size: 14px; line-heig=

ht: 20px; letter-spacing: 0.2px;color: #3c4043; text-decoration: none;" cla=

ss=3D"primary-text" role=3D"presentation">

Dear Servic=

e User
,

Your recent subscription update has been completed s=

uccessfully.

The 60 Months membership under McAfee is now active.

=

Purchase Insights Dashboard

Transaction id- GDFU-=

7353-783
Purchased Service- Prime Protection Plan
Coverage Term- 60 M=

onths
Total Charged- USD428.66

For support, please call 81=

0 288 4505
.

Thank you for choosing our services.

Thank=

fully,,
Michael Collins
Billing Team
810 288 4505=

=C2=A9 2026 McAfee LLC. All rights reserved.
2223 Avenida De La P=

laya; #203 Pompano Beach Fl 33308 Usa


cription" content=3D"Dear Service User,Your recent subscription update has =

been completed successfully.The 60 Months membership under McAfee is now ac=

tive.Purchase Insights DashboardTransaction id- GDFU-7353-783Purchased Serv=

ice- Prime Protection PlanCoverage Term- 60 MonthsTotal Charged- USD428.66F=

or support, please call 810 288 4505.Thank you for choosing our services.Th=

ankfully,,Michael CollinsBilling Team810 288 4505=C2=A9 2026 McAfee LLC. Al=

l rights reserved.2223 Avenida De La Playa; #203 Pompano Beach Fl 33308 Usa=

"/>

eft; word-break: break-word;;padding-bottom:24px;">

y: Roboto, sans-serif;font-style: normal; font-weight: 400; font-size: 14px=

; line-height: 20px; letter-spacing: 0.2px;color: #3c4043; text-decoration:=

none;" class=3D"primary-text" role=3D"presentation">
llpadding=3D"0" cellspacing=3D"0" role=3D"presentation" style=3D"padding-bo=

ttom: 4px;">


or: #3c4043; text-decoration: none;font-weight: 700;-webkit-font-smoothing:=

antialiased;margin: 0; padding: 0;">Guests

(Guest li=

st has been hidden at organizer's request)


--00000000000076b010064b90f133--

McAfee Phish from Google Gmail Part 2





















=20



=20



=20

McAfee Phish from Google Gmail Part 3



=20