Business partnership spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 19 Feb 2026 19:33:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vtGJL-00000000Nor-3RE2

for dave@doctor.nl2k.ab.ca;

Thu, 19 Feb 2026 19:32:07 -0700

Resent-From: The Doctor

Resent-Date: Thu, 19 Feb 2026 19:32:07 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [41.76.169.13] (port=33290 helo=mail.npsc.go.ke)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vtFlZ-00000000F5T-03cz

for root@nk.ca;

Thu, 19 Feb 2026 18:57:23 -0700

Received: from localhost (localhost [127.0.0.1])

by mail.npsc.go.ke (Postfix) with ESMTP id 611EDFE981B;

Fri, 20 Feb 2026 04:37:05 +0300 (EAT)

Received: from mail.npsc.go.ke ([127.0.0.1])

by localhost (mail.npsc.go.ke [127.0.0.1]) (amavis, port 10032) with ESMTP

id Wngpp6kaosdp; Fri, 20 Feb 2026 04:37:05 +0300 (EAT)

Received: from localhost (localhost [127.0.0.1])

by mail.npsc.go.ke (Postfix) with ESMTP id F20A7FE981F;

Fri, 20 Feb 2026 04:37:01 +0300 (EAT)

DKIM-Filter: OpenDKIM Filter v2.10.3 mail.npsc.go.ke F20A7FE981F

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=npsc.go.ke;

s=13BBFD90-AC39-11ED-971F-DDDAE4525639; t=1771551422;

bh=AMxdccGG9HWm2rk8Y4HFhADTZi+BGrhXyET7EcoEV/I=;

h=Date:From:Message-ID:Subject:MIME-Version;

b=MF8/c0WbGNTUakAtkQnHh7jqHyIKkzbrgIu7gbbwT1sPXMbQfpEgV5tqufOIwk+qM

sb+p+oTA8PQkuK03+LeQMnLyq2MWN5VZYOFfDsQrKkSyUh1STZejTtaZbkYkNrr2m6

Ds15qLmV4Su0+ZHdRCibDPO9Sqn9ELnwwnX5tUgwzLMjL73O9wJGvOaeuuUywa3Sc5

EqN7vci0TVhA0vj7LqHdh3HnJYJMWRCgCOSeNskBOo4IZAJAABvZKLxbmPgvmfRrUQ

mJ7C3m1+CRL1aRTGByEDuKl1+9a1j8IivNTcrnW70/IbRKQkJ+mUGiaJiDqshE/0mI

PoUAFWIrjN+uA==

X-Virus-Scanned: amavis at npsc.go.ke

Received: from mail.npsc.go.ke ([127.0.0.1])

by localhost (mail.npsc.go.ke [127.0.0.1]) (amavis, port 10026) with ESMTP

id I7oVRwsd_JeQ; Fri, 20 Feb 2026 04:37:01 +0300 (EAT)

Received: from mail.npsc.go.ke (mail.npsc.go.ke [10.179.3.1])

by mail.npsc.go.ke (Postfix) with ESMTP id 7B031FE9817;

Fri, 20 Feb 2026 04:36:53 +0300 (EAT)

Date: Fri, 20 Feb 2026 04:36:53 +0300 (EAT)

From: Nathalie Hartmann

Reply-To: Nathalie Hartmann

Message-ID: <55005601.69760.1771551413365.JavaMail.zimbra@npsc.go.ke>

Subject: Introduction and potential partnership

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="=_25e150f9-4b7c-463b-9b35-b20897de1c64"

X-Originating-IP: [129.222.206.173]

X-Mailer: Zimbra 8.8.15_GA_4717 (ZimbraWebClient - GC145 (Win)/8.8.15_GA_4717)

Thread-Index: cQqibkDYxwBCWmMoH22tdVsb3d7i/Q==

Thread-Topic: Introduction and potential partnership

X-Spam_score: 15.2

X-Spam_score_int: 152

X-Spam_bar: +++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hello, I hope you’re well. My name is Nathalie Hartmann,

and I’m reaching out to introduce myself. I work closely with partners

in various field, and I believe there may be a meaningful opportunity for

collaboration. I’d welcome the chance to learn more about your work and

explore whether our goa [...]



Content analysis details: (15.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[41.76.169.13 listed in dnsbl.ahbl.org]

[41.76.169.13 listed in dnsbl.ahbl.org]

[41.76.169.13 listed in dnsbl.ahbl.org]

[41.76.169.13 listed in dnsbl.ahbl.org]

[129.222.206.173 listed in dnsbl.ahbl.org]

[129.222.206.173 listed in dnsbl.ahbl.org]

[129.222.206.173 listed in dnsbl.ahbl.org]

[129.222.206.173 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[41.76.169.13 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[41.76.169.13 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[41.76.169.13 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[41.76.169.13 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[129.222.206.173 listed in will-spam-for-food.eu.org]

[129.222.206.173 listed in will-spam-for-food.eu.org]

[129.222.206.173 listed in will-spam-for-food.eu.org]

[129.222.206.173 listed in will-spam-for-food.eu.org]

[129.222.206.173 listed in will-spam-for-food.eu.org]

[129.222.206.173 listed in will-spam-for-food.eu.org]

[129.222.206.173 listed in will-spam-for-food.eu.org]

[129.222.206.173 listed in will-spam-for-food.eu.org]

[41.76.169.13 listed in will-spam-for-food.eu.org]

[41.76.169.13 listed in will-spam-for-food.eu.org]

[41.76.169.13 listed in will-spam-for-food.eu.org]

[41.76.169.13 listed in will-spam-for-food.eu.org]

[41.76.169.13 listed in will-spam-for-food.eu.org]

[41.76.169.13 listed in will-spam-for-food.eu.org]

[41.76.169.13 listed in will-spam-for-food.eu.org]

[41.76.169.13 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[129.222.206.173 listed in sbl-xbl.spamhaus.org]

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Listed by XBL, see ]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[41.76.169.13 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.2 MISSING_HEADERS Missing To: header

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[xp.nathalie.hartmann1(at)gmail.com]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.0 NO_RDNS2 Sending MTA has no reverse DNS

1.9 REPLYTO_WITHOUT_TO_CC No description available.

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

Subject: {SPAM?} Introduction and potential partnership



--=_25e150f9-4b7c-463b-9b35-b20897de1c64

Content-Type: text/plain; charset=utf-8

Content-Transfer-Encoding: quoted-printable



Hello,=20



I hope you=E2=80=99re well. My name is Nathalie Hartmann, and I=E2=80=99m r=

eaching out to introduce myself.=20



I work closely with partners in various field, and I believe there may be a=

meaningful opportunity for collaboration. I=E2=80=99d welcome the chance t=

o learn more about your work and explore whether our goals align.=20



If this is of interest, I=E2=80=99d be happy to connect at a time that suit=

s you.=20



Kind regards,=20



Nathalie Hartmann=20



--=_25e150f9-4b7c-463b-9b35-b20897de1c64

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: quoted-printable




ize: 12pt; color: #000000">

000000; font-family: arial, helvetica, sans-serif; font-size: 16px; font-st=

yle: normal; font-variant-ligatures: normal; font-variant-caps: normal; fon=

t-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-=

indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-te=

xt-stroke-width: 0px; white-space: normal; background-color: #ffffff; text-=

decoration-thickness: initial; text-decoration-style: initial; text-decorat=

ion-color: initial;" data-mce-style=3D"color: #000000; font-family: arial, =

helvetica, sans-serif; font-size: 16px; font-style: normal; font-variant-li=

gatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacin=

g: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform:=

none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; white-=

space: normal; background-color: #ffffff; text-decoration-thickness: initia=

l; text-decoration-style: initial; text-decoration-color: initial;">
He=

llo,

I hope you=E2=80=99re well. My name is Nathal=

ie Hartmann, and I=E2=80=99m reaching out to introduce myself.

r>
I work closely with partners in various field, and I believe t=

here may be a meaningful opportunity for collaboration. I=E2=80=99d welcome=

the chance to learn more about your work and explore whether our goals ali=

gn.

If this is of interest, I=E2=80=99d be happy t=

o connect at a time that suits you.

Kind regards,<=

/div>

Nathalie Hartmann

div>


--=_25e150f9-4b7c-463b-9b35-b20897de1c64--

Spotify Phish from Google Gmail PArt 1

Posted by Dave Yadallee on
lla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 19 Feb 2026 14:25:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vtBVS-00000000JMV-1V9T

for dave@doctor.nl2k.ab.ca;

Thu, 19 Feb 2026 14:24:18 -0700

Resent-From: The Doctor

Resent-Date: Thu, 19 Feb 2026 14:24:18 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ua1-f71.google.com ([209.85.222.71]:61584)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vtApc-000000006wb-1sEr

for sales@nk.ca;

Thu, 19 Feb 2026 13:41:11 -0700

Received: by mail-ua1-f71.google.com with SMTP id a1e0cc1a2514c-94ad7cd3a35so14680797241.2

for ; Thu, 19 Feb 2026 12:40:16 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=firebaseapp.com; s=20230601; t=1771533610; x=1772138410; darn=nk.ca;

h=to:from:subject:date:message-id:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=Q9EBAerNvbgZQ10LDzi7AlRTN3kP3kqLQETj2MhJ75c=;

b=JXrwyC7P620TPlfdZ0IlJxL24hWxSjves6hBnYhokC4m11QvgdR7iODQGa86oSPocq

MIhCD5EEcwOxoRFDIsedUpTuRT8AfHpK57Xz7DYXWqK0RsTkpMlfH/oGs8vz4porDc7v

xHyS99Qw/7vpM70J+xmi03twoqBjQHplPKVx8UaDYl1tGziY4WNR4sA2vRXdCyngue3F

rRAG31nVBKrjEm+1Xom4IoHTngoSuoupqx7J2ATs9R8N8Kae+8nB9M8VaAQk7X8Za8Vc

HtBhB17OZKDJxP7MSAbLtuvkOUoz6CokaTSvVBGKWsm0Fw9rJOIq1SmJMYjOnGgxx2Ug

NwAw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1771533610; x=1772138410;

h=to:from:subject:date:message-id:mime-version:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=Q9EBAerNvbgZQ10LDzi7AlRTN3kP3kqLQETj2MhJ75c=;

b=X6GBbhizvdSqUB5gRjIPSjlTK45VY4kvSAQAIOyXkJEXSs1B6GB8Uk8UVk1LjY2/eT

vTUurkKbyHHplLh+mOiyJFH5YHGlxLvQpRlmtwK2VtMh5hEQIxsx4VoQvVBTxKBv/HH5

bcq0ckUGSWFwGm1dzaBKvL/Ur8Xx4B5e+W31epIHmktK613W+hfArBOmmCp++ssXqmnw

kTd+e9IuOogD6zugmCQ7jEMayo+eZpRPaldm+qu83TMsMHMDq2y6MbPknTSUexZKuAlm

23JG1Hn6Ups/3A8oePe2QrrGSIwr2bokMn9gesWFMEk+taEkEuqNNv/S5qLs+EU3dizH

n7RQ==

X-Gm-Message-State: AOJu0YxPT2c/FrZtm9fEYMiLlgkxi+TMZI5n0VJXBVRH1EfM8oqLpJKu

PXivEHh4uBNHRdxe5AObrVKfk2f608TWqaUe0BxmUICBOWOIOo8hmbbFOZJHtTLMdObImBUkKKA

2qAGbf0NVsA==

MIME-Version: 1.0

X-Received: by 2002:a05:6102:2ac7:b0:5f9:39e8:5346 with SMTP id

ada2fe7eead31-5fe7fb393bfmr3374997137.9.1771533610694; Thu, 19 Feb 2026

12:40:10 -0800 (PST)

Message-ID: <00000000000092b846064b334f89@google.com>

Date: Thu, 19 Feb 2026 20:40:10 +0000

Subject: Verify your billing details

From: SpotifyAB

To: sales@nk.ca

Content-Type: multipart/alternative; boundary="00000000000092b83d064b334f86"

X-Spam_score: 9.3

X-Spam_score_int: 93

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Your payment was unsuccessful. We were unable to process your

Premium subscription payment . Your card may have expired or the transaction

may have been declined by the bank. Important: If you do not update your

payment information, your account will be suspended and will switch to the

free version within 24 hours.



Content analysis details: (9.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.222.71 listed in dnsbl.ahbl.org]

[209.85.222.71 listed in dnsbl.ahbl.org]

[209.85.222.71 listed in dnsbl.ahbl.org]

[209.85.222.71 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.222.71 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.222.71 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.222.71 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.222.71 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.222.71 listed in will-spam-for-food.eu.org]

[209.85.222.71 listed in will-spam-for-food.eu.org]

[209.85.222.71 listed in will-spam-for-food.eu.org]

[209.85.222.71 listed in will-spam-for-food.eu.org]

[209.85.222.71 listed in will-spam-for-food.eu.org]

[209.85.222.71 listed in will-spam-for-food.eu.org]

[209.85.222.71 listed in will-spam-for-food.eu.org]

[209.85.222.71 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.222.71 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.222.71 listed in wl.mailspike.net]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

3.0 URI_FIREBASEAPP Link to hosted firebase web application, possible

phishing

1.5 TVD_PH_BODY_ACCOUNTS_PRE The body matches phrases such as "accounts

suspended", "account credited", "account

verification"

Subject: {SPAM?} Verify your billing details

Spotify Phish from Google Gmail PArt 2

Posted by Dave Yadallee on
X-Mozi



--00000000000092b83d064b334f86

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes

Content-Transfer-Encoding: base64



WW91ciBwYXltZW50IHdhcyB1bnN1Y2Nlc3NmdWwuDQoNCg0KV2Ugd2VyZSB1bmFibGUgdG8gcHJv

Y2VzcyB5b3VyIFByZW1pdW0gc3Vic2NyaXB0aW9uIHBheW1lbnQgLiBZb3VyIGNhcmQgbWF5ICAN

CmhhdmUgZXhwaXJlZCBvciB0aGUgdHJhbnNhY3Rpb24gbWF5IGhhdmUgYmVlbiBkZWNsaW5lZCBi

eSB0aGUgYmFuay4NCg0KSW1wb3J0YW50OiBJZiB5b3UgZG8gbm90IHVwZGF0ZSB5b3VyIHBheW1l

bnQgaW5mb3JtYXRpb24sIHlvdXIgYWNjb3VudCB3aWxsICANCmJlIHN1c3BlbmRlZCBhbmQgd2ls

bCBzd2l0Y2ggdG8gdGhlIGZyZWUgdmVyc2lvbiB3aXRoaW4gMjQgaG91cnMuDQoNClVQREFURSBZ

T1VSIEJJTExJTkcNCg0KVGhhbmsgeW91IGZvciB1c2luZyBTcG90aWZ5Lg0KDQoNClRoZSBTcG90

aWZ5IHRlYW0NCg0KwqkgMjAyNiBTcG90aWZ5IEFCDQoNCg0KVW5zdWJzY3JpYmUNCg0K

--00000000000092b83d064b334f86

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable
















bottom: 2px solid rgb(29, 185, 84); padding-bottom: 20px; margin-bottom: 30=

px; display: flex; align-items: center; color: rgb(51, 51, 51); font-family=

: Helvetica, Arial, sans-serif; font-size: 11px;">


center;"> 








font-family: Helvetica, Arial, sans-serif; font-size: 11px;">


ont-size:20px;">
dir=3D"auto" style=3D"vertical-align: inherit;">
=3D"vertical-align: inherit;">
nherit;">Your payment was unsuccessful.<=

/h2>



 






=3D"auto" style=3D"vertical-align: inherit;">
rtical-align: inherit;">
;">We were unable to =

process your 
tyle=3D"vertical-align: inherit;">
n: inherit;">
r=3D"auto" style=3D"vertical-align: inherit;">Premium subscription
font>
erit;">
uto" style=3D"vertical-align: inherit;">
l-align: inherit;"> payment . Your card may have expired or the transaction=

may have been declined by the bank.






ft: 4px solid rgb(29, 185, 84); padding: 20px; margin: 25px 0px; text-align=

: center;">
185, 84);">
=3D"auto" style=3D"vertical-align: inherit;">
rtical-align: inherit;">
;">Important:
=3D"vertical-align: inherit;">
nherit;">
"auto" style=3D"vertical-align: inherit;">  If you do not update your =

payment information, your account will be suspended and will switch to the =

free version within 24 hours.









er;">
lign: inherit;">
dir=3D"auto" style=3D"vertical-align: inherit;">
=3D"vertical-align: inherit;">Thank you for using Spotify.
ont>








r-top: 1px solid rgb(238, 238, 238); color: rgb(102, 102, 102); font-size: =

14px; font-family: Helvetica, Arial, sans-serif;">


: inherit;">
=3D"auto" style=3D"vertical-align: inherit;">
rtical-align: inherit;">The Spotify team






=3D"vertical-align: inherit;">
nherit;">
"auto" style=3D"vertical-align: inherit;">
cal-align: inherit;">=

© 2026 Spotify AB





 






-btn" href=3D"https://robot-pikos.firebaseapp.com/__/auth/action?mode=3Dres=

etPassword&oobCode=3D4vjaB7uZgV13og7FmAS7jkP-6fTgp5810THa304_7LEAAAGcd6=

Gtvw&apiKey=3DAIzaSyCzlOnc3z69ZrMOKC8eFQnXN2OG1SLVd4g&lang=3Den&=

;tenantId=3DTenant-Expert-1-z0bvb" rel=3D"noreferrer" style=3D"color: rgb(1=

18, 118, 118); display: inline-block; background-color: rgb(255, 255, 255);=

border: 1px solid rgb(208, 208, 208); border-radius: 16px; padding: 4px 12=

px; font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", R=

oboto, Helvetica, Arial, sans-serif; text-decoration-line: none; line-heigh=

t: 1.4; transition: 0.1s; cursor: pointer; letter-spacing: 0.2px; box-shado=

w: none;" target=3D"_blank">
erit;">
uto" style=3D"vertical-align: inherit;">
l-align: inherit;">Unsubscribe









--00000000000092b83d064b334f86--

Spotify Phish from Google Gmail PArt 1

Posted by Dave Yadallee on
lla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 19 Feb 2026 14:25:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vtBVS-00000000JMV-1V9T

for dave@doctor.nl2k.ab.ca;

Thu, 19 Feb 2026 14:24:18 -0700

Resent-From: The Doctor

Resent-Date: Thu, 19 Feb 2026 14:24:18 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ua1-f71.google.com ([209.85.222.71]:61584)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vtApc-000000006wb-1sEr

for sales@nk.ca;

Thu, 19 Feb 2026 13:41:11 -0700

Received: by mail-ua1-f71.google.com with SMTP id a1e0cc1a2514c-94ad7cd3a35so14680797241.2

for ; Thu, 19 Feb 2026 12:40:16 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=firebaseapp.com; s=20230601; t=1771533610; x=1772138410; darn=nk.ca;

h=to:from:subject:date:message-id:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=Q9EBAerNvbgZQ10LDzi7AlRTN3kP3kqLQETj2MhJ75c=;

b=JXrwyC7P620TPlfdZ0IlJxL24hWxSjves6hBnYhokC4m11QvgdR7iODQGa86oSPocq

MIhCD5EEcwOxoRFDIsedUpTuRT8AfHpK57Xz7DYXWqK0RsTkpMlfH/oGs8vz4porDc7v

xHyS99Qw/7vpM70J+xmi03twoqBjQHplPKVx8UaDYl1tGziY4WNR4sA2vRXdCyngue3F

rRAG31nVBKrjEm+1Xom4IoHTngoSuoupqx7J2ATs9R8N8Kae+8nB9M8VaAQk7X8Za8Vc

HtBhB17OZKDJxP7MSAbLtuvkOUoz6CokaTSvVBGKWsm0Fw9rJOIq1SmJMYjOnGgxx2Ug

NwAw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1771533610; x=1772138410;

h=to:from:subject:date:message-id:mime-version:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=Q9EBAerNvbgZQ10LDzi7AlRTN3kP3kqLQETj2MhJ75c=;

b=X6GBbhizvdSqUB5gRjIPSjlTK45VY4kvSAQAIOyXkJEXSs1B6GB8Uk8UVk1LjY2/eT

vTUurkKbyHHplLh+mOiyJFH5YHGlxLvQpRlmtwK2VtMh5hEQIxsx4VoQvVBTxKBv/HH5

bcq0ckUGSWFwGm1dzaBKvL/Ur8Xx4B5e+W31epIHmktK613W+hfArBOmmCp++ssXqmnw

kTd+e9IuOogD6zugmCQ7jEMayo+eZpRPaldm+qu83TMsMHMDq2y6MbPknTSUexZKuAlm

23JG1Hn6Ups/3A8oePe2QrrGSIwr2bokMn9gesWFMEk+taEkEuqNNv/S5qLs+EU3dizH

n7RQ==

X-Gm-Message-State: AOJu0YxPT2c/FrZtm9fEYMiLlgkxi+TMZI5n0VJXBVRH1EfM8oqLpJKu

PXivEHh4uBNHRdxe5AObrVKfk2f608TWqaUe0BxmUICBOWOIOo8hmbbFOZJHtTLMdObImBUkKKA

2qAGbf0NVsA==

MIME-Version: 1.0

X-Received: by 2002:a05:6102:2ac7:b0:5f9:39e8:5346 with SMTP id

ada2fe7eead31-5fe7fb393bfmr3374997137.9.1771533610694; Thu, 19 Feb 2026

12:40:10 -0800 (PST)

Message-ID: <00000000000092b846064b334f89@google.com>

Date: Thu, 19 Feb 2026 20:40:10 +0000

Subject: Verify your billing details

From: SpotifyAB

To: sales@nk.ca

Content-Type: multipart/alternative; boundary="00000000000092b83d064b334f86"

X-Spam_score: 9.3

X-Spam_score_int: 93

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Your payment was unsuccessful. We were unable to process your

Premium subscription payment . Your card may have expired or the transaction

may have been declined by the bank. Important: If you do not update your

payment information, your account will be suspended and will switch to the

free version within 24 hours.



Content analysis details: (9.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.222.71 listed in dnsbl.ahbl.org]

[209.85.222.71 listed in dnsbl.ahbl.org]

[209.85.222.71 listed in dnsbl.ahbl.org]

[209.85.222.71 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.222.71 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.222.71 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.222.71 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.222.71 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.222.71 listed in will-spam-for-food.eu.org]

[209.85.222.71 listed in will-spam-for-food.eu.org]

[209.85.222.71 listed in will-spam-for-food.eu.org]

[209.85.222.71 listed in will-spam-for-food.eu.org]

[209.85.222.71 listed in will-spam-for-food.eu.org]

[209.85.222.71 listed in will-spam-for-food.eu.org]

[209.85.222.71 listed in will-spam-for-food.eu.org]

[209.85.222.71 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.222.71 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.222.71 listed in wl.mailspike.net]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

3.0 URI_FIREBASEAPP Link to hosted firebase web application, possible

phishing

1.5 TVD_PH_BODY_ACCOUNTS_PRE The body matches phrases such as "accounts

suspended", "account credited", "account

verification"

Subject: {SPAM?} Verify your billing details

Microsoft PC Defender phish from Google Gmail PArt 4

Posted by Dave Yadallee on

/InformAction">
emtype=3D"http://schema.org/EmailMessage">
ntent=3D"Kathy Velazquez: Account Update: Transaction update stage recorded=

"/>
/Event">
heduled"/>
org/Organization">
an>
1hv4771"/>
eight: 1px; height: 0; max-height: 0; width: 0; max-width: 0; opacity: 0; o=

verflow: hidden;" itemprop=3D"name">Account Update: Transaction update stag=

e recorded
acing=3D"0" role=3D"presentation" align=3D"center" style=3D"width:100%;" cl=

ass=3D"body-container">
=

 

" cellspacing=3D"0" role=3D"presentation" align=3D"center" style=3D"width:1=

00%;" class=3D"">
r>

itemscope itemtype=3D"http://schema.org/EmailMessage">


ption">Account Update: Transaction update stage recorded


ole=3D"presentation" align=3D"center" style=3D"width:100%;" class=3D"">
dy>
dy>

n: rtl; font-size: 0; padding: 24px 32px; text-align: left; vertical-align:=

top;" class=3D"main-container-inner">=


display: inline-block; vertical-align: top; width: 100%;overflow: hidden; =

word-wrap: break-word;">
=3D"0" role=3D"presentation" width=3D"100%" class=3D"main-column-table-ltr"=

style=3D"padding-right: 32px; padding-left: 0;;table-layout: fixed;">
y>
dy>

>
on" width=3D"100%" style=3D"table-layout: fixed;">
r>

e: 0; padding: 0; text-align: left; word-break: break-word;;padding-bottom:=

2px;">

font-weight: 400; font-size: 22px; line-height: 28px;color: #3c4043; text-d=

ecoration: none;" class=3D"primary-text" role=3D"presentation">
op=3D"name">Account Update: Transaction update stage recorded
<=

/td>

break: break-word;;padding-bottom:24px;">

sans-serif;font-style: normal; font-weight: 400; font-size: 14px; line-hei=

ght: 20px; letter-spacing: 0.2px;color: #3c4043; text-decoration: none;" cl=

ass=3D"primary-text" role=3D"presentation">
itemprop=3D"startDate" datetime=3D"20260220T075756Z">Friday Feb 2=

0, 2026 =E2=8B=85 2:57am (Eastern Time - New York)

k-word;;padding-bottom:24px;">

;font-style: normal; font-weight: 400; font-size: 14px; line-height: 20px; =

letter-spacing: 0.2px;color: #3c4043; text-decoration: none;" class=3D"prim=

ary-text" role=3D"presentation">

Microsoft PC Defender
Cons=

tance Larsen
United States
1.856. 209.9554


rong>Account Update, Your subscription has been renewed automatica=

lly as requested. The upgrade process was completed on Friday, 20 February =

2026.

Thank you for trusting us to safeguard your digital security fo=

r the next 3-Years.

Billing Information Dashboard
>

Transaction receipt:- c9db-1f92-388
License Key:- 858673db-2ac8-4272=

-8668-fb0da00061da
Item Bought:- Advanced Care Membership
Coverage Pe=

riod:- 3-Years
Charged Amount:- USD 419.22

Need assistance? Reach =

our Help Desk at 1.856. 209.9554.

2026 Microsoft PC =

Defender, llc. All rights reserved.
Mailing Address: 755 Marigold Way Ho=

ckessin De 19707-8704 Us


tent=3D"Microsoft PC DefenderConstance LarsenUnited States1.856. 209.9554Ac=

count Update, Your subscription has been renewed automatically as requested=

. The upgrade process was completed on Friday, 20 February 2026.Thank you f=

or trusting us to safeguard your digital security for the next 3-Years.Bill=

ing Information DashboardTransaction receipt:- c9db-1f92-388License Key:- 8=

58673db-2ac8-4272-8668-fb0da00061daItem Bought:- Advanced Care MembershipCo=

verage Period:- 3-YearsCharged Amount:- USD 419.22Need assistance? Reach ou=

r Help Desk at 1.856. 209.9554.2026 Microsoft PC Defender, llc. All rights =

reserved.Mailing Address: 755 Marigold Way Hockessin De 19707-8704 Us"/>
iv>

ord-break: break-word;;padding-bottom:24px;">

oto, sans-serif;font-style: normal; font-weight: 400; font-size: 14px; line=

-height: 20px; letter-spacing: 0.2px;color: #3c4043; text-decoration: none;=

" class=3D"primary-text" role=3D"presentation">
ing=3D"0" cellspacing=3D"0" role=3D"presentation" style=3D"padding-bottom: =

4px;">


c4043; text-decoration: none;font-weight: 700;-webkit-font-smoothing: antia=

liased;margin: 0; padding: 0;">Guests

(Guest list has=

been hidden at organizer's request)


--0000000000008469f1064b31e265--

Microsoft PC Defender phish from Google Gmail PArt 3

Posted by Dave Yadallee on






=20

















Microsoft PC Defender phish from Google Gmail PArt 2

Posted by Dave Yadallee on
Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable




schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-microsoft-com:office:offi=

ce">
t=3D"text/html; charset=3DUTF-8">
=3Ddevice-width,initial-scale=3D1">
ight dark">





















=20



=20



=20

Microsoft PC Defender phish from Google Gmail PArt 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 19 Feb 2026 14:23:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vtBTe-00000000JGG-27Y4

for dave@doctor.nl2k.ab.ca;

Thu, 19 Feb 2026 14:22:26 -0700

Resent-From: The Doctor

Resent-Date: Thu, 19 Feb 2026 14:22:26 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ot1-f73.google.com ([209.85.210.73]:61949)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vt9Ep-00000000Pgi-0yO8

for root@doctor.nl2k.ab.ca;

Thu, 19 Feb 2026 11:59:08 -0700

Received: by mail-ot1-f73.google.com with SMTP id 46e09a7af769-7d1936b8a7cso14668100a34.3

for ; Thu, 19 Feb 2026 10:58:12 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=google.com; s=20230601; t=1771527486; x=1772132286; darn=doctor.nl2k.ab.ca;

h=from:subject:date:message-id:sender:reply-to:mime-version:from:to

:cc:subject:date:message-id:reply-to;

bh=t4994OKa2S2zljUAIVifeAp6fF1tGKSRpQhTUthXo2w=;

b=PgtqtwqChWR698EzhOZw77RXX3O4vsVRZVJ2WdPeEnTX+SlkLmdIEDgOomQ4bEKjs/

IvcQw8+TfThx5W1VTQDa5RcZCbAPpmLXn4PNCn8yewvR2YF7aVN4AGoFr5TNjmbmIEB3

V6iXV+C5eWnnSaJC4d3ondXWbzUsyWODvteOeGl6/+zXWgK54Nosf/s6W9h9WpgRNRt5

dfdbzM4ZGhSUWypSNtk9TUYQh2gq3oKc5+xXDhfiAesf/cX9y/1KopHamK9XcN8pqXGv

YprZ6BVUX1Up5rhesvdfsQ77HAw+9O6e1//pjdmb7ooGyU8FBy3P5KU2fpcLhrx1aCK9

ChTQ==

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=askkita-org.20230601.gappssmtp.com; s=20230601; t=1771527486; x=1772132286; darn=doctor.nl2k.ab.ca;

h=from:subject:date:message-id:sender:reply-to:mime-version:from:to

:cc:subject:date:message-id:reply-to;

bh=t4994OKa2S2zljUAIVifeAp6fF1tGKSRpQhTUthXo2w=;

b=hZOYGMPKZ30LprXSQb2MajcUrgMY8EMB4bFxmadxYedoMJ9ZTakXlXH0LUAYEq33/J

S0rMGuFcw2woXD+9cesYLTTJ/Za5VXaTqtoTKssDh+7EYBDEnWKndD8THMXATmq/+6fe

8sN0xAfwlQeyi6C6WtBk1813YTf068myivlrAaWQ+7uF/k9NICaYwy4UP575gJ92P0C5

MJRmPr6DSBL4wIH7lVLOLXkn8lm7wB+RD4p/MelFOo0/RymMlsUPK2/rAS1AjBNUcpAr

Os6AS5UR7DMNHEDqML9TIfeVJmOsNY0pRBNJqtkQpTq96IqBnI8QisIXkJ0A7boIU5/8

Qj9A==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1771527486; x=1772132286;

h=from:subject:date:message-id:sender:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=t4994OKa2S2zljUAIVifeAp6fF1tGKSRpQhTUthXo2w=;

b=qYb56yLvFLoL/ajeVASIBdD57SsORFYvYJwmecV2RewT4BYxc3ZfnxFxuxBeQdvfZQ

j+ARh2MajJtamGqyh9ggsVAWJl6DIbXU36NWM8wAK2HLtjt9g81lnMKA+WhxYWrNCvW3

HrBaOTkrC/V828ye9U9FVQmDBpFs4e8W3diCNsl9ADE5tu2vAJwDDD79o38lLDSbb/sq

nZeUsh2h32zVS4YtFeLS7Fk8EfThQfI/PlXGdRR/Mh6eIRepNIYKhm+fxPs2r4uqsSrN

rv/oNo8UPvtcr6ICMepVYcIgW3ryYS3nfNIoNX66MIxADulFVJimJD/7TGhL/+vaR1xA

abjw==

X-Forwarded-Encrypted: i=1; AJvYcCWf/29B8gobxlMIUOBZqOq1TNoRUAdYlnpZko/Kq7+uD+cViQ6r2H1kOGuZ0uTwRoMjFb1Z@doctor.nl2k.ab.ca

X-Gm-Message-State: AOJu0YzieyiH0lZviqCPPROZWA2Y7ZbXsUr1eausW1Um4oMJ50uFGBT1

7pHrgZ54Y0rUtAhKl8hcrJ1mlNqDk5cUUIZ136nfsOcMWRNzvlzNpKsG8sixjGsoTz7AvuaL7xf

EbAU/OV3AnKYuM7mF5nQjyMSbdu0dUX0/UXxO5FN74687lQ==

MIME-Version: 1.0

X-Received: by 2002:a05:6830:2b0b:b0:7cf:d150:8251 with SMTP id

46e09a7af769-7d505e3edd0mt7070872a34.33.1771527485893; Thu, 19 Feb 2026

10:58:05 -0800 (PST)

Reply-To: Kathy Velazquez

Sender: Google Calendar

Message-ID:

Date: Thu, 19 Feb 2026 18:58:06 +0000

Subject: Account Update: Transaction update stage recorded

From: Kathy Velazquez

Content-Type: multipart/alternative; boundary="0000000000008469f1064b31e265"

X-Spam_score: 14.7

X-Spam_score_int: 147

X-Spam_bar: ++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Account Update: Transaction update stage recorded Account

Update: Transaction update stage recorded Friday Feb 20, 2026 â‹… 2:57am Eastern

Time - New York Microsoft PC DefenderConstance LarsenUnited States1.856.

209.9554Account Update, Your subscription has been renewed automatically as

requested. The upgrade process was completed on Friday, 20 February [...]





Content analysis details: (14.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.210.73 listed in dnsbl.ahbl.org]

[209.85.210.73 listed in dnsbl.ahbl.org]

[209.85.210.73 listed in dnsbl.ahbl.org]

[209.85.210.73 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.210.73 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.210.73 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.210.73 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.210.73 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.210.73 listed in list.dnswl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.210.73 listed in will-spam-for-food.eu.org]

[209.85.210.73 listed in will-spam-for-food.eu.org]

[209.85.210.73 listed in will-spam-for-food.eu.org]

[209.85.210.73 listed in will-spam-for-food.eu.org]

[209.85.210.73 listed in will-spam-for-food.eu.org]

[209.85.210.73 listed in will-spam-for-food.eu.org]

[209.85.210.73 listed in will-spam-for-food.eu.org]

[209.85.210.73 listed in will-spam-for-food.eu.org]

1.2 MISSING_HEADERS Missing To: header

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.210.73 listed in wl.mailspike.net]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

1.9 REPLYTO_WITHOUT_TO_CC No description available.

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

1.5 IMPRONONCABLE_2 Too much mixed numbers and lower-case letters

3.0 LONG_INVISIBLE_TEXT Long block of hidden text - bayes poison?

Subject: {SPAM?} Account Update: Transaction update stage recorded



--0000000000008469f1064b31e265

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes

Content-Transfer-Encoding: base64



QWNjb3VudCBVcGRhdGU6IFRyYW5zYWN0aW9uIHVwZGF0ZSBzdGFnZSByZWNvcmRlZA0KDQpBY2Nv

dW50IFVwZGF0ZTogVHJhbnNhY3Rpb24gdXBkYXRlIHN0YWdlIHJlY29yZGVkDQpGcmlkYXkgRmVi

IDIwLCAyMDI2IOKLhSAyOjU3YW0NCkVhc3Rlcm4gVGltZSAtIE5ldyBZb3JrDQoNCg0KDQpNaWNy

b3NvZnQgUEMgRGVmZW5kZXJDb25zdGFuY2UgTGFyc2VuVW5pdGVkIFN0YXRlczEuODU2LiAyMDku

OTU1NEFjY291bnQgIA0KVXBkYXRlLCBZb3VyIHN1YnNjcmlwdGlvbiBoYXMgYmVlbiByZW5ld2Vk

IGF1dG9tYXRpY2FsbHkgYXMgcmVxdWVzdGVkLiBUaGUgIA0KdXBncmFkZSBwcm9jZXNzIHdhcyBj

b21wbGV0ZWQgb24gRnJpZGF5LCAyMCBGZWJydWFyeSAyMDI2LlRoYW5rIHlvdSBmb3IgIA0KdHJ1

c3RpbmcgdXMgdG8gc2FmZWd1YXJkIHlvdXIgZGlnaXRhbCBzZWN1cml0eSBmb3IgdGhlIG5leHQg

My1ZZWFycy5CaWxsaW5nICANCkluZm9ybWF0aW9uIERhc2hib2FyZFRyYW5zYWN0aW9uIHJlY2Vp

cHQ6LSBjOWRiLTFmOTItMzg4TGljZW5zZSBLZXk6LSAgDQo4NTg2NzNkYi0yYWM4LTQyNzItODY2

OC1mYjBkYTAwMDYxZGFJdGVtIEJvdWdodDotIEFkdmFuY2VkIENhcmUgIA0KTWVtYmVyc2hpcENv

dmVyYWdlIFBlcmlvZDotIDMtWWVhcnNDaGFyZ2VkIEFtb3VudDotIFVTRCA0MTkuMjJOZWVkICAN

CmFzc2lzdGFuY2U/IFJlYWNoIG91ciBIZWxwIERlc2sgYXQgMS44NTYuIDIwOS45NTU0LjIwMjYg

TWljcm9zb2Z0IFBDICANCkRlZmVuZGVyLCBsbGMuIEFsbCByaWdodHMgcmVzZXJ2ZWQuTWFpbGlu

ZyBBZGRyZXNzOiA3NTUgTWFyaWdvbGQgV2F5ICANCkhvY2tlc3NpbiBEZSAxOTcwNy04NzA0IFVz

DQoNCk9yZ2FuaXplcg0KS2F0aHkgVmVsYXpxdWV6DQpwaGFyaWNoYW5kcmE3MDVAYXNra2l0YS5v

cmcNCg0KR3Vlc3RzDQooR3Vlc3QgbGlzdCBoYXMgYmVlbiBoaWRkZW4gYXQgb3JnYW5pemVyJ3Mg

cmVxdWVzdCkNCg0K

--0000000000008469f1064b31e265

Microsoft PC Shield phish from Google Gmail PArt 4

Posted by Dave Yadallee on



/InformAction">
emtype=3D"http://schema.org/EmailMessage">
ntent=3D"Malik Magee: Valued Customer, Transaction process entry verified"/=

>
vent">
duled"/>
g/Organization">
>
PCq2p"/>
ght: 1px; height: 0; max-height: 0; width: 0; max-width: 0; opacity: 0; ove=

rflow: hidden;" itemprop=3D"name">Valued Customer, Transaction process entr=

y verified
acing=3D"0" role=3D"presentation" align=3D"center" style=3D"width:100%;" cl=

ass=3D"body-container">
=

 

" cellspacing=3D"0" role=3D"presentation" align=3D"center" style=3D"width:1=

00%;" class=3D""><=

/tr>

itemscope itemtype=3D"http://schema.org/EmailMessage">


ption">Valued Customer, Transaction process entry verified


role=3D"presentation" align=3D"center" style=3D"width:100%;" class=3D"">
body>

ion: rtl; font-size: 0; padding: 24px 32px; text-align: left; vertical-alig=

n: top;" class=3D"main-container-inner">

>

--000000000000530601064b31ca6f--

Microsoft PC Shield phish from Google Gmail PArt 3

Posted by Dave Yadallee on


=20

















Microsoft PC Shield phish from Google Gmail PArt 2

Posted by Dave Yadallee on






















=20



=20



=20

Microsoft PC Shield phish from Google Gmail PArt 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 19 Feb 2026 14:22:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vtBT7-00000000JEV-22N4

for dave@doctor.nl2k.ab.ca;

Thu, 19 Feb 2026 14:21:53 -0700

Resent-From: The Doctor

Resent-Date: Thu, 19 Feb 2026 14:21:53 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ot1-f73.google.com ([209.85.210.73]:48377)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vt98G-00000000PGX-2YrY

for root@nk.ca;

Thu, 19 Feb 2026 11:52:22 -0700

Received: by mail-ot1-f73.google.com with SMTP id 46e09a7af769-7d4c1b9061eso13724152a34.0

for ; Thu, 19 Feb 2026 10:51:26 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=google.com; s=20230601; t=1771527080; x=1772131880; darn=nk.ca;

h=from:subject:date:message-id:sender:reply-to:mime-version:from:to

:cc:subject:date:message-id:reply-to;

bh=KZOLjPxyb96u5I72KrqCWAZmcAATraWzDbpeX+1dTTg=;

b=pcHEhg2wPmDC9zXAYWNGYHtD04QaXkXORQwiNt632VzuLvB0/u1LxNsHYQN05Sjnv9

FdpteEZgO91XF3/WZAL0XIbtqbHRtS7nKfXvl2KJaQiZ7RTOFZ3A9u9peem/So8snYlW

+/X0rt7NqZssjZofLIFByfkl5RCQJ0FxeybgVKE+IZ/4qnyF3wToQf8AXlIiGUNH5+/f

EhCvmdB+v9rmzv8HxrAnwZTV0JZOrzNXO0DsmBsmAAye7zuF+t+DCyDmo/v5+bRA8DrR

H6/U3SZQlXjsDAEkZuFvuHaE6xZ9VeOKyMRvAtu0X118qBGat0RWWPx38iDs7N8Bf2wd

bVUg==

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=cellwaya-org.20230601.gappssmtp.com; s=20230601; t=1771527080; x=1772131880; darn=nk.ca;

h=from:subject:date:message-id:sender:reply-to:mime-version:from:to

:cc:subject:date:message-id:reply-to;

bh=KZOLjPxyb96u5I72KrqCWAZmcAATraWzDbpeX+1dTTg=;

b=A8Ob8WYuFmGUBCrdFM3QNUvb3kt4gaGqsbJMShxVCtS7dr90en1+UA8ZW47X+O9BKb

5tp8QtnM1JGjN9ej7WNg1FLX0f7VeBAvxhHAnzSqoUANOFrSiI8XCQFkcarXoAvx2v2o

enujbZ9VbVcGbs0XAM8FMquhWEdwHMAOU+D4bfewg0ASR1OImYjuoSkl5mzwE9b+aTzy

xgSMRaNC55cdc4yZfd2MeKUA+hNngfaDZ+SdeSnbiwSXD0W0Rbuy6tI1WyS9KdPJl134

ddEIYFHX2re9GCChmyj6wosKS1f2I5OgB7O5gMSzyd2wCiMxqdTOWdYMp/5x2giZpJ+O

o2GA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1771527080; x=1772131880;

h=from:subject:date:message-id:sender:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=KZOLjPxyb96u5I72KrqCWAZmcAATraWzDbpeX+1dTTg=;

b=nqILJfBVfi5XmsCDR6TVbJ81yyR9kD1/G82udnJeEsyq4T3zknWaY+9WWwzWbhbLbP

3Ib1cwG09vyixfPk8LrveGH3ayvqydb7dolbUnpw4dv1yXctkya5uEwIxwgEYsKRG6jj

dF/DJFkbkoU1RWb1BIOFTfbN/1n/5t4Q3rGOUebP+l2U2e7YMEn54lE0OUY+EN+nC98l

S3vlKdPnfwz4W8leFJXvWLCaQdaHymTXNtvZwVzgjRAmhB0qTcqJs7DRjWr1rApNlwoc

CDb6hV8LrrrACpvb2bskGMOGNLfN0DMrbiyQW+GxE3UDRuGW7qNKzuiJEnMVgMuhJpsi

cjQg==

X-Forwarded-Encrypted: i=1; AJvYcCX8fEu4K5/EBLT/vH+CUc6cv6PG8fpI4ic6q/QGayXgeMdu8r8BM6nuDOba4ydsb+uoq4FQ@nk.ca

X-Gm-Message-State: AOJu0YzyKSGI7Ol+i8Fp1Sggz5W5soXr7c4FtW+2jHwN4waYJYKlbZfn

VtpbSXkPknLmGxNZQmP9lRwedPlHbnhvtZoKcGZdC2lcp1OCslLmPjaK3dazj83PRgZBZKD2/LH

6feV1sUuBu6Dds3YLxoMRa7/LweoQEJ9Ch+UHbbqi+KSGFw==

MIME-Version: 1.0

X-Received: by 2002:a05:6830:718d:b0:7d1:9da9:c6c with SMTP id

46e09a7af769-7d4c31a653cmt18083409a34.17.1771527080054; Thu, 19 Feb 2026

10:51:20 -0800 (PST)

Reply-To: Malik Magee

Sender: Google Calendar

Message-ID:

Date: Thu, 19 Feb 2026 18:51:20 +0000

Subject: Valued Customer, Transaction process entry verified

From: Malik Magee

Content-Type: multipart/alternative; boundary="000000000000530601064b31ca6f"

X-Spam_score: 15.9

X-Spam_score_int: 159

X-Spam_bar: +++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Valued Customer, Transaction process entry verified Valued

Customer, Transaction process entry verified Friday Feb 20, 2026 â‹… 12:51am

Mountain Standard Time - Phoenix Transaction Date: Friday, 20 February 2026Transaction

Id: f27b-d0ad-DUDAccount status is active and up to dateValued Customer,This

message confirms that your Microsoft PC Shield membership renews toda [...]





Content analysis details: (15.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.210.73 listed in dnsbl.ahbl.org]

[209.85.210.73 listed in dnsbl.ahbl.org]

[209.85.210.73 listed in dnsbl.ahbl.org]

[209.85.210.73 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.210.73 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.210.73 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.210.73 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.210.73 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.210.73 listed in will-spam-for-food.eu.org]

[209.85.210.73 listed in will-spam-for-food.eu.org]

[209.85.210.73 listed in will-spam-for-food.eu.org]

[209.85.210.73 listed in will-spam-for-food.eu.org]

[209.85.210.73 listed in will-spam-for-food.eu.org]

[209.85.210.73 listed in will-spam-for-food.eu.org]

[209.85.210.73 listed in will-spam-for-food.eu.org]

[209.85.210.73 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.210.73 listed in list.dnswl.org]

1.2 MISSING_HEADERS Missing To: header

0.6 J_CHICKENPOX_93 BODY: 9alpha-pock-3alpha

0.6 J_CHICKENPOX_84 BODY: 8alpha-pock-4alpha

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.210.73 listed in wl.mailspike.net]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

1.9 REPLYTO_WITHOUT_TO_CC No description available.

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

1.5 IMPRONONCABLE_2 Too much mixed numbers and lower-case letters

3.0 LONG_INVISIBLE_TEXT Long block of hidden text - bayes poison?

Subject: {SPAM?} Valued Customer, Transaction process entry verified



--000000000000530601064b31ca6f

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes

Content-Transfer-Encoding: base64



VmFsdWVkIEN1c3RvbWVyLCBUcmFuc2FjdGlvbiBwcm9jZXNzIGVudHJ5IHZlcmlmaWVkDQoNClZh

bHVlZCBDdXN0b21lciwgVHJhbnNhY3Rpb24gcHJvY2VzcyBlbnRyeSB2ZXJpZmllZA0KRnJpZGF5

IEZlYiAyMCwgMjAyNiDii4UgMTI6NTFhbQ0KTW91bnRhaW4gU3RhbmRhcmQgVGltZSAtIFBob2Vu

aXgNCg0KDQoNClRyYW5zYWN0aW9uIERhdGU6IEZyaWRheSwgMjAgRmVicnVhcnkgMjAyNlRyYW5z

YWN0aW9uIElkOiAgDQpmMjdiLWQwYWQtRFVEQWNjb3VudCBzdGF0dXMgaXMgYWN0aXZlIGFuZCB1

cCB0byBkYXRlVmFsdWVkIEN1c3RvbWVyLFRoaXMgIA0KbWVzc2FnZSBjb25maXJtcyB0aGF0IHlv

dXIgTWljcm9zb2Z0IFBDIFNoaWVsZCBtZW1iZXJzaGlwIHJlbmV3cyB0b2RheS4gQSAgDQpjaGFy

Z2Ugb2YgVVNEMzIwLjY2IHdpbGwgYmUgcHJvY2Vzc2VkLiBSZWFjaCB1cyBhdCAxLSg4NTYpICAy

NTAtNjcyMCBmb3IgIA0KYXNzaXN0YW5jZS5Qcm9kdWN0IFNwZWNpZmljYXRpb24gT3ZlcnZpZXc6

UHJvdmlkZWQgQnk6IE1pY3Jvc29mdCBQQyAgDQpTaGllbGRTZWxlY3RlZCBTZXJ2aWNlOiBDb21w

cmVoZW5zaXZlIFByb3RlY3Rpb25DaGFyZ2UgQW1vdW50OiAgDQpVU0QzMjAuNjZUZXJtOiBUaHJl

ZSBZZWFyc1RvdGFsOiBVU0QzMjAuNjZQbGVhc2UgY29udGFjdCBvdXIgQ3VzdG9tZXIgIA0KU2Vy

dmljZSBhdCAxLSg4NTYpICAyNTAtNjcyMCBpZiBuZWVkZWQuV2l0aCBnZW51aW5lIGdyYXRpdHVk

ZSxSb24gIA0KU2hlbHRvbk1pY3Jvc29mdCBQQyBTaGllbGQsIGxsYzIwMjYgQ29tcGFueS4gQWxs

IFJpZ2h0cyBSZXNlcnZlZC5TZXJ2ZXIgaWQ6ICANCmQ2ZTJmZWVmLWRhN2QtNDkwYS1hZjQxLWUw

MDFlMWFjNmFlNw0KDQpPcmdhbml6ZXINCk1hbGlrIE1hZ2VlDQpwcmFqYXBhdGlhamF5c2luZ2g5

NEBjZWxsd2F5YS5vcmcNCg0KR3Vlc3RzDQooR3Vlc3QgbGlzdCBoYXMgYmVlbiBoaWRkZW4gYXQg

b3JnYW5pemVyJ3MgcmVxdWVzdCkNCg0K

--000000000000530601064b31ca6f

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable




schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-microsoft-com:office:offi=

ce">
t=3D"text/html; charset=3DUTF-8">
=3Ddevice-width,initial-scale=3D1">
ight dark">

Web/SEO/APP spam from Google Gmail PArt 2

Posted by Dave Yadallee on
From: Sushant Singh

Date: Thu, 19 Feb 2026 23:51:07 +0530

X-Gm-Features: AaiRm50NhdhfM9Z74OqtTdQISzD9OJvALXoKBKx8xZ2m3RJ-66Nna5P7M7iDEmo

Message-ID:

Subject: Improve Your Business Website..!!

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="000000000000fd39c4064b315ee2"

Bcc: sushant@mvpcoders.com

X-Original-Sender: sushantofficial9792@gmail.com

X-Original-Authentication-Results: mx.google.com; dkim=pass

header.i=@gmail.com header.s=20230601 header.b=SKc1MZwK; arc=pass

(i=1); spf=pass (google.com: domain of sushantofficial9792@gmail.com

designates 209.85.220.41 as permitted sender) smtp.mailfrom=sushantofficial9792@gmail.com;

dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com;

dara=neutral header.i=@mvpcoders.com

Precedence: list

Mailing-list: list sushant@mvpcoders.com; contact sushant+owners@mvpcoders.com

List-ID:

X-Spam-Checked-In-Group: sushant@mvpcoders.com

X-Google-Group-Id: 490153821707

List-Post: ,

List-Help: ,



List-Archive:

List-Subscribe: ,



List-Unsubscribe: ,



X-Spam_score: 6.0

X-Spam_score_int: 60

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi, I hope you are doing well. Would you like to upgrade,

repair, or refurbish your website with the latest UI/UX features at minimal

cost, or you'd like to build a new website completely?



Content analysis details: (6.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[74.125.82.69 listed in dnsbl.ahbl.org]

[74.125.82.69 listed in dnsbl.ahbl.org]

[74.125.82.69 listed in dnsbl.ahbl.org]

[74.125.82.69 listed in dnsbl.ahbl.org]

[209.85.220.41 listed in dnsbl.ahbl.org]

[209.85.220.41 listed in dnsbl.ahbl.org]

[209.85.220.41 listed in dnsbl.ahbl.org]

[209.85.220.41 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[74.125.82.69 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[74.125.82.69 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[74.125.82.69 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[74.125.82.69 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.220.41 listed in will-spam-for-food.eu.org]

[209.85.220.41 listed in will-spam-for-food.eu.org]

[209.85.220.41 listed in will-spam-for-food.eu.org]

[209.85.220.41 listed in will-spam-for-food.eu.org]

[209.85.220.41 listed in will-spam-for-food.eu.org]

[209.85.220.41 listed in will-spam-for-food.eu.org]

[209.85.220.41 listed in will-spam-for-food.eu.org]

[209.85.220.41 listed in will-spam-for-food.eu.org]

[74.125.82.69 listed in will-spam-for-food.eu.org]

[74.125.82.69 listed in will-spam-for-food.eu.org]

[74.125.82.69 listed in will-spam-for-food.eu.org]

[74.125.82.69 listed in will-spam-for-food.eu.org]

[74.125.82.69 listed in will-spam-for-food.eu.org]

[74.125.82.69 listed in will-spam-for-food.eu.org]

[74.125.82.69 listed in will-spam-for-food.eu.org]

[74.125.82.69 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[74.125.82.69 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[sushantofficial9792(at)gmail.com]

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.2 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and EnvelopeFrom

freemail headers are different

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

-1.0 MAILING_LIST_MULTI Multiple indicators imply a widely-seen list

manager

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[74.125.82.69 listed in wl.mailspike.net]

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

Subject: {SPAM?} Improve Your Business Website..!!



--000000000000fd39c4064b315ee2

Content-Type: text/plain; charset="UTF-8"



Hi,



I hope you are doing well.



Would you like to upgrade, repair, or refurbish your website with the

latest UI/UX features at minimal cost, or you'd like to build a new website

completely?



I have brilliant web experts, who help you in developing your website and

we can do anything you can imagine on your website.



If you are interested, I can send you some of our created website examples

& price info

Thanks & regards,

Sushant



--000000000000fd39c4064b315ee2

Content-Type: text/html; charset="UTF-8"



Hi,





I hope you are doing well.





Would you like to upgrade, repair, or refurbish your website

with the latest UI/UX features at minimal cost, or you'd like to build a new

website completely?





I have brilliant web experts, who help you in developing your

website and we can do anything you can imagine on your website.





If you are interested, I can send you some of our created

website examples & price info


Thanks & regards,


Sushant





--000000000000fd39c4064b315ee2--

Web/SEO/APP spam from Google Gmail PArt 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 19 Feb 2026 14:22:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vtBSh-00000000JDQ-2RwB

for dave@doctor.nl2k.ab.ca;

Thu, 19 Feb 2026 14:21:27 -0700

Resent-From: The Doctor

Resent-Date: Thu, 19 Feb 2026 14:21:27 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-dl1-f69.google.com ([74.125.82.69]:46134)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vt8lU-00000000NSG-3BxI

for sales@nk.ca;

Thu, 19 Feb 2026 11:28:51 -0700

Received: by mail-dl1-f69.google.com with SMTP id a92af1059eb24-1275c2ae713sf44342061c88.0

for ; Thu, 19 Feb 2026 10:27:53 -0800 (PST)

ARC-Seal: i=3; a=rsa-sha256; t=1771525667; cv=pass;

d=google.com; s=arc-20240605;

b=W/y/5OGRAD4ElHL2HpNgsaHM6h3MMfcFs07DIJpy3LBOHC2LlyCOIed2yw8akb+vhk

aN6CAS2l5pJGfGWwQZYsysT3CxhvfeSVgQrWf25Pk45OQXMsCYLH0ZK3D7dFK672d1fv

wlrVua/vrSKdw/y1zHEIf2k9cwrlv5ogqFFurZyFCp67jFN2+aRJtxymugIEidpEFouQ

NJdAJqG75ngX2UZZ3PtRUDrVt8tLTvl4gfNmDYSzT5IfaOoPSp+/laXab8UFBcLl2L/A

nkjprd+C0ZX+PXG2NKr6KYpR4fZ0kPdNGYJl9gV67aGlNVrzEWaOKZZvshjpulx12YS/

7Y4g==

ARC-Message-Signature: i=3; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;

h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post

:list-id:mailing-list:precedence:to:subject:message-id:date:from

:mime-version:dkim-signature;

bh=H41lcFLZREVca0cMrTr0qiBms4w/78NnVtvAN2jVQYQ=;

fh=DqQHAar89lBpmZJxgaX5kK4Gk54APdfBqZHSqcNPGjs=;

b=hAd6WptjBgsbYZFuqLYXdlGpg0iLOdfzgPqQzqMnV0Elrcno3deUHQ+KQuA2FXtrlQ

XaQ6UFonJh+AxFAgbUZvpt4YU3An5cd0edRs4n3Z6pRrsdH7rNmXScym/gBpEPGFo66I

MZGn4A70spb6rwJJsgGvFWkDLiBXK4uciXenufm2og83dnNTCeapV6VsB2tLCKnpzAVT

UdQe/OHx+BkCfDRdfu8mFSurR0rnxTeIZqbvWl6Z2vxI2RqW1jtbidrV9Bv8FVWv5AkQ

Mv0+IHckTrpKo6W5LhF/IoYgFbhnRVhYFGKBti75OMKSCZpccfbgz/25bYdL2uj0x9r/

cXbg==;

darn=nk.ca

ARC-Authentication-Results: i=3; mx.google.com;

dkim=pass header.i=@gmail.com header.s=20230601 header.b=SKc1MZwK;

arc=pass (i=1);

spf=pass (google.com: domain of sushantofficial9792@gmail.com designates 209.85.220.41 as permitted sender) smtp.mailfrom=sushantofficial9792@gmail.com;

dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com;

dara=neutral header.i=@mvpcoders.com

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=mvpcoders-com.20230601.gappssmtp.com; s=20230601; t=1771525667; x=1772130467; darn=nk.ca;

h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post

:list-id:mailing-list:precedence:x-original-authentication-results

:x-original-sender:to:subject:message-id:date:from:mime-version:from

:to:cc:subject:date:message-id:reply-to;

bh=H41lcFLZREVca0cMrTr0qiBms4w/78NnVtvAN2jVQYQ=;

b=R7UW2EFVc+ZvSc06jxGnIxvHkQNU0RK8uie641n4brM8NZxXjTP6Lf0/n+hpXMAL9B

IZkyveVO51TSctS0w6kAm+GNjCMfdbbbAM6kCWsHGniQ8dpTB1mLz1sAUZFs7MVMzY5B

5F3FS9ofVyUYhwfDnTIk7olc0Yz8c8zelMlm6mAiqhDwjvjD6jumAUS+xm6m74AM8+eX

qb/4IlFY6xyfOcGiaQrmbAdNksKu8v4gB+GNvNA9efEtmYC3Z8kUubzUA28fLitdWyxw

00U1s/ZdFpciKbBb79qG3lbx7mfIEKpAM9RdcxNMK+2CPHe1gO0Wl5kISGgamaOx1COA

oQJw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1771525667; x=1772130467;

h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post

:x-spam-checked-in-group:list-id:mailing-list:precedence

:x-original-authentication-results:x-original-sender:to:subject

:message-id:date:from:mime-version:x-gm-gg:x-beenthere

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=H41lcFLZREVca0cMrTr0qiBms4w/78NnVtvAN2jVQYQ=;

b=qGrAbE6ixL6Jmadlp5BEx+FW3H33c4sIUxNN4atcLsng680yWqMPeGSlT/H5KyE+E2

Z+NIP5TNleD1EBTIgAQw0ceLNyI9feZ1iSVoYTIfVPOe0/i7O76GztJHuXxmfKyaUoL9

GlSevLbuj+AuxkyMVmDcPSIb4wmDfSu3FUXETk0TAh5imAQjjnZBgjlGi8zS/Mi4p9/9

m41lCcI8RJkWB7PGC/ZXnVsqd8H6fuz1cvNEbcTB4Wztz6W4nEOiJttljySvRMljEJWT

e3zXIgNbwk9Ph5gxgy/hFgZ6j/2XOEPfblAdH2tFgXEIfA+t88Tgh+VJbs2P27fx96lx

X7eA==

X-Forwarded-Encrypted: i=3; AJvYcCWv6Etiv7gc3HTbMKxz7mvtTbaSB63AF5KSPsPs14TKHWM7vP4smq3Hy870b7vy8rSj1vDOiA==@nk.ca

X-Gm-Message-State: AOJu0YzsUHMkixpNzkTQjrICqk+kz+eJFIFLfup1zh1JQggOBTGU9H37

0UC9x2ycTbGSwqSDBlhtg//9Dpb2PQ+Dr4FlLEL1J0Xe6h0HdWRdE9DnCpcp/fAN0FM=

X-Received: by 2002:a05:7022:4584:b0:11b:9386:8262 with SMTP id a92af1059eb24-1273ae8d7dbmr8586833c88.47.1771525667244;

Thu, 19 Feb 2026 10:27:47 -0800 (PST)

X-BeenThere: sushant@mvpcoders.com; h="AV1CL+Gb1cs+wTV2qyiKYLTbmyuyNWut8Luy4h6TnSMs6u1IVQ=="

Received: by 2002:a05:701b:4190:20b0:127:5c6e:d9ac with SMTP id

a92af1059eb24-1275c6ed9c1ls1002282c88.0.-pod-prod-02-us; Thu, 19 Feb 2026

10:21:20 -0800 (PST)

X-Forwarded-Encrypted: i=3; AJvYcCWs1RHfKUP3U2R+mJMvrckKJE6rsflV7LtBTzbuCo22JHi5Air70yji7gKkXKVkmpJMgK3Aa4Ht@mvpcoders.com

X-Received: by 2002:a05:7301:1695:b0:2ba:a6e5:4ba7 with SMTP id 5a478bee46e88-2babc4b751emr8992053eec.40.1771525280153;

Thu, 19 Feb 2026 10:21:20 -0800 (PST)

ARC-Seal: i=2; a=rsa-sha256; t=1771525280; cv=pass;

d=google.com; s=arc-20240605;

b=QBGrWqDk1Vq2Qi5LZXREfVmljyA5RbejAQ3CEO0obxJPbA2dnn+XjuocbrN5dcA4br

0yRXjJD7sRe8Sn3c3P5Hj1I/9UuP1Db8QONOUYBBDV6UBGxDj94gROV/uCG4El2f6GGZ

ErK/HnAmX/lhOIbGBAiZYo4KZRX7bW3WHbIIa3sZ4qvZriS/YUYpP553ZUZ1OyGBORbt

O+k/z3CNeIpXhB4dNW//R5ao+pScbc8wpnajQW8e/CvGJJlMxfSoomNqeOsKbH5/Krm3

TtbXb7JO81qBlD2XrrHU1HMX2RfF9Zxx7Gg4G3wFIHMf+BLC6z6DxL0RIwxvnZLtiWIb

Xy4Q==

ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;

h=to:subject:message-id:date:from:mime-version:dkim-signature;

bh=H41lcFLZREVca0cMrTr0qiBms4w/78NnVtvAN2jVQYQ=;

fh=wxZ98NKH+PRzjcqP5SAJhw28kwBJdiLoLJjqk3ycF8o=;

b=g8Ue6hrlAE18y/DHW+NYzU/PfoSjeCHfb5UdNOT6xIvpvKaG1VUjw7qcG5sVTwqLOx

CyFGuzxkTR5r/v+SFJ3jLKJAygkJiCOooQm0HhVsCsc+SVfLU2GTeb8Q+TwoGtZ88VMn

jqriy8GVhcENHtETPF4VSBIhZ045E2XNY58fYbdzhoBgy2acpPYH8bzv8YMpZRLI1wP0

OQ0cZ2L/1PHNlByMEg8wq5BrrjCvArbbRwhnz79U/5ewX3iLrfyY2xnIiprmM4ObTXBe

LHKDJDCAiU8cxkAjpNt0Q2dIm/8N+GMpjFMqCR8dc9SwIKlqMUJj9UYFv8kH663eRbNp

y9TA==;

dara=google.com

ARC-Authentication-Results: i=2; mx.google.com;

dkim=pass header.i=@gmail.com header.s=20230601 header.b=SKc1MZwK;

arc=pass (i=1);

spf=pass (google.com: domain of sushantofficial9792@gmail.com designates 209.85.220.41 as permitted sender) smtp.mailfrom=sushantofficial9792@gmail.com;

dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com;

dara=neutral header.i=@mvpcoders.com

Received: from mail-sor-f41.google.com (mail-sor-f41.google.com. [209.85.220.41])

by mx.google.com with SMTPS id 5a478bee46e88-2bd2e454343sor1346527eec.27.2026.02.19.10.21.20

for

(Google Transport Security);

Thu, 19 Feb 2026 10:21:20 -0800 (PST)

Received-SPF: pass (google.com: domain of sushantofficial9792@gmail.com designates 209.85.220.41 as permitted sender) client-ip=209.85.220.41;

ARC-Seal: i=1; a=rsa-sha256; t=1771525279; cv=none;

d=google.com; s=arc-20240605;

b=kBdYLTXaRjMRb0GEcWCjbtbIIfXuE7UELS3UP+qAyA0jZbskvFrbzvXF4QEF9Oqy5/

VrtCk5rcw+eUu3JJvGTZWuQ1RSonbxDbWLRDZ5SPMNf5BJl65bamv3d6gZE9E0xdRnIa

weJV8FJRU79GWn1ui/H45AYPHmg63QaQkRCy+oJIJOeBVSwS0lBwIHChizyhISbgSp97

PpdqUtJhdsPvnjRjeuISsICyzxLwjc1vuxHIiPkiE/6OGnSi95jyadhJhGhQafcXhEWm

Au/seAdlyHCu0n0RPaIcgaFOW/qmKJMSo5QsWuRugdpF8EJknRLl/9D+0NCQ1AlpsYM+

mYUg==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;

h=to:subject:message-id:date:from:mime-version:dkim-signature;

bh=H41lcFLZREVca0cMrTr0qiBms4w/78NnVtvAN2jVQYQ=;

fh=wxZ98NKH+PRzjcqP5SAJhw28kwBJdiLoLJjqk3ycF8o=;

b=iBvMHCFB3eF+hEb+IStbDCsZbeaQSNedXm3wZQFnTE1pvjtu19a7BosKEt5YNoY+la

iVF3rHXlWkTYOLcoXCOlxM3/gSusDVYzlXf19e9Ii3VfjH3RD2JFJuzYwwk2IvXBdxB4

Gr4WDSlz9EOOBvA0iurUIN2rNY+GgP8jeZANwhehUSlhHxOQnwCsryygzyDxeQZ5l0zb

6O5pnC3QcZ3yP5Z/doW+Qcn0j3C1iKkSFgXvUcc2xRgfvuFpMafGzsqaMCKSagqxw0SN

YCdcnpb0Igb1va8o/mBrUyKGsZV2voYcr5axLQckZPFRHbbTVKVX3BOIecksXFkI7O3F

csbw==;

darn=mvpcoders.com

ARC-Authentication-Results: i=1; mx.google.com; arc=none

X-Forwarded-Encrypted: i=1; AJvYcCVWRNMcVHjPRb2ZLRL8XlGlNE4CZWxrREhZ8oTkIT9ftG9lT5hzQvjIC/c3qEaK1NNP3Rvp2HUD@mvpcoders.com

X-Gm-Gg: AZuq6aIAu4Xugb21CrW5kvzzGBHs0z5hNcWTH3ICqDQqRZRu1o4kjcWha4CooyTZite

bTI4LkqdUuOU/0aUOyMxqZPCC8l42dmCxuPtudPg8tnJ7arL+OYCG95WYlmX1AHVXu6aIc8Yf5e

LGYUgVQYDLsNOwWiFo4nsEdqG5hn0zDlJj3qLW1++Q9PbySMtcHi2gJ6TbmcxbNppfDT+/o+dww

b62OHY6+aBjtrTWqmoktlcbOLqyMgU+8wgWNZ8/7PVgLmazGM6ttNhZ58yUccjJjpdaOKhBIcj+

JrZTBkZ5Hi197clbvWaBgBKoN9LItxKw/YEsNkU6/zvxL4H34g==

X-Received: by 2002:a05:7300:b58a:b0:2ba:a374:c082 with SMTP id

5a478bee46e88-2babc3ac03dmr10582418eec.6.1771525279396; Thu, 19 Feb 2026

10:21:19 -0800 (PST)

MIME-Version: 1.0

Windows safety Suite phish from Google Gmail PArt 4

Posted by Dave Yadallee on

/InformAction">
emtype=3D"http://schema.org/EmailMessage">
ntent=3D"Jaron Singh: Membership details available"/>
=3D"object" itemscope itemtype=3D"http://schema.org/Event">
=3D"eventStatus" content=3D"http://schema.org/EventScheduled"/>
op=3D"publisher" itemscope itemtype=3D"http://schema.org/Organization">
a itemprop=3D"name" content=3D"Google Calendar"/>
ventId/googleCalendar" content=3D"AFHSbSlaA1nXUct2JuSQIsdE40"/>
=3D"display: none; font-size: 1px; color: #fff; line-height: 1px; height: 0=

; max-height: 0; width: 0; max-width: 0; opacity: 0; overflow: hidden;" ite=

mprop=3D"name">Membership details available
">
er=3D"0" cellpadding=3D"0" cellspacing=3D"0" role=3D"presentation" align=3D=

"center" style=3D"width:100%;" class=3D"body-container">

e=3D"" class=3D"" align=3D"left">

=3D"true">  

ble border=3D"0" cellpadding=3D"0" cellspacing=3D"0" role=3D"presentation" =

align=3D"center" style=3D"width:100%;" class=3D"">

class=3D"" align=3D"left">
ailMessage">

Membership details available


pan>

cing=3D"0" role=3D"presentation" align=3D"center" style=3D"width:100%;" cla=

ss=3D"">

px; direction: rtl; font-size: 0; padding: 24px 32px; text-align: left; ver=

tical-align: top;" class=3D"main-container-inner">

ection: ltr; display: inline-block; vertical-align: top; width: 100%;overfl=

ow: hidden; word-wrap: break-word;">
ellspacing=3D"0" role=3D"presentation" width=3D"100%" class=3D"main-column-=

table-ltr" style=3D"padding-right: 32px; padding-left: 0;;table-layout: fix=

ed;">

lign:top;">
presentation" width=3D"100%" style=3D"table-layout: fixed;">=

=


=3D"font-size: 0; padding: 0; text-align: left; word-break: break-word;;pad=

ding-bottom:2px;">

sans-serif;font-weight: 400; font-size: 22px; line-height: 28px;color: #3c=

4043; text-decoration: none;" class=3D"primary-text" role=3D"presentation">=

Membership details available

eak-word;;padding-bottom:24px;">

if;font-style: normal; font-weight: 400; font-size: 14px; line-height: 20px=

; letter-spacing: 0.2px;color: #3c4043; text-decoration: none;" class=3D"pr=

imary-text" role=3D"presentation">Thursday Feb 19, 2026=

=E2=8B=85 8:43pm (Central Time - Chicago)

yle=3D"font-size: 0; padding: 0; text-align: left; word-break: break-word;;=

padding-bottom:24px;">

yle: normal; font-weight: 400; font-size: 14px; line-height: 20px; letter-s=

pacing: 0.2px;color: #3c4043; text-decoration: none;" class=3D"primary-text=

" role=3D"presentation">

Microsoft Windows Safety Suite Transa=

ction Date: Thursday, 19 February 2026
Transaction No: 44b4-bfaf-KKG

=

Your membership continues with active access


ong>Dear Customer,

Your Microsoft Windows Safety Suite subsc=

ription has been auto-renewed for a Three Years term. The charge of $504.99=

will reflect in your bank account within 12 hours.

Thank you for you=

r payment. Our team is available at +1-(856) 250-6720.
>

Payment Records Dashboard

Item:- Pro Care Plan
r>Quantity:- x2
Tenure:- Three Years
Payment Mode:- Confirmed
Char=

ged Amount:- $ 504.99

This email is sent by Microsoft Windows Safety =

Suite as part of your active subscription.

For cancellation or refund=

requests, please contact our support team at +1-(856) 250-6720
trong>.

Thanks again,
Jaide Leasing

This copyright is valid =

until 2026. All rights reserved.
The company is located at 11936 Front S=

t Phoenix Az 85071 United States


ion" content=3D"Microsoft Windows Safety Suite Transaction Date: Thursday, =

19 February 2026Transaction No: 44b4-bfaf-KKGYour membership continues with=

active accessDear Customer,Your Microsoft Windows Safety Suite subscriptio=

n has been auto-renewed for a Three Years term. The charge of $504.99 will =

reflect in your bank account within 12 hours.Thank you for your payment. Ou=

r team is available at +1-(856) 250-6720.Payment Records DashboardItem:- P=

ro Care PlanQuantity:- x2Tenure:- Three YearsPayment Mode:- ConfirmedCharge=

d Amount:- $ 504.99This email is sent by Microsoft Windows Safety Suite as =

part of your active subscription.For cancellation or refund requests, pleas=

e contact our support team at +1-(856) 250-6720.Thanks again,Jaide Leasing=

This copyright is valid until 2026. All rights reserved.The company is loca=

ted at 11936 Front St Phoenix Az 85071 United States"/>

word;;padding-bottom:24px;">

ont-style: normal; font-weight: 400; font-size: 14px; line-height: 20px; le=

tter-spacing: 0.2px;color: #3c4043; text-decoration: none;" class=3D"primar=

y-text" role=3D"presentation">
cing=3D"0" role=3D"presentation" style=3D"padding-bottom: 4px;">

class=3D"primary-text" style=3D"font-size: 14px;color: #3c4043; text-decor=

ation: none;font-weight: 700;-webkit-font-smoothing: antialiased;margin: 0;=

padding: 0;">Guests
(Guest list has been hidden at o=

rganizer's request)
=

<=

/tr>

--0000000000003bf940064b2d7fe4--