Product catalogue request spam

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 05 Jun 2026 09:21:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wVWLt-00000000Gge-2eRo

for dave@doctor.nl2k.ab.ca;

Fri, 05 Jun 2026 09:20:53 -0600

Resent-From: The Doctor

Resent-Date: Fri, 5 Jun 2026 09:20:53 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from vzded219.smartservers.com.au ([203.98.83.103]:35844)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wVV96-00000000J2b-3Coe

for root@nk.ca;

Fri, 05 Jun 2026 08:03:46 -0600

Received: from [155.103.70.103] (port=53463 helo=menbakasal262)

by vzded219.smartservers.com.au with esmtpsa (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.99.4)

(envelope-from )

id 1wVV8J-0000000DUqi-3jZS

for root@nk.ca;

Fri, 05 Jun 2026 22:02:47 +0800

From: "Hans Edstrom"

Subject: Re: Purchase.

To:

Content-Type: multipart/alternative; boundary="Qq89=_CJhn12MdlKIlCWGmZpyeR9n1ex3B"

MIME-Version: 1.0

Reply-To:

Date: Fri, 5 Jun 2026 07:02:46 -0700

Message-Id: <0545202606020713DA988C2C$75C4B666D2@hualeonggroup.sg>

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - vzded219.smartservers.com.au

X-AntiAbuse: Original Domain - nk.ca

X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]

X-AntiAbuse: Sender Address Domain - hualeonggroup.sg

X-Get-Message-Sender-Via: vzded219.smartservers.com.au: authenticated_id: ehs@hualeonggroup.sg

X-Authenticated-Sender: vzded219.smartservers.com.au: ehs@hualeonggroup.sg

X-Source:

X-Source-Args:

X-Source-Dir:

X-Spam_score: 8.8

X-Spam_score_int: 88

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear Sir, I am reaching out regarding our interest in your

products. Kindly provide your product price list along with catalogs for

our review. Additionally, please include any relevant information that may

ass [...]



Content analysis details: (8.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[155.103.70.103 listed in dnsbl.ahbl.org]

[155.103.70.103 listed in dnsbl.ahbl.org]

[155.103.70.103 listed in dnsbl.ahbl.org]

[155.103.70.103 listed in dnsbl.ahbl.org]

[203.98.83.103 listed in dnsbl.ahbl.org]

[203.98.83.103 listed in dnsbl.ahbl.org]

[203.98.83.103 listed in dnsbl.ahbl.org]

[203.98.83.103 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[155.103.70.103 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[155.103.70.103 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[155.103.70.103 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[155.103.70.103 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[155.103.70.103 listed in will-spam-for-food.eu.org]

[155.103.70.103 listed in will-spam-for-food.eu.org]

[155.103.70.103 listed in will-spam-for-food.eu.org]

[155.103.70.103 listed in will-spam-for-food.eu.org]

[155.103.70.103 listed in will-spam-for-food.eu.org]

[155.103.70.103 listed in will-spam-for-food.eu.org]

[155.103.70.103 listed in will-spam-for-food.eu.org]

[155.103.70.103 listed in will-spam-for-food.eu.org]

[203.98.83.103 listed in will-spam-for-food.eu.org]

[203.98.83.103 listed in will-spam-for-food.eu.org]

[203.98.83.103 listed in will-spam-for-food.eu.org]

[203.98.83.103 listed in will-spam-for-food.eu.org]

[203.98.83.103 listed in will-spam-for-food.eu.org]

[203.98.83.103 listed in will-spam-for-food.eu.org]

[203.98.83.103 listed in will-spam-for-food.eu.org]

[203.98.83.103 listed in will-spam-for-food.eu.org]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[edstromh00(at)gmail.com]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[155.103.70.103 listed in sbl-xbl.spamhaus.org]

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Listed by XBL, see ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.7 DEAR_SOMETHING BODY: Contains 'Dear (something)'

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[203.98.83.103 listed in bl.score.senderscore.com]

Subject: {SPAM?} Re: Purchase.



This is a multi-part message in MIME format



--Qq89=_CJhn12MdlKIlCWGmZpyeR9n1ex3B

Content-Type: text/plain; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable





Dear Sir,



I am reaching out regarding our interest in your products. Kindly prov=

ide your product price list along with catalogs for our review. Additi=

onally, please include any relevant information that may assist us in =

conducting due diligence about your company.



Thank you for your attention to this matter. We are optimistic about t=

he potential for a long-term business partnership and look forward to =

your response.



Regards

Mr. Hans Edstrom

CEO

Company Name: INWATER AB

Address: Lovangsvagen 12 194 45 Upplands V=E4sby

Stockholms,

Tel: +46739303676



--Qq89=_CJhn12MdlKIlCWGmZpyeR9n1ex3B

Content-Type: text/html; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable








8859-1">


le=3D1"> <=

title>Re: Purchase.



Dear =

Sir,

I am reaching out regarding our interest in your products. =

Kindly provide your product price list along with catalogs for our rev=

iew. Additionally, please include any relevant information that may as=

sist us in conducting due diligence about your company.

Thank yo=

u for your attention to this matter. We are optimistic about the poten=

tial for a long-term business partnership and look forward to your res=

ponse.

Regards
Mr. Hans Edstrom
CEO
Company Name: INWAT=

ER AB
Address: Lovangsvagen 12 194 45 Upplands V=E4sby
Stockholm=

s,
Tel: +46739303676







--Qq89=_CJhn12MdlKIlCWGmZpyeR9n1ex3B--



Geek Squad Phish from Microsoft Outlook Part 4



Haresasz Nxysarwsa has invited you to Geek Squad Security Renewal Alert

Title: Geek Squad Security Renewal Alert

Location: https://meet.google.com/pas-qxpy-ach

When: June 5, 2026

Organizer:

Haresasz Nxysarwsa

Description: Dear Protected Customer,



We wish to notify you that the Geek Squad 365 Advanced Protection Plan safeguarding your devices has been securely renewed for another three-year term.



The mandatory renewal fee of $299.99 was processed using your stored payment details. It can take up to twenty-four hours for this purchase to appear on bank statements.



Protection Summary:

Contract: 365 Advanced Protection Plan

Period: 3 Years

Charged: $299.99



To report any unrecognized or potentially fraudulent activity regarding this charge, call our Billing Specialists right away at +1 805 422 6065 to receive immediate support from us.



Thank you for continually prioritizing security with Geek Squad services.



Respectfully yours, Billing Team



-::~:~::~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~::~:~::-

Pripojiť sa cez Google Meet: https://meet.google.com/pas-qxpy-ach



Viac o službe Meet sa dozviete na https://support.google.com/a/users/answer/9282720



Túto sekciu neupravujte.

-::~:~::~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~::~:~::-

Attendees:



cynthiaperez389903@groups.outlook.com



Geek Squad Security Renewal Alert

Pripojiť sa cez Google Meet – Dear Protected Customer, We wish to notify you that the Geek Squad 365 Advanced Protection Plan safeguarding your devices has been securely renewed for another three-year term. The mandatory renewal



Pripojiť sa cez Google Meet

Odkaz na stretnutie

meet.google.com/pas-qxpy-ach

Dear Protected Customer,



We wish to notify you that the Geek Squad 365 Advanced Protection Plan safeguarding your devices has been securely renewed for another three-year term.



The mandatory renewal fee of $299.99 was processed using your stored payment details. It can take up to twenty-four hours for this purchase to appear on bank statements.



Protection Summary:

Contract: 365 Advanced Protection Plan

Period: 3 Years

Charged: $299.99



To report any unrecognized or potentially fraudulent activity regarding this charge, call our Billing Specialists right away at +1 805 422 6065 to receive immediate support from us.



Thank you for continually prioritizing security with Geek Squad services.



Respectfully yours, Billing Team

Kedy

piatok 5. jún 2026

Organizátor

Haresasz Nxysarwsa

haressaznzxrrsxaxz321@gmail.com

Hostia

(Zoznam hostí bol na žiadosť organizátora skrytý)

Odpoveď na cynthiaperez389903@groups.outlook.com

Áno



Nie



Možno

Ďalšie možnosti



Pozvánka z Kalendára Google



Túto správu ste dostali, pretože ste účastníkom danej udalosti.



Ak túto pozvánku prepošlete, ktorýkoľvek jej príjemca bude môcť odoslať odpoveď organizátorovi, byť pridaný do zoznamu hostí, pozývať iných bez ohľadu na ich vlastný stav pozvánky alebo meniť vaše potvrdenie účasti. Ďalšie informácie

Geek Squad Phish from Microsoft Outlook Part 2

X-Microsoft-Antispam-Message-Info:

=?utf-8?B?NHpob1Q3d0FGMEx3UW5PMm9NWi96UnkzUzFjMnZ5R2dreGpoRSsrTE9nTGlJ?=

=?utf-8?B?UmxEN2IzL2k1bXNoWEpIL2p3Ynkzak5mcnpLQ3A0ZGM4bWx1Rko0bGlyUWp1?=

=?utf-8?B?VE5vcG1UMHVpMXI1cFlWV3VsK1k4ME5nZUpUUDRiYllMeHdlVUFsVWpsT0w0?=

=?utf-8?B?eHFpSE1mNkdwRVMrbG5tNXd2Z2ZzTHRRWXd5c2pLbzkyTUJaT2g5bFZBUGha?=

=?utf-8?B?WWxRZDBhc0RLTGZreU1mY0YzZ1BEZWNWcTdqbG5nQm1qZ3ozRmk4cEc1R25t?=

=?utf-8?B?REtQbHRnNit1NyswQ3IrdGh3V0g4SkNWSjJ0bWtocGFOVHlIY3Rxc3FlUHM5?=

=?utf-8?B?THlKaG5YY3JBZ1VyV2pKL1JVb29vajlWaFc0LzZneXQ0VzNRN0pzWWY5UHN2?=

=?utf-8?B?SUs5OUhDV0dlNThXWnlQWUV1STRodHYxNHpiQmVtNDdDcGpGNytGbitjdXk1?=

=?utf-8?B?M1ZsUERxZ2ZvbnBjMXFDcGxwbENLUnRIN2crTjI5R0pQYmdkK0NpTXFYUEFr?=

=?utf-8?B?djF4MVg2VGF4MkhDWEMxaXBsN0pFQ1hqdU5WYjJRTE9pSzJkYzJieFRhVlNL?=

=?utf-8?B?RGpWYkVDMitlbkYvMEQ1MWFBYW5BaHJleXBjMk13anFmRFRsZFRROFVFSm5E?=

=?utf-8?B?WjVhMGFuM1l4WEFBWHM2RHJRMkN5ZFNvaTZyUUQxcU1BOUVuNGp6NU1iRkpD?=

=?utf-8?B?TDFma3JDRXBxZFNLZXRZbExxYzVFak9qZ3ZsRWE1ZTFEdnNmdFNQVjBnaWFO?=

=?utf-8?B?ckp5SEpIVm1sNkRsNE1NbkJzZ2lsaWdIUFB6clF0ZFpJVnl3cUdTdldvUERR?=

=?utf-8?B?TjR5SnJDV3hLZFgyWjVkckZPNVA3R3RTSGl2YUExTTVmdDBqRTlrL204SWtt?=

=?utf-8?B?dlo5M0xub0w5T0hzV01uQ3pxakgwUGdQYUZ3T0l5TzRhdUEvTGJMRTFOQ3Qr?=

=?utf-8?B?QkM2MHk4eGRMdHB3aEhZNkJQSlU2MHlxRm52WFVGdzM3WGRHcVk1WldQVVJh?=

=?utf-8?B?K2FqaXozbnhEU3BKcG1vQ0J2K2lSWXZoWHZJTGNEeFlKMXRBRHB3Y2kwM3ZL?=

=?utf-8?B?NHpTS05BQklvSzlVb1N1N25tbjVsUXE2ak00bTR2Smg2Vjl2OFJiUHBnNkNK?=

=?utf-8?B?OEdleGtmME9iZ0svMWFySm5JeXE0aExlNGtEWHFTTGM0Y0prRU1EQ2Z4ZVNN?=

=?utf-8?B?cHc2TXN3cnhJS0pqWHkxUzNQbGh3TnJBNDZSbG5OSlVRTGFVQkQwVjB3WlF3?=

=?utf-8?B?SlN2ZXp5Y3h1b1JhUTZBbXVQYUVuam5QSUlNa0hoNkptMCtMb0ZiOGtxSDJk?=

=?utf-8?B?S0pNREtPL1BsMWJCRWZTZnpyd3ZnNnJjUXVkYVFKMWRLWTkrWVpKaXdicDJi?=

=?utf-8?B?dUg2eGMybEhLVEZwdXpOamJpWnNiTmdIdXBlYmh2emtOa256Sk1mZUZTMGdk?=

=?utf-8?B?YUdFWXNyb096cG51eHo5YVpZZlhZUmU3L0lvUGJXb3cyblBjWEV1cUI5UERn?=

=?utf-8?B?NWZYWlBCS0pmdG5XTzNqWTkyRUNhSFdBMkJuZUdsTUFLcVpEUGdwVHNJczVv?=

=?utf-8?B?QVQ2T0NrMFZVZ2NUZWN3UWJHbnV0blYrRUJ0TnorOWtXUmtDVlRPQzZleFdS?=

=?utf-8?B?RU0xSXBoTnNsRndtUWhjYXZ0MXVuV1FiU0VMZDdVNWhyUStRTUg1eDJ2R1RZ?=

=?utf-8?B?MWpQRTZCTGJLM2tJeGtZTzErY1A5TmdDYU9ZQ0JFaUcvUy9pazhneFNoWThT?=

=?utf-8?B?bGZGR2RzS0oyQmpUWFN2ajZ4SWIrcFhCRHY0ZzBVWExZZ0FoTC9ENzVzR0dV?=

=?utf-8?B?Z3BFY01aQStNM0ZFSjUxYnk2Uk1EeTlUeERrQS9vTm16bG5tWHhNWEdjMnAz?=

=?utf-8?B?NXB4d3ZKTVZIZFhIOE5EcU1nZUliOFdIMDVXNm5NRWxpVWhaV2pXbEh2OFc2?=

=?utf-8?B?WjFhN0dPMVpLRXpjVGl1WnFBcHgxTXZwZ21aa0JoWGNNeVFjM2pmOGVoYW50?=

=?utf-8?B?QnJIeWtKYWd5NGU2Um9JQXFoZitGTHYyeCtsa0xWNzYwcFd1S2MrdEZUS3JC?=

=?utf-8?B?UTllYmI5dWNHbW9BdjRWbmdWQTFXcDZNem9GNmdRRUpTekRhSVZGZjVBV1lS?=

=?utf-8?B?bTd2V1JKNHdja1llMjhweTNYc0ZkZFl6R0ZEWXRJK1NiS1pIQVp4UUw5TXZq?=

=?utf-8?B?R0R0UDBOaU4ybEhRVnpwdEg1azVsdFVyS0gwV1daZFBKNy9QTkRuSTFYKzBv?=

=?utf-8?B?T2xKekVkWHpTMi9OTUxtUDlTY0podHRZZzBpYjhac1RadDJPOC8wNkI2eUhx?=

=?utf-8?B?MXlGSkNlM1J1NnhIK0dNRldzOWE4Y3ZkK1dZWFd1dXVueDdSKzJKazV1TU9h?=

=?utf-8?B?Z2J2Z2QxVzQyRmZPU1ZRcXc3Qk9BdDRCRlI2amVzWkdjQzl6UTlOWStiNTRt?=

=?utf-8?B?UHpKUlpLeEpkR0FnMlQrZENKM29EbVF4Tk1wSGNaRVQ3QlV2eFNFcDVOelV1?=

=?utf-8?B?UUpHZWt3eWtpY20wNm0zZXlpZHljUFZlNjNvNjJpTHkwOXZWdzhRZHhvM0RX?=

=?utf-8?B?bW5sV25idGIyR294WFNjSlQvNXhZaWRlRlRJMGNTTHJ2NCtHOXQyRVRvdVlo?=

=?utf-8?B?S3JHazRzMmJDTWczUWN0eGVjeWpYclJqdFZUYlFGUmNmNWhOU042UkdSZkpi?=

=?utf-8?B?bXJqeTI0MVd1V3lQRHU1WThPenk3eTAzRVpwUHdVQVpCK1RPOXV0WnlzdFBC?=

=?utf-8?B?dzdQNVBmL3ZRaHFOLzFlRjJmVlYzUENjN3gyM0x2WVBJV2Z1M0R2bjcyNng0?=

=?utf-8?B?WkZ6RU9nVVpndDR3QXJrU0pMVVBwUGN6aUNqNmVGUjJXaEJ0ZkZwNXBjTDZr?=

=?utf-8?B?RytQMEpIcEI3ZlZXUTNZT2plM09aSkVLcGs2RCtkZitKVUF1VlNOR2pyNUJC?=

=?utf-8?B?SFFOUm0wbGhYWVpjSHlHajZBcmhNUllzYTVYcTcydG13ZU44STRxdFRHc1pw?=

=?utf-8?B?YkJWTGFFSk9UYmg0WFI3cS8zKzNmUWVCWG1tSEhvMmJNNml2bU84endURm5B?=

=?utf-8?B?T3ZYeXVOY1dXQVZFT2U2S29XZmN4Vm1QQ2ZEalZOMUkvdFJ3S0xiOVJoMXJM?=

=?utf-8?B?UWZ2TVMvTFJGVXExaXcrOTRvR3I4Uld2ODgxQkgzRjV5NVphWlFnTHFjNTY4?=

=?utf-8?B?cHpBRXBUWC9TWEd2Q3kxTkt0b0dWWXp0Z0krL1hyRUNuODM4WGhld0hjK2Fm?=

=?utf-8?B?ZnZEMXpFY3dsYzVqUkFkekpZSDBmUy9ua1dLZDhRNUZZREgwWXN6N0FLUmhY?=

=?utf-8?B?cG9xWkJMSzVZYVdJU0JpOTUrdXUrWWpDSXVzVGJGb0dhNjNRZWVUVitXdW8r?=

=?utf-8?B?d2QzUm1MRW1OQ0NWUmpxSzZMaGVHaHptL1BnSzVHTnlNOXJsNUxTbi9QNEdY?=

=?utf-8?B?UzVsOXp6VkZtYWMyVWNuZnZ2SW9EblROYzFEZ1BNcTJaQ3pFUnhmaHkyME5a?=

=?utf-8?B?RHVqZHg3QUtOUWs1WStwNnBnZnFEQjBDTjJNSWdBOW1Ua050bmhSN2ZGVmNL?=

=?utf-8?B?ODdMdDNNdmowc05WbVBZZ0l2VEdlNEdqbmNuTk9JeCs3Umh4SnZsazc3WWhm?=

=?utf-8?B?NDBscmxWS0FaU1ExQkY0N1hiZ09qUEdkdFRIWW1JOVVOOXF6b3hWRW1CUWdX?=

=?utf-8?B?bXFTZFdxUFpqQkRLVDF1VkJENzRML1l3NkxOT2VWYjBVMndDVFczWTdsc1lU?=

=?utf-8?B?Z1dlT01tSEtEeUEwU2hqTnB5ZkhIRzFzZWUvQWtjVTl5MWszRzhSMWR5Y3B5?=

=?utf-8?Q?zuIMVvj+reiyu5wbq9DxQ2Ms7l?=

X-Auto-Response-Suppress: DR, OOF, AutoReply

X-OriginatorOrg: sct-15-20-9412-4-msonline-outlook-090a5.templateTenant

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 05 Jun 2026 13:35:42.4103

(UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id: a0c2f9f1-17b3-4466-e6f8-08dec30756f6

X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-AuthSource: BN3PEPF0000B071.namprd04.prod.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: Internet

X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM4PR18MB4365

X-Spam_score: 13.9

X-Spam_score_int: 139

X-Spam_bar: +++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Geek Squad Security Renewal Alert piatok 5. jún 2026 Pripojiť

sa cez Google Meet https://meet.google.com/pas-qxpy-ach?hs=224 Dear Protected

Customer,



Content analysis details: (13.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[40.93.12.21 listed in dnsbl.ahbl.org]

[40.93.12.21 listed in dnsbl.ahbl.org]

[40.93.12.21 listed in dnsbl.ahbl.org]

[40.93.12.21 listed in dnsbl.ahbl.org]

[209.85.128.71 listed in dnsbl.ahbl.org]

[209.85.128.71 listed in dnsbl.ahbl.org]

[209.85.128.71 listed in dnsbl.ahbl.org]

[209.85.128.71 listed in dnsbl.ahbl.org]

[2603:10b6:408:e6:cafe:0:0:1c listed in]

[dnsbl.ahbl.org]

[2603:10b6:408:e6:cafe:0:0:1c listed in]

[dnsbl.ahbl.org]

[2603:10b6:408:e6:cafe:0:0:1c listed in]

[dnsbl.ahbl.org]

[2603:10b6:408:e6:cafe:0:0:1c listed in]

[dnsbl.ahbl.org]

[2603:10b6:408:e6:0:0:0:15 listed in]

[dnsbl.ahbl.org]

[2603:10b6:408:e6:0:0:0:15 listed in]

[dnsbl.ahbl.org]

[2603:10b6:408:e6:0:0:0:15 listed in]

[dnsbl.ahbl.org]

[2603:10b6:408:e6:0:0:0:15 listed in]

[dnsbl.ahbl.org]

Geek Squad Phish from Microsoft Outlook Part 3

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[40.93.12.21 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[40.93.12.21 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[40.93.12.21 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[40.93.12.21 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.128.71 listed in will-spam-for-food.eu.org]

[209.85.128.71 listed in will-spam-for-food.eu.org]

[209.85.128.71 listed in will-spam-for-food.eu.org]

[209.85.128.71 listed in will-spam-for-food.eu.org]

[209.85.128.71 listed in will-spam-for-food.eu.org]

[209.85.128.71 listed in will-spam-for-food.eu.org]

[209.85.128.71 listed in will-spam-for-food.eu.org]

[209.85.128.71 listed in will-spam-for-food.eu.org]

[2603:10b6:408:e6:cafe:0:0:1c listed in]

[will-spam-for-food.eu.org]

[2603:10b6:408:e6:cafe:0:0:1c listed in]

[will-spam-for-food.eu.org]

[2603:10b6:408:e6:cafe:0:0:1c listed in]

[will-spam-for-food.eu.org]

[2603:10b6:408:e6:cafe:0:0:1c listed in]

[will-spam-for-food.eu.org]

[2603:10b6:408:e6:cafe:0:0:1c listed in]

[will-spam-for-food.eu.org]

[2603:10b6:408:e6:cafe:0:0:1c listed in]

[will-spam-for-food.eu.org]

[2603:10b6:408:e6:cafe:0:0:1c listed in]

[will-spam-for-food.eu.org]

[2603:10b6:408:e6:cafe:0:0:1c listed in]

[will-spam-for-food.eu.org]

[2603:10b6:408:e6:0:0:0:15 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:408:e6:0:0:0:15 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:408:e6:0:0:0:15 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:408:e6:0:0:0:15 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:408:e6:0:0:0:15 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:408:e6:0:0:0:15 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:408:e6:0:0:0:15 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:408:e6:0:0:0:15 listed in]

[will-spam-for-food.eu.org]

[40.93.12.21 listed in will-spam-for-food.eu.org]

[40.93.12.21 listed in will-spam-for-food.eu.org]

[40.93.12.21 listed in will-spam-for-food.eu.org]

[40.93.12.21 listed in will-spam-for-food.eu.org]

[40.93.12.21 listed in will-spam-for-food.eu.org]

[40.93.12.21 listed in will-spam-for-food.eu.org]

[40.93.12.21 listed in will-spam-for-food.eu.org]

[40.93.12.21 listed in will-spam-for-food.eu.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[40.93.12.21 listed in list.dnswl.org]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

1.0 HK_RANDOM_REPLYTO Reply-To username looks random

1.0 HK_RANDOM_FROM From username looks random

0.5 FROM_LOCAL_NOVOWEL From: localpart has series of non-vowel letters

3.5 VOWEL_FROM_7 Impronouncable from header (7+ consecutive vowels)

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[40.93.12.21 listed in bl.score.senderscore.com]

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[haressaznzxrrsxaxz321(at)gmail.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[haressaznzxrrsxaxz321(at)gmail.com]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

0.1 TW_RW BODY: Odd Letter Triples with RW

0.6 MEGALONGWORD BODY: Uses really overlong words

0.3 LONGWORD BODY: Uses overlong words

0.1 TW_QX BODY: Odd Letter Triples with QX

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.2 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and EnvelopeFrom

freemail headers are different

0.1 TO_IN_SUBJ To address is in Subject

3.0 LONG_INVISIBLE_TEXT Long block of hidden text - bayes poison?

Subject: {SPAM?} =?UTF-8?Q?Pozv=C3=A1nky=3A_Geek_Squad_Security_Renewal_Alert_=40_pi_5=2E?=

=?UTF-8?Q?_j=C3=BAn_2026_=28cynthiaperez389903=40groups=2Eoutlook=2Ecom=29?=

Geek Squad Phish from Microsoft Outlook Part 1

\X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 05 Jun 2026 09:21:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wVWLU-00000000FPe-0CXL

for dave@doctor.nl2k.ab.ca;

Fri, 05 Jun 2026 09:20:28 -0600

Resent-From: The Doctor

Resent-Date: Fri, 5 Jun 2026 09:20:27 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-eastus2azlp17010021.outbound.protection.outlook.com ([40.93.12.21]:35854 helo=BN1PR04CU002.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wVUj0-00000000HYI-3eRf

for doctor@doctor.nl2k.ab.ca;

Fri, 05 Jun 2026 07:36:51 -0600

Received: from BN0PR03CA0010.namprd03.prod.outlook.com (2603:10b6:408:e6::15)

by DM4PR18MB4365.namprd18.prod.outlook.com (2603:10b6:5:39a::10) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.71.15; Fri, 5 Jun 2026

13:35:42 +0000

Received: from BN3PEPF0000B071.namprd04.prod.outlook.com

(2603:10b6:408:e6:cafe::1c) by BN0PR03CA0010.outlook.office365.com

(2603:10b6:408:e6::15) with Microsoft SMTP Server (version=TLS1_3,

cipher=TLS_AES_256_GCM_SHA384) id 15.21.92.9 via Frontend Transport; Fri, 5

Jun 2026 13:35:42 +0000

Authentication-Results: spf=pass (sender IP is 209.85.128.71)

smtp.mailfrom=gmail.com; dkim=pass (signature was verified)

header.d=google.com;dkim=pass (signature was verified)

header.d=gmail.com;dmarc=pass action=none header.from=gmail.com;compauth=pass

reason=100

Received-SPF: Pass (protection.outlook.com: domain of gmail.com designates

209.85.128.71 as permitted sender) receiver=protection.outlook.com;

client-ip=209.85.128.71; helo=mail-wm1-f71.google.com; pr=C

Received: from mail-wm1-f71.google.com (209.85.128.71) by

BN3PEPF0000B071.mail.protection.outlook.com (10.167.243.116) with Microsoft

SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.92.5 via

Frontend Transport; Fri, 5 Jun 2026 13:35:42 +0000

X-IncomingTopHeaderMarker:

OriginalChecksum:B443219361A61EB7CC52C274A603A39198522F0D02679FA8F520649F3C96793C;UpperCasedChecksum:C13EBA62FAE74B872C16CFA71A80EC8368E1570A8DDC195D5DC0E57F2E52624F;SizeAsReceived:3374;Count:15

Received: by mail-wm1-f71.google.com with SMTP id 5b1f17b1804b1-490af284fd8so14924065e9.3

for ; Fri, 05 Jun 2026 06:35:42 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=google.com; s=20251104; t=1780666541; x=1781271341; darn=groups.outlook.com;

h=to:from:subject:date:message-id:sender:reply-to:mime-version:from

:to:cc:subject:date:message-id:reply-to;

bh=UJh/3ZZql8ltrPkcMr1hErbFFl+w4nVKwR1qsw9fVtk=;

b=HuxH8JY2986G8dTvSxfvGpJniGZF0nNSpI7BTYOg6OJzD5VqEDnE125EalO4cT2AhQ

4rqz5pwnMSMHRoW5JMKywZ89vidliekqb7adhnCONyvsyRxc0wOmG38ynKMnWZew9R8a

5YxCDEBV0xsvCMMxHWidK9obKdz0IQR8t/TWssdn2dd4Fo8t4J2Q4DIohag3zj1INsaq

OePv0LADUj78aBZi94QbzFcOkVaKxNBKb0gsGT52aV6p8Wjoukq72BxwOyqc3mNdLhwq

+3T3OSNCDqdy6fHT7AoPTTI1A0yhjerPwDn5X8Oo6ZczmTfNmozclslV5MoRVyF0zdAU

p/ug==

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1780666541; x=1781271341; darn=groups.outlook.com;

h=to:from:subject:date:message-id:sender:reply-to:mime-version:from

:to:cc:subject:date:message-id:reply-to;

bh=UJh/3ZZql8ltrPkcMr1hErbFFl+w4nVKwR1qsw9fVtk=;

b=ZFTDw1yeYEzfAGg46lS3dUUG+mVq7VM9hX7cyx7boYO+Mt12tspzdrDt3BeyTHAJDP

xbVQyUgcOuIUl1xXSlMrBKH/JRTr3msT56MM4MvmkfqQwF09P0kgB7AfA93c9tY2ocI2

i97Tkf4O6r+EXhLD7mMAnDDw84sAjGRUfX1Fs6/lTV5FIy1kv5uP3jC0q0yhmg/GntDA

1pn8uUoXbmMLfxx/SXCE5ok6Bahaum1FpNxx7iuUyo5fHWVowOKpvCKMNjnja10qdPd4

oBNavng9ODUTKGedXxo3Lo1u1DzQiEq8P9BB38NFQP5JmlbguYZ5QDPcyoj9xY9KrLXg

WW6A==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1780666541; x=1781271341;

h=to:from:subject:date:message-id:sender:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=UJh/3ZZql8ltrPkcMr1hErbFFl+w4nVKwR1qsw9fVtk=;

b=mXFhVMv9Ox0cI8MUOF1Py31WjejB9oJ470JLW2Cx2k7ehSeLys1H1ggc1wgRggjpqV

YsMO9l+bWt6rsvnPio1QnJkiohDV8fDIf89HOr4hobW153tnMzrNfeJT7iH4iqZMLgSX

uIdlHzJe81xRrUXv4D3MWgsU27XOvxgCZdOxOhPOBsWkKREVDeNXMrjZadIBWGomfxG0

Hb36D04Rxv7h0e1VcpnWjy2ATC1eHCaEiBujvBPRgSKKrCJp+TP0hqme2AoIrj138H/u

VNwjIUrdxCQ/EjuhCDcB18o0CNTITqnkRK1VGnXy1BpgxoO+fzJ3YEZGJhBgibpN8H5/

DBFw==

X-Gm-Message-State: AOJu0YxbG/aa5hEj2eZQaq5nu3ti7mtMFOFFH6NHY6LPspJAVUvL5HCC

Id3ye0QODIxlszB9fsUASgm8s6AhisXb1w8DA3k+7gqjX0lmKAf/FJalNBO+wcuYJLyw1yFA7NG

JZWygaFX0qLIbxwfelQFPCJuQszOkoP/Gskg=

MIME-Version: 1.0

X-Received: by 2002:a05:600c:4506:b0:490:b642:ce2a with SMTP id

5b1f17b1804b1-490c25c0d27mr58597045e9.9.1780666541372; Fri, 05 Jun 2026

06:35:41 -0700 (PDT)

Reply-To: Haresasz Nxysarwsa

Sender: =?UTF-8?Q?Kalend=C3=A1r_Google?=

Message-ID:

Date: Fri, 05 Jun 2026 13:35:41 +0000

Subject: =?UTF-8?Q?Pozv=C3=A1nky=3A_Geek_Squad_Security_Renewal_Alert_=40_pi_5=2E?=

=?UTF-8?Q?_j=C3=BAn_2026_=28cynthiaperez389903=40groups=2Eoutlook=2Ecom=29?=

From: Haresasz Nxysarwsa

To: cynthiaperez389903@groups.outlook.com

Content-Type: multipart/mixed; boundary="000000000000a97e42065381bcc1"

X-IncomingHeaderCount: 15

X-EOPAttributedMessage: 0

X-EOPTenantAttributedMessage: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa:0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: BN3PEPF0000B071:EE_|DM4PR18MB4365:EE_

X-MS-Office365-Filtering-Correlation-Id: a0c2f9f1-17b3-4466-e6f8-08dec30756f6

X-MS-Exchange-EOPDirect: true

X-Sender-IP: 209.85.128.71

X-SID-PRA: HARESSAZNZXRRSXAXZ321@GMAIL.COM

X-SID-Result: PASS

X-MS-Consumer-Group-Expansion-Loop: cynthiaperez389903@groups.outlook.com

X-MS-Exchange-Group-Expansion-Loop: cynthiaperez389903@groups.outlook.com

X-Microsoft-Antispam:

BCL:0;ARA:1444111002|1680799066|26130799012|9400799043|970799063|34130799006|6019299003|3069299007|32020799003|22000799015|16200799027|26000799027|9000799056|29080799009|4040799016|3151999006|5139299004|9020799019|24102599021|6092099016|26104999009|21002599022;

Norton 360 Phish from Google Gmail Part 2



Alanna Zaggia has invited you to Account Information Available for Review

Title: Account Information Available for Review

When: Friday, June 5, 2026 at 19:18

Organizer:

Alanna Zaggia

Description:



Norton 360 Registry » Friday, 05 June 2026 20:18:33

File Reference: QQVEUTSZI2GIKM • Contact Desk: (828)-275 1293‬





Account details continue under current service information





Customer Support Notice,





Please review the account information listed below. This notice has been generated as part of routine record maintenance.





Payment Activity Center



» Registry Handle: J6CMYCQC27



» Service Entry: Device Status Center



» Coverage Window: 1-Year



» Recorded Figure: $362.14 USD



» Security Marker: b6daedd9-a953-4acf-bd10-82c42a62e686





Please retain this document for future reference.





With kindness,,



Norton Life lock Security



Support Coordinator: Sherry Ramirez • Contact Phone: 1-(805)-(303)-0425



4758 Clear River Ct - San Jose Horace Nd 58047 USA



Attendees:



doctor@nl2k.ab.ca



Account Information Available for Review

Norton 360 Registry » Friday, 05 June 2026 20:18:33File Reference: QQVEUTSZI2GIKM • Contact Desk: (828)-275 1293‬ Account details continue under current service information Customer Suppo





Norton 360 Registry » Friday, 05 June 2026 20:18:33

File Reference: QQVEUTSZI2GIKM • Contact Desk: (828)-275 1293‬



Account details continue under current service information



Customer Support Notice,





Please review the account information listed below. This notice has been generated as part of routine record maintenance.



Payment Activity Center



» Registry Handle: J6CMYCQC27



» Service Entry: Device Status Center



» Coverage Window: 1-Year



» Recorded Figure: $362.14 USD



» Security Marker: b6daedd9-a953-4acf-bd10-82c42a62e686



Please retain this document for future reference.



With kindness,,



Norton Life lock Security



Support Coordinator: Sherry Ramirez • Contact Phone: 1-(805)-(303)-0425



4758 Clear River Ct - San Jose Horace Nd 58047 USA



When

Friday Jun 5, 2026 ⋅ 9:18pm (Eastern Time - New York)

Organizer

Alanna Zaggia

alannazaggia@dietlives.com

Guests

(Guest list has been hidden at organizer's request)

Reply for doctor@nl2k.ab.ca

Yes



No



Maybe

More options



Invitation from Google Calendar



You are receiving this email because you are an attendee on the event.



Forwarding this invitation could allow any recipient to send a response to the organizer, be added to the guest list, invite others regardless of their own invitation status, or modify your RSVP. Learn more

Norton 360 Phish from Google Gmail Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 05 Jun 2026 07:14:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wVUN4-00000000EdY-47oI

for dave@doctor.nl2k.ab.ca;

Fri, 05 Jun 2026 07:13:58 -0600

Resent-From: The Doctor

Resent-Date: Fri, 5 Jun 2026 07:13:58 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-qt1-f198.google.com ([209.85.160.198]:43118)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wVTWj-00000000Nrz-3d1K

for doctor@nl2k.ab.ca;

Fri, 05 Jun 2026 06:20:03 -0600

Received: by mail-qt1-f198.google.com with SMTP id d75a77b69052e-51776d4355cso74570801cf.0

for ; Fri, 05 Jun 2026 05:19:06 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=google.com; s=20251104; t=1780661940; x=1781266740; darn=nl2k.ab.ca;

h=to:from:subject:date:message-id:sender:reply-to:mime-version:from

:to:cc:subject:date:message-id:reply-to;

bh=6wZVN9MMcXxs1y6O/Bhm2l+PUbrE+RerPLmdZ2lidhw=;

b=vTGrMw/+Xw3gMVNDzMAJs9jKMs8sfk018Zd8DlivxekrcfdVc68I04FA8hkkHZnhCu

RhvohRMls3W9cK2djEi/YS+puyDvCoLLZ683EQ2Zqhb63s6N1K1ZCQGgc+ySrT7AzO+O

k+f57IFCVH3zIBdVwL5oSNcfQUlPsi/UsCNb1sUuae4DmJzkg73t5DJ95RZ2+3JoQZeD

TpTNwoW/qYPvoRlipp52X7M3tmUrFGCNI9GLBEbfwbkg6vN5LnUyxfaBLiyttY6GWOvZ

DiahC27kZfpke/wV+jcDpkC0ySzg/6ozYAIsx4QVtLn4AfWyWB/wBbe0qkWX5uuJyz8y

6G7A==

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=dietlives-com.20251104.gappssmtp.com; s=20251104; t=1780661940; x=1781266740; darn=nl2k.ab.ca;

h=to:from:subject:date:message-id:sender:reply-to:mime-version:from

:to:cc:subject:date:message-id:reply-to;

bh=6wZVN9MMcXxs1y6O/Bhm2l+PUbrE+RerPLmdZ2lidhw=;

b=d4p7QkjNdC9jrWR+KaE0sNsN+k8VdUtURCfqZfVNqzYqdx2C+IAPzzQ2Gsx5hwx0sE

edYOwL0NwGTzA7gQMY/4qrSIPlgGCVMhpPRft4sRZA1hk037vN8wJJQ3KUUTgNB+Jc1M

iigIwVrjcjZdCz4vtgtJz66cVUhoMjKzWxK3px37X2Tmbv1NppJeYqqh/dZ8J7Cmta4c

MyJh54IWrPKr1VLZ1PhSt2y9oCvToKFAFGDv073aTjxUNstQdL58Mtuqn4K93euszAel

9YWPVGTcbV/VZ0D2Q5aHArb+0huHVZOqpnvruwqw/G0hH4byX5H5eliTX9Xv9nuN1/pT

LJbg==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1780661940; x=1781266740;

h=to:from:subject:date:message-id:sender:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=6wZVN9MMcXxs1y6O/Bhm2l+PUbrE+RerPLmdZ2lidhw=;

b=J19ETFAUxKGMUkLzOydiI/cX1N0ZlUx7gfUgiml1NAbTaQwHiJ49uccHDTsVu7X/wy

4pTUn4KmSGuCS42ILG8bYrVzHAGko7wgsBVyuh1g/bDo8IU/xg7pei0Fv9QqzM5+PdUr

qpp64wKLpQ+2efInYE58UKf++Rq0ltf/kemstfaZPoOVMN5x9p/1bM4Zp0Ri8egIFK/a

6BbgD20LDS20037aopwgxLFzXqKNMDR7QB2mNhdch8hD1sChEM2UrMjkgZ2mawtvvYH3

F96qW+WJ51FjJxKwqE06PMHqcXTRGS7B+fHb6q9S/Q+/wOsbYaXdAq7F+8qq543VKQSc

lCOg==

X-Gm-Message-State: AOJu0YxpBu/UoZPKV5NSlBBqHZk2RpjdjIwkXg93aLX1/TI3TlB3LQa+

dhgtxcNctUFiQxPwS86un37HwQCF04OD8LOTocGJkIPs87J0XZgR/CrK3gE3VoR0OQ8P7zTG+iO

QsrKktAczF3236CvW3PZXYPFNSBIqY99Cm+rNq29E0P42Joe86qzTmKn8

MIME-Version: 1.0

X-Received: by 2002:a05:6820:f023:b0:69e:3426:5b64 with SMTP id

006d021491bc7-69e6d4ea507mr883291eaf.28.1780661929128; Fri, 05 Jun 2026

05:18:49 -0700 (PDT)

Reply-To: Alanna Zaggia

Sender: Google Calendar

Message-ID:

Date: Fri, 05 Jun 2026 12:18:49 +0000

Subject: Invitation: Account Information Available for Review @ Fri Jun 5,

2026 9:18pm (GMT-4) (doctor@nl2k.ab.ca)

From: Alanna Zaggia

To: doctor@nl2k.ab.ca

Content-Type: multipart/mixed; boundary="000000000000c037dc065380a94c"

X-Spam_score: 9.5

X-Spam_score_int: 95

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Account Information Available for Review Friday Jun 5, 2026

â‹… 9:18pm Eastern Time - New York Norton 360 Registry » Friday, 05

June 2026 20:18:33File Reference: QQVEUTSZI2GIKM • Contact Desk: (828)-275

1293‬



Content analysis details: (9.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.160.198 listed in dnsbl.ahbl.org]

[209.85.160.198 listed in dnsbl.ahbl.org]

[209.85.160.198 listed in dnsbl.ahbl.org]

[209.85.160.198 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.160.198 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.160.198 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.160.198 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.160.198 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.160.198 listed in will-spam-for-food.eu.org]

[209.85.160.198 listed in will-spam-for-food.eu.org]

[209.85.160.198 listed in will-spam-for-food.eu.org]

[209.85.160.198 listed in will-spam-for-food.eu.org]

[209.85.160.198 listed in will-spam-for-food.eu.org]

[209.85.160.198 listed in will-spam-for-food.eu.org]

[209.85.160.198 listed in will-spam-for-food.eu.org]

[209.85.160.198 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.160.198 listed in list.dnswl.org]

0.8 ZMIvirSobY_SUB39 SPAM from Sober-Y-Virus

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.6 MEGALONGWORD BODY: Uses really overlong words

0.3 LONGWORD BODY: Uses overlong words

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.160.198 listed in bl.score.senderscore.com]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.160.198 listed in wl.mailspike.net]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

1.5 IMPRONONCABLE_2 Too much mixed numbers and lower-case letters

3.0 LONG_INVISIBLE_TEXT Long block of hidden text - bayes poison?

Subject: {SPAM?} Invitation: Account Information Available for Review @ Fri Jun 5,

2026 9:18pm (GMT-4) (doctor@nl2k.ab.ca)

Norton 360 Phish from Google Gmail Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 05 Jun 2026 07:14:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wVUMx-00000000EdP-3gTN

for dave@doctor.nl2k.ab.ca;

Fri, 05 Jun 2026 07:13:51 -0600

Resent-From: The Doctor

Resent-Date: Fri, 5 Jun 2026 07:13:51 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-oo1-f69.google.com ([209.85.161.69]:43216)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wVTWY-00000000Np1-2WTs

for doctor@nl2k.ab.ca;

Fri, 05 Jun 2026 06:19:53 -0600

Received: by mail-oo1-f69.google.com with SMTP id 006d021491bc7-69e61a0e999so1525450eaf.0

for ; Fri, 05 Jun 2026 05:18:55 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=google.com; s=20251104; t=1780661930; x=1781266730; darn=nl2k.ab.ca;

h=to:from:subject:date:message-id:sender:reply-to:mime-version:from

:to:cc:subject:date:message-id:reply-to;

bh=6wZVN9MMcXxs1y6O/Bhm2l+PUbrE+RerPLmdZ2lidhw=;

b=MdQvg3Ijr0NLe2Qn7bAPj36pi9EK9/WZYl/Dnr0Jbjpb5DJhJKrNNjdt2Uxzkwqnvr

DAb9NobVxZcGVzL9YYTmVIbG3EiNAyCxj0ajZbKp32h3Jbu1eJxWBz5wApClfGEl99JD

X7SwM4puhhcdndpHXCvrEVMi6RHHZcdxmCP1E7RxlsDet9KL0xRRSk/vN1eVrAsLTjnc

JTzOxkR2UEnsERK8S9znAoQNbYgrCzDK55GK78j6XGIl7IXTdhNlIT7BYEk9SmwYoCjJ

EdusOoVaaiIuFzQ7lGdoHDRzd8Q00gcwF9ZlngSuKYptH4HqlKJxAMp8soi6EupL+Pol

i8Zw==

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=dietlives-com.20251104.gappssmtp.com; s=20251104; t=1780661930; x=1781266730; darn=nl2k.ab.ca;

h=to:from:subject:date:message-id:sender:reply-to:mime-version:from

:to:cc:subject:date:message-id:reply-to;

bh=6wZVN9MMcXxs1y6O/Bhm2l+PUbrE+RerPLmdZ2lidhw=;

b=BOjOuKDhuuoP9XWO/TH/CiQWykF5pH4rTX1Sn9DV8keh/OK7uZMR0bXudGys+k8h9C

plKWq8vm3z5bOcFwx2KI31eXd7R4YJ72jWPpPvD8JJvCgLl4tZeHHCecOmDB0j+IE+Kr

llLW6YJnZVUw6Yu8AxOFh2g7/B5wzLHovZashkDUeGhnKOCpwKqp2NuGrJrinMewGHxy

a3IaKso7VvjKGLQnyJZZs6meIXaMj3DCugjC5S7lvQHfVgLysHqVNjGZECJ5lcgzXzir

3+kxz5pP2WNoVzbRBeaKNSDDtHzQW5+LOdqHgiiEFg7xXZCMAwRxrmuJvzTSDz6kDLgO

Toow==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1780661930; x=1781266730;

h=to:from:subject:date:message-id:sender:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=6wZVN9MMcXxs1y6O/Bhm2l+PUbrE+RerPLmdZ2lidhw=;

b=bsbNfX3w+TkTDj2EaqLnVCDkiebVJdEzptMrgTnwLm9/4RQ77+DubtfrwKjm7fJPNk

OdQPXxvsehAgYHMc7HKmI5r6sSu7hMrVU2W99VBD/TW4EP6tGxhLYQ1KeAX8uBj2kHzj

GxLPQMBOcCKu7wSx+Rmmhp0vt7pQ3PwLeI1pIG3vdql1kktZOFxkx5CZdYJaVEgfuxdC

bAkGTm0ZxAtyiOREl+4mM9B5HgUXd60SoajKDHQrPSdKnsr6+i7MqbdKHiozeekcg+Ht

JoYdT6UrC0d5fTBVAn0z7xG18qeEfSTNU/rbMgAOLtdo02VIFduhjT7/jD7JeYGd8/uW

VJlA==

X-Gm-Message-State: AOJu0YxxtYOku8e1GjekZ4rIn0OaJJXqQfzyOUnJGTyag8EeYtkZTOkO

7X38lkbnOyC66Mb0l4THI8sU/tbqdNnvr6krtJU0kjFqEwl+WYuGsoj5K/Anvw3bD7jl88Adwge

1ZhIOY61IZ3O0sPkCCiQoHw3p9mz964COuIeW7Q/AGaI00kZxKHSvVp2G

MIME-Version: 1.0

X-Received: by 2002:a05:6820:f023:b0:69e:3426:5b64 with SMTP id

006d021491bc7-69e6d4ea507mr883291eaf.28.1780661929128; Fri, 05 Jun 2026

05:18:49 -0700 (PDT)

Reply-To: Alanna Zaggia

Sender: Google Calendar

Message-ID:

Date: Fri, 05 Jun 2026 12:18:49 +0000

Subject: Invitation: Account Information Available for Review @ Fri Jun 5,

2026 9:18pm (GMT-4) (doctor@nl2k.ab.ca)

From: Alanna Zaggia

To: doctor@nl2k.ab.ca

Content-Type: multipart/mixed; boundary="000000000000c037dc065380a94c"

X-Spam_score: 9.5

X-Spam_score_int: 95

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Account Information Available for Review Friday Jun 5, 2026

â‹… 9:18pm Eastern Time - New York Norton 360 Registry » Friday, 05

June 2026 20:18:33File Reference: QQVEUTSZI2GIKM • Contact Desk: (828)-275

1293‬



Content analysis details: (9.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.161.69 listed in dnsbl.ahbl.org]

[209.85.161.69 listed in dnsbl.ahbl.org]

[209.85.161.69 listed in dnsbl.ahbl.org]

[209.85.161.69 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.161.69 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.161.69 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.161.69 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.161.69 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.161.69 listed in list.dnswl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.161.69 listed in will-spam-for-food.eu.org]

[209.85.161.69 listed in will-spam-for-food.eu.org]

[209.85.161.69 listed in will-spam-for-food.eu.org]

[209.85.161.69 listed in will-spam-for-food.eu.org]

[209.85.161.69 listed in will-spam-for-food.eu.org]

[209.85.161.69 listed in will-spam-for-food.eu.org]

[209.85.161.69 listed in will-spam-for-food.eu.org]

[209.85.161.69 listed in will-spam-for-food.eu.org]

0.8 ZMIvirSobY_SUB39 SPAM from Sober-Y-Virus

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.6 MEGALONGWORD BODY: Uses really overlong words

0.3 LONGWORD BODY: Uses overlong words

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.161.69 listed in bl.score.senderscore.com]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.161.69 listed in wl.mailspike.net]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

3.0 LONG_INVISIBLE_TEXT Long block of hidden text - bayes poison?

1.5 IMPRONONCABLE_2 Too much mixed numbers and lower-case letters

Subject: {SPAM?} Invitation: Account Information Available for Review @ Fri Jun 5,

2026 9:18pm (GMT-4) (doctor@nl2k.ab.ca)

Norton 360 Phish from Google Gmail Part 2



Alanna Zaggia has invited you to Account Information Available for Review

Title: Account Information Available for Review

When: Friday, June 5, 2026 at 19:18

Organizer:

Alanna Zaggia

Description:



Norton 360 Registry » Friday, 05 June 2026 20:18:33

File Reference: QQVEUTSZI2GIKM • Contact Desk: (828)-275 1293‬





Account details continue under current service information





Customer Support Notice,





Please review the account information listed below. This notice has been generated as part of routine record maintenance.





Payment Activity Center



» Registry Handle: J6CMYCQC27



» Service Entry: Device Status Center



» Coverage Window: 1-Year



» Recorded Figure: $362.14 USD



» Security Marker: b6daedd9-a953-4acf-bd10-82c42a62e686





Please retain this document for future reference.





With kindness,,



Norton Life lock Security



Support Coordinator: Sherry Ramirez • Contact Phone: 1-(805)-(303)-0425



4758 Clear River Ct - San Jose Horace Nd 58047 USA



Attendees:



doctor@nl2k.ab.ca



Account Information Available for Review

Norton 360 Registry » Friday, 05 June 2026 20:18:33File Reference: QQVEUTSZI2GIKM • Contact Desk: (828)-275 1293‬ Account details continue under current service information Customer Suppo





Norton 360 Registry » Friday, 05 June 2026 20:18:33

File Reference: QQVEUTSZI2GIKM • Contact Desk: (828)-275 1293‬



Account details continue under current service information



Customer Support Notice,





Please review the account information listed below. This notice has been generated as part of routine record maintenance.



Payment Activity Center



» Registry Handle: J6CMYCQC27



» Service Entry: Device Status Center



» Coverage Window: 1-Year



» Recorded Figure: $362.14 USD



» Security Marker: b6daedd9-a953-4acf-bd10-82c42a62e686



Please retain this document for future reference.



With kindness,,



Norton Life lock Security



Support Coordinator: Sherry Ramirez • Contact Phone: 1-(805)-(303)-0425



4758 Clear River Ct - San Jose Horace Nd 58047 USA



When

Friday Jun 5, 2026 ⋅ 9:18pm (Eastern Time - New York)

Organizer

Alanna Zaggia

alannazaggia@dietlives.com

Guests

(Guest list has been hidden at organizer's request)

Reply for doctor@nl2k.ab.ca

Yes



No



Maybe

More options



Invitation from Google Calendar



You are receiving this email because you are an attendee on the event.



Forwarding this invitation could allow any recipient to send a response to the organizer, be added to the guest list, invite others regardless of their own invitation status, or modify your RSVP. Learn more

Norton 360 Phish from Google Gmail Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 05 Jun 2026 07:10:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wVUIY-00000000EPT-2a6D

for dave@doctor.nl2k.ab.ca;

Fri, 05 Jun 2026 07:09:18 -0600

Resent-From: The Doctor

Resent-Date: Fri, 5 Jun 2026 07:09:18 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ot1-f70.google.com ([209.85.210.70]:57795)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wVRSr-00000000GiK-10wt

for doctor@nl2k.ab.ca;

Fri, 05 Jun 2026 04:07:55 -0600

Received: by mail-ot1-f70.google.com with SMTP id 46e09a7af769-7e704fa3f07so1707605a34.3

for ; Fri, 05 Jun 2026 03:06:58 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=google.com; s=20251104; t=1780654012; x=1781258812; darn=nl2k.ab.ca;

h=to:from:subject:date:message-id:sender:reply-to:mime-version:from

:to:cc:subject:date:message-id:reply-to;

bh=1CU6PkMtgI47wNPo7VSUh0aiIYA9/4+CsxEddBBCIw4=;

b=RQDKPjJ7okSonfeaUGFLwRRqhklAUjj2a8fFMjz+St0vty+y05Amp4ca3eludVejJm

O4R2uRm8F9WPHOXGqzWcgj3Kqi41esQde5NYXfBr42Tuu+utoe4BFQwMY3bElDhipZx0

jZXH2VIwRI2ySmerjb2RqKNm9r8ihwNEhXL2vfz8tOge+AVwLz4H8Mp06QzwLLCOVMz8

wbOV8LqytNdZ2EFrPJU7Zii1CtvM/fim2sqbmuDzcMKUkWfmzq3KGhih8e3nQOIe+OQC

K5Ie4mDjRjwK/nBfC17sJl0QINbh24sMR4zbm+OF6zV6EGsZvQg9ajA4kYd6CYqNN6Ns

S7jg==

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=cyverau-com.20251104.gappssmtp.com; s=20251104; t=1780654012; x=1781258812; darn=nl2k.ab.ca;

h=to:from:subject:date:message-id:sender:reply-to:mime-version:from

:to:cc:subject:date:message-id:reply-to;

bh=1CU6PkMtgI47wNPo7VSUh0aiIYA9/4+CsxEddBBCIw4=;

b=Pb+OrPiMq8MqC0UAyFyacC/OUmxIFN4qLIY1Xu1FXCCpCvK2PhdYw5Vaq+zVwZUnYi

ihOeOaogSmgtRkeAW5WdPDY2Vt2lea3ML6+YfPDUp16EQND/0+yrBVTCAdzet2JmbXTy

i2dpNBbRJ1H+UFiiOGxWaSjzMzkF53nd3Yr3IMAUs6uH60ka3l9PLJYfjry75EKp0iTw

9qlrETOoJlUJF8jHQ1u42PP0WY6fBKVkES7E251Y5Q4FUBVYyL8PMX1lq2eEBIpdh0VD

yNmDtQnpB6OXGhxekPmOywIFOrElzqeeRI3CD/mHLSmngl5yWfrYLs4FA7TMqRoRocSW

00sQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1780654012; x=1781258812;

h=to:from:subject:date:message-id:sender:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=1CU6PkMtgI47wNPo7VSUh0aiIYA9/4+CsxEddBBCIw4=;

b=MhBKboebDbPifHnTphFhjDHwmLBdLsLFcqasizxRV5SDMC3b0QdXEt4Qb9w5M7IOXF

amsXXF5YJob85kJiKycR0tzTvvstknjiQGmLizhJEp5VsauQJtyOsIsc9c566puGexLD

ihvtkIsFQ4C3PHq2DPc4+fU1NwxHioDVJ4uIc0v6PPPFqACs4DPji/5aJFTQgsUJMupH

AtpgsHeJsDyyatI4fdaQKi9ffwWDAf1duky4BbCeBYR0pCLl84KtQhQf8IfpI/LIXHoc

cFtY4psQPMOND9745pdH0mmTN8pCoRaQtghdegdYsbTPEc1uZpnEcYKf23+ii+0S9dRW

h4fA==

X-Gm-Message-State: AOJu0YzS3CODuxDpVM1aiSjpbwxH3fXpW5rxkKMbmAjPTnE+3dHne31J

G1BXV2EGbwK3c9awZ6bfO4IIdjO20ncvRkrs3TZglvh/I8aSbP25iwq5AeqCrQ0dQKJUHCT2cnR

I3MC2BHLYxwAuPO35Sl8ksJ+twH3uDR/TuqTQSOppLZAkIbIH93273M4P

MIME-Version: 1.0

X-Received: by 2002:a05:6820:82a:b0:69d:e2fc:3631 with SMTP id

006d021491bc7-69e68b08df4mr1593968eaf.10.1780654012495; Fri, 05 Jun 2026

03:06:52 -0700 (PDT)

Reply-To: Alcorama Yusufu

Sender: Google Calendar

Message-ID:

Date: Fri, 05 Jun 2026 10:06:52 +0000

Subject: Invitation: Account Activity Information Has Been Updated @ Fri Jun

5, 2026 7:06pm (GMT-4) (doctor@nl2k.ab.ca)

From: Alcorama Yusufu

To: doctor@nl2k.ab.ca

Content-Type: multipart/mixed; boundary="000000000000e1fdbe06537ed156"

X-Spam_score: 8.7

X-Spam_score_int: 87

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Account Activity Information Has Been Updated Friday Jun 5,

2026 â‹… 7:06pm Eastern Time - New York DOCUMENT REF #RHFSSEMN1JNWWJ Norton

360 • Friday, 05 June 2026 18:06:39 Support Contact: 1-808- 721-3196



Content analysis details: (8.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.210.70 listed in dnsbl.ahbl.org]

[209.85.210.70 listed in dnsbl.ahbl.org]

[209.85.210.70 listed in dnsbl.ahbl.org]

[209.85.210.70 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.210.70 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.210.70 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.210.70 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.210.70 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.210.70 listed in will-spam-for-food.eu.org]

[209.85.210.70 listed in will-spam-for-food.eu.org]

[209.85.210.70 listed in will-spam-for-food.eu.org]

[209.85.210.70 listed in will-spam-for-food.eu.org]

[209.85.210.70 listed in will-spam-for-food.eu.org]

[209.85.210.70 listed in will-spam-for-food.eu.org]

[209.85.210.70 listed in will-spam-for-food.eu.org]

[209.85.210.70 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.210.70 listed in list.dnswl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

0.6 MEGALONGWORD BODY: Uses really overlong words

0.3 LONGWORD BODY: Uses overlong words

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.210.70 listed in bl.score.senderscore.com]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.210.70 listed in wl.mailspike.net]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

1.5 TVD_PH_BODY_ACCOUNTS_PRE The body matches phrases such as "accounts

suspended", "account credited", "account

verification"

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.0 TVD_PH_SUBJ_META1 Email has a Phishy looking subject line

3.0 LONG_INVISIBLE_TEXT Long block of hidden text - bayes poison?

Subject: {SPAM?} Invitation: Account Activity Information Has Been Updated @ Fri Jun

5, 2026 7:06pm (GMT-4) (doctor@nl2k.ab.ca)

Norton 360 Phish from Google Gmail Part 2



Alcorama Yusufu has invited you to Account Activity Information Has Been Updated

Title: Account Activity Information Has Been Updated

When: Friday, June 5, 2026 at 17:06

Organizer:

Alcorama Yusufu

Description:



DOCUMENT REF #RHFSSEMN1JNWWJ



Norton 360 • Friday, 05 June 2026 18:06:39



Support Contact: 1-808- 721-3196





Good day,







We are providing this document as part of our regular account information and recordkeeping process.





DOCUMENT DETAILS





Category Amount

Digital Records Center - One Year Plan $344.34 USD





























Document Total: $344.34 USD



Security Identifier: 3863b99d-c9c3-4d79-a5c8-5b6ed66c7d11







For additional information, contact 1(808) 748-1467.







Best regards,



Accounts Manager: Terrell Shook



Norton LifeLock Service

Attendees:



doctor@nl2k.ab.ca



Account Activity Information Has Been Updated

DOCUMENT REF #RHFSSEMN1JNWWJ Norton 360 • Friday, 05 June 2026 18:06:39 Support Contact: 1-808- 721-3196 Good day, We are providing this document as part of our regular account information and reco





DOCUMENT REF #RHFSSEMN1JNWWJ



Norton 360 • Friday, 05 June 2026 18:06:39



Support Contact: 1-808- 721-3196



Good day,





We are providing this document as part of our regular account information and recordkeeping process.



DOCUMENT DETAILS











Category

Amount



Digital Records Center - One Year Plan

$344.34 USD









Document Total: $344.34 USD



Security Identifier: 3863b99d-c9c3-4d79-a5c8-5b6ed66c7d11





For additional information, contact 1(808) 748-1467.







Best regards,



Accounts Manager: Terrell Shook



Norton LifeLock Service

When

Friday Jun 5, 2026 ⋅ 7:06pm (Eastern Time - New York)

Organizer

Alcorama Yusufu

alcoramayusufu@cyverau.com

Guests

(Guest list has been hidden at organizer's request)

Reply for doctor@nl2k.ab.ca

Yes



No



Maybe

More options



Invitation from Google Calendar



You are receiving this email because you are an attendee on the event.



Forwarding this invitation could allow any recipient to send a response to the organizer, be added to the guest list, invite others regardless of their own invitation status, or modify your RSVP. Learn more

Norton 360 Phish from Google Gmail Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 05 Jun 2026 07:10:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wVUIY-00000000EPT-2a6D

for dave@doctor.nl2k.ab.ca;

Fri, 05 Jun 2026 07:09:18 -0600

Resent-From: The Doctor

Resent-Date: Fri, 5 Jun 2026 07:09:18 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ot1-f70.google.com ([209.85.210.70]:57795)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wVRSr-00000000GiK-10wt

for doctor@nl2k.ab.ca;

Fri, 05 Jun 2026 04:07:55 -0600

Received: by mail-ot1-f70.google.com with SMTP id 46e09a7af769-7e704fa3f07so1707605a34.3

for ; Fri, 05 Jun 2026 03:06:58 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=google.com; s=20251104; t=1780654012; x=1781258812; darn=nl2k.ab.ca;

h=to:from:subject:date:message-id:sender:reply-to:mime-version:from

:to:cc:subject:date:message-id:reply-to;

bh=1CU6PkMtgI47wNPo7VSUh0aiIYA9/4+CsxEddBBCIw4=;

b=RQDKPjJ7okSonfeaUGFLwRRqhklAUjj2a8fFMjz+St0vty+y05Amp4ca3eludVejJm

O4R2uRm8F9WPHOXGqzWcgj3Kqi41esQde5NYXfBr42Tuu+utoe4BFQwMY3bElDhipZx0

jZXH2VIwRI2ySmerjb2RqKNm9r8ihwNEhXL2vfz8tOge+AVwLz4H8Mp06QzwLLCOVMz8

wbOV8LqytNdZ2EFrPJU7Zii1CtvM/fim2sqbmuDzcMKUkWfmzq3KGhih8e3nQOIe+OQC

K5Ie4mDjRjwK/nBfC17sJl0QINbh24sMR4zbm+OF6zV6EGsZvQg9ajA4kYd6CYqNN6Ns

S7jg==

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=cyverau-com.20251104.gappssmtp.com; s=20251104; t=1780654012; x=1781258812; darn=nl2k.ab.ca;

h=to:from:subject:date:message-id:sender:reply-to:mime-version:from

:to:cc:subject:date:message-id:reply-to;

bh=1CU6PkMtgI47wNPo7VSUh0aiIYA9/4+CsxEddBBCIw4=;

b=Pb+OrPiMq8MqC0UAyFyacC/OUmxIFN4qLIY1Xu1FXCCpCvK2PhdYw5Vaq+zVwZUnYi

ihOeOaogSmgtRkeAW5WdPDY2Vt2lea3ML6+YfPDUp16EQND/0+yrBVTCAdzet2JmbXTy

i2dpNBbRJ1H+UFiiOGxWaSjzMzkF53nd3Yr3IMAUs6uH60ka3l9PLJYfjry75EKp0iTw

9qlrETOoJlUJF8jHQ1u42PP0WY6fBKVkES7E251Y5Q4FUBVYyL8PMX1lq2eEBIpdh0VD

yNmDtQnpB6OXGhxekPmOywIFOrElzqeeRI3CD/mHLSmngl5yWfrYLs4FA7TMqRoRocSW

00sQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1780654012; x=1781258812;

h=to:from:subject:date:message-id:sender:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=1CU6PkMtgI47wNPo7VSUh0aiIYA9/4+CsxEddBBCIw4=;

b=MhBKboebDbPifHnTphFhjDHwmLBdLsLFcqasizxRV5SDMC3b0QdXEt4Qb9w5M7IOXF

amsXXF5YJob85kJiKycR0tzTvvstknjiQGmLizhJEp5VsauQJtyOsIsc9c566puGexLD

ihvtkIsFQ4C3PHq2DPc4+fU1NwxHioDVJ4uIc0v6PPPFqACs4DPji/5aJFTQgsUJMupH

AtpgsHeJsDyyatI4fdaQKi9ffwWDAf1duky4BbCeBYR0pCLl84KtQhQf8IfpI/LIXHoc

cFtY4psQPMOND9745pdH0mmTN8pCoRaQtghdegdYsbTPEc1uZpnEcYKf23+ii+0S9dRW

h4fA==

X-Gm-Message-State: AOJu0YzS3CODuxDpVM1aiSjpbwxH3fXpW5rxkKMbmAjPTnE+3dHne31J

G1BXV2EGbwK3c9awZ6bfO4IIdjO20ncvRkrs3TZglvh/I8aSbP25iwq5AeqCrQ0dQKJUHCT2cnR

I3MC2BHLYxwAuPO35Sl8ksJ+twH3uDR/TuqTQSOppLZAkIbIH93273M4P

MIME-Version: 1.0

X-Received: by 2002:a05:6820:82a:b0:69d:e2fc:3631 with SMTP id

006d021491bc7-69e68b08df4mr1593968eaf.10.1780654012495; Fri, 05 Jun 2026

03:06:52 -0700 (PDT)

Reply-To: Alcorama Yusufu

Sender: Google Calendar

Message-ID:

Date: Fri, 05 Jun 2026 10:06:52 +0000

Subject: Invitation: Account Activity Information Has Been Updated @ Fri Jun

5, 2026 7:06pm (GMT-4) (doctor@nl2k.ab.ca)

From: Alcorama Yusufu

To: doctor@nl2k.ab.ca

Content-Type: multipart/mixed; boundary="000000000000e1fdbe06537ed156"

X-Spam_score: 8.7

X-Spam_score_int: 87

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Account Activity Information Has Been Updated Friday Jun 5,

2026 â‹… 7:06pm Eastern Time - New York DOCUMENT REF #RHFSSEMN1JNWWJ Norton

360 • Friday, 05 June 2026 18:06:39 Support Contact: 1-808- 721-3196



Content analysis details: (8.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.210.70 listed in dnsbl.ahbl.org]

[209.85.210.70 listed in dnsbl.ahbl.org]

[209.85.210.70 listed in dnsbl.ahbl.org]

[209.85.210.70 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.210.70 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.210.70 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.210.70 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.210.70 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.210.70 listed in will-spam-for-food.eu.org]

[209.85.210.70 listed in will-spam-for-food.eu.org]

[209.85.210.70 listed in will-spam-for-food.eu.org]

[209.85.210.70 listed in will-spam-for-food.eu.org]

[209.85.210.70 listed in will-spam-for-food.eu.org]

[209.85.210.70 listed in will-spam-for-food.eu.org]

[209.85.210.70 listed in will-spam-for-food.eu.org]

[209.85.210.70 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.210.70 listed in list.dnswl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

0.6 MEGALONGWORD BODY: Uses really overlong words

0.3 LONGWORD BODY: Uses overlong words

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.210.70 listed in bl.score.senderscore.com]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.210.70 listed in wl.mailspike.net]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

1.5 TVD_PH_BODY_ACCOUNTS_PRE The body matches phrases such as "accounts

suspended", "account credited", "account

verification"

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.0 TVD_PH_SUBJ_META1 Email has a Phishy looking subject line

3.0 LONG_INVISIBLE_TEXT Long block of hidden text - bayes poison?

Subject: {SPAM?} Invitation: Account Activity Information Has Been Updated @ Fri Jun

5, 2026 7:06pm (GMT-4) (doctor@nl2k.ab.ca)

Norton 360 Phish from Google Gmail Part 2

Alcorama Yusufu has invited you to Account Activity Information Has Been Updated



Account Activity Information Has Been Updated

DOCUMENT REF #RHFSSEMN1JNWWJ Norton 360 • Friday, 05 June 2026 18:06:39 Support Contact: 1-808- 721-3196 Good day, We are providing this document as part of our regular account information and reco





DOCUMENT REF #RHFSSEMN1JNWWJ



Norton 360 • Friday, 05 June 2026 18:06:39



Support Contact: 1-808- 721-3196



Good day,





We are providing this document as part of our regular account information and recordkeeping process.



DOCUMENT DETAILS











Category

Amount



Digital Records Center - One Year Plan

$344.34 USD









Document Total: $344.34 USD



Security Identifier: 3863b99d-c9c3-4d79-a5c8-5b6ed66c7d11





For additional information, contact 1(808) 748-1467.







Best regards,



Accounts Manager: Terrell Shook



Norton LifeLock Service

When

Friday Jun 5, 2026 ⋅ 7:06pm (Eastern Time - New York)

Organizer

Alcorama Yusufu

alcoramayusufu@cyverau.com

Guests

(Guest list has been hidden at organizer's request)

Reply for doctor@nl2k.ab.ca

Yes



No



Maybe

More options



Invitation from Google Calendar



You are receiving this email because you are an attendee on the event.



Forwarding this invitation could allow any recipient to send a response to the organizer, be added to the guest list, invite others regardless of their own invitation status, or modify your RSVP. Learn more

Norton 360 Phish from Google Gmail Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 05 Jun 2026 07:10:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wVUIh-00000000EQD-1sri

for dave@doctor.nl2k.ab.ca;

Fri, 05 Jun 2026 07:09:27 -0600

Resent-From: The Doctor

Resent-Date: Fri, 5 Jun 2026 07:09:27 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-oo1-f69.google.com ([209.85.161.69]:57598)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wVRT0-00000000Giy-0low

for doctor@nl2k.ab.ca;

Fri, 05 Jun 2026 04:08:03 -0600

Received: by mail-oo1-f69.google.com with SMTP id 006d021491bc7-69dc70d4b0aso2991016eaf.2

for ; Fri, 05 Jun 2026 03:07:08 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=google.com; s=20251104; t=1780654022; x=1781258822; darn=nl2k.ab.ca;

h=to:from:subject:date:message-id:sender:reply-to:mime-version:from

:to:cc:subject:date:message-id:reply-to;

bh=1CU6PkMtgI47wNPo7VSUh0aiIYA9/4+CsxEddBBCIw4=;

b=kJ3qVR9uAY9w2NlIBkP3yInDSv+Su3IaFE6d2tHMdWkpGJCKEABBz4K1cqBmY2LaDS

+AA0u/dxplUYJe4l6/U/81dGKdlV/ySHKYHqtuHAeLjs630Wxdm6BT6ca7N0oe+DLKcy

hE6r9kNl00Cb7bbYBwRRozIYZFZ3AwUKUFkur+XQXOEX0lTfNJCLJsDj5QTvBG9m+WAV

jumDeoKX+YKspOvczYI8+rpXYETQmWxrR8lb+jvMlldWR+Mi7nbacV3DY4npcLMeUrjW

OfwWypi06ZBU09b/C7rRwWcS09cQsaTcC0VFBL3iQbWQnqs040u4jsINCdGe5h35WhO6

Jr+A==

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=cyverau-com.20251104.gappssmtp.com; s=20251104; t=1780654022; x=1781258822; darn=nl2k.ab.ca;

h=to:from:subject:date:message-id:sender:reply-to:mime-version:from

:to:cc:subject:date:message-id:reply-to;

bh=1CU6PkMtgI47wNPo7VSUh0aiIYA9/4+CsxEddBBCIw4=;

b=KKsw8U3Ak9fIkWa5yp7rwlforurACH8aab8Mf6mSNbwixVh4smvngFv8AuY3VpZzDD

GsPtjyw2C8yaf0ELLVD7/kGIzQmvNh8jYq3LnKj92KDa4FeGp0NPgd/AJZrAzasCV5YZ

0XHUZqZkx+RseJm8f+VLJvkfG8PxP+dELYU+oojv3sjv7//gqqZGs2LEmk84hzQw942w

X2Gj28vLTPlvp3ayzuMWpLDo6wdBp8yRKvh6D/3I7WU9KpzdntCikVEVho7muckSX8E2

+Ttb+og8GwZBEgirv85B+6KoODWZhAi2EZ5gUFV10lZUqs7DeYBTgaItiPZRj7w0AML9

XaMw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1780654022; x=1781258822;

h=to:from:subject:date:message-id:sender:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=1CU6PkMtgI47wNPo7VSUh0aiIYA9/4+CsxEddBBCIw4=;

b=G356RVJJpcXJGISpYEu+ORCOqapF5IzvF2kl1p5LvBUZkAezBmaeBLmz4dJ2V2vxkj

m+iAjvZFWiZu0GXuEfjvDA0WpFScebhkL8cUMCAUWZx7x3yWiQh3CFLs+pPmMzbvL3OH

6ct+VzGyt4bURgg/xHdKQqwasrHvJyRFHgmqUljWbMsnfgFajSdpQlkMCGOvtVULxSm9

q3MAYlLbPIxFpUx8BzHeQeMkdvopABP/S7/myU5keRUE/PKIQf2e2TCZAFvqlsJ5vaTN

G6RzB28i0Jgj1qaFFwEdAqZqpQ6iLqXVjUD5qIq8/W0As1yTG1XFcBasfmDuMSJrP4vH

A3fQ==

X-Gm-Message-State: AOJu0YyDnoqfCp6lZR6fqiNB1syCKJLivkGPbgvhVwcB9DXbIdGXXDFn

IEiMZM5kposq8oTyZ/cCj7/nSTSRUpxyuv8WtOOkgFsDBaQIuRr3uYQk28UyyjWK1MKdZiVvV3F

2M5rYGAAfphnGsRyvb+4kPz9VUtnQ3jOlOlfM7Q2yz0C6M5udNGtib4tH

MIME-Version: 1.0

X-Received: by 2002:a05:6820:82a:b0:69d:e2fc:3631 with SMTP id

006d021491bc7-69e68b08df4mr1593968eaf.10.1780654012495; Fri, 05 Jun 2026

03:06:52 -0700 (PDT)

Reply-To: Alcorama Yusufu

Sender: Google Calendar

Message-ID:

Date: Fri, 05 Jun 2026 10:06:52 +0000

Subject: Invitation: Account Activity Information Has Been Updated @ Fri Jun

5, 2026 7:06pm (GMT-4) (doctor@nl2k.ab.ca)

From: Alcorama Yusufu

To: doctor@nl2k.ab.ca

Content-Type: multipart/mixed; boundary="000000000000e1fdbe06537ed156"

X-Spam_score: 8.7

X-Spam_score_int: 87

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Account Activity Information Has Been Updated Friday Jun 5,

2026 â‹… 7:06pm Eastern Time - New York DOCUMENT REF #RHFSSEMN1JNWWJ Norton

360 • Friday, 05 June 2026 18:06:39 Support Contact: 1-808- 721-3196



Content analysis details: (8.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.161.69 listed in dnsbl.ahbl.org]

[209.85.161.69 listed in dnsbl.ahbl.org]

[209.85.161.69 listed in dnsbl.ahbl.org]

[209.85.161.69 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.161.69 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.161.69 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.161.69 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.161.69 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.161.69 listed in will-spam-for-food.eu.org]

[209.85.161.69 listed in will-spam-for-food.eu.org]

[209.85.161.69 listed in will-spam-for-food.eu.org]

[209.85.161.69 listed in will-spam-for-food.eu.org]

[209.85.161.69 listed in will-spam-for-food.eu.org]

[209.85.161.69 listed in will-spam-for-food.eu.org]

[209.85.161.69 listed in will-spam-for-food.eu.org]

[209.85.161.69 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.161.69 listed in list.dnswl.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.6 MEGALONGWORD BODY: Uses really overlong words

0.3 LONGWORD BODY: Uses overlong words

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.161.69 listed in bl.score.senderscore.com]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.161.69 listed in wl.mailspike.net]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.0 TVD_PH_SUBJ_META1 Email has a Phishy looking subject line

1.5 TVD_PH_BODY_ACCOUNTS_PRE The body matches phrases such as "accounts

suspended", "account credited", "account

verification"

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

3.0 LONG_INVISIBLE_TEXT Long block of hidden text - bayes poison?

Subject: {SPAM?} Invitation: Account Activity Information Has Been Updated @ Fri Jun

5, 2026 7:06pm (GMT-4) (doctor@nl2k.ab.ca)

Aeroplan phish from Sendgrid Part 1




r:#333333;">

Expiry Date: June 5, 2026








t:1.8;">

To keep your points active, simply complete an =

eligible Aeroplan activity before the expiry date, such as:












/click?upn=3Du001.IrujB1yoCwvlYIVfFuPD2b2D75HYEblTiivH7PL-2Fx-2F4-3DhUeV_Ym=

NPztx4miJCrnDYqcF7jfR8yISc1B2YMcURCB95RzH7v-2FAlqusd9Q2l6rZumiG-2BKDbmL6ETK=

FvupUGdMmnHpZ8xnfswBgDv56ULRc6Ej7kJm-2BGqZQL6DqzqUNPNV7238ktb63re1Vuvzgscbm=

jh6A-2BTPNpLHCRz4taCfSCnepNaASThVhNyWW7Te-2FWnIk8IbouOVHWIE-2BLPhNMQOrtmOhF=

HLKclbPbf4Sycgo3-2F2a-2F1vk31qyw51239bzHtbNVO-2F1QmnUHPhs1aQmui3p4VM1EEQr4t=

D4Xt-2BBaMP1fevvhJq9VG-2BGWD5Hi1oRGAa4oMAK5yFraWMh8Tr2OmO36COSsmMj54aU51CD-=

2F5CvnncpWubKIbMwpOu2OwSoOhCx9aNK8ewFp4yeL-2FGCiPtJG54J-2BWLlTTfX7RJX-2BQGj=

qfi7QUv7hi-2BVdqJwixLXRsMxbvisqzIJD46DW2qmOOP-2FuJ-2BVrMwxCkjubFZ5ebd9-2F-2=

BfbGiVzOOzAvUzom4YcA96ftfjt2V2z3xDesCJuhLTcYS9uUp0Zj8rrtyxRMWfMglZUGLOcervb=

4-2Fyq-2FyvhK-2Bm5Hi39LmRMzNi1ExqhD-2Fu818DBaq9-2FRIGZHs5ylW3kLqN-2FHrA1B8b=

cZTgAicQgSgD8wXAwNNO9tuJ2Djv1BbLE7TNUVM6Fho-2BllmkYIoNi6c-2BuezXqirZBbI6198=

0Ie645FLsSsfdzoCbCtKWH2CJ6uuiEviUxnbnefIxdYh1SI9FKafuROQAXf67iEEKey-2FQIaWh=

ZPq2UlPfZ0PL-2F689MjLZYjXXQYL9JiF4jnSfdsE8oFggA239C6lZXH-2B5kRHtokSGB-2Btrx=

RD96f4bAL0gExPtZkZoxioghCelBplN7G1fpA-3D"

style=3D"background:#d71920;

color:#ffffff;

text-decoration:none;

padding:15px 40px;

border-radius:4px;

font-size:16px;

font-weight:bold;

display:inline-block;">

View My Aeroplan Account








t:1.8;">

Log in to your Aeroplan account today to review=

your balance and take action before your points expire.






t:1.8;">

Thank you for choosing Air Canada and Aeroplan.







Sincerely,


The Aeroplan Team
















:center;">


>

Aeroplan=AE Loyalty Program






aaaaa;">

This is an automated message. Please do not rep=

ly directly to this email.






aaaaa;">

=A9 2026 Air Canada. All rights reserved.






















GZYDmBykh8zSgppscrG1a9-2FbnUZspF0av6mdLTg7APu65Yl-2FlT7gYWIWvlofAwKkY-2F2pt=

fbkc7w8h-2FPFa6xEfU55tVw9pxqAkjKcoCM5xYrUadMDhNOM92fWIv17g9YhozDkR7CnSOMJ0r=

nZ5hQ1GgZoVocaDQ0uA-2F5dQBLGzxrjAlIVUROgpZAfjCJeKxRlzSRzgWYmJ-2F4xU2e-2F2XL=

0cCOM0zNEQUZt2WxsmXWLhdG4cecVps9UEFcpp9oFfFXNtvrOOB36-2F2hVVGxxH6DfyI7eFTnh=

g-2B6-2FATbyq0SGV-2BKazk9TY5xzpshobs-2BsrWYKsraFZ5cIpo5v4Um0thU9JiFOPrNQTxO=

LbI86QpNgQRGWNrHW6dyHzU-2Bvx-2BVd7a4G1vJJRLL9x3XxpISXW32HrxUlaLPPvsfpn0Q-2B=

Zdbr-2FwS-2Ba-2BvX3nVbQFyugBDeNI-2BL0FZs2jTYA86l6tx2os9VIRzNNf-2BqnX6o-2Bu5=

yg59VcsDvs3ijT9Q0Z2LHyzuqYOKJl59bPfThIIG-2FK4SmCmOyGBhnbEcPxgGSp0gWzM9FqdPd=

Ud2QYNubN-2BKztsbLU57DPPqzlBlW-2FcIKPQbG9azhyyNFXM9mqQl6HcLayPlGhZ-2BRj9Qhm=

e5NxAc-2BPJe2kdOvAMYPZd2By-2BOMsRHaL15SEWCqkGgC2h1h9cMPyxqmPxKzV16Yhhk6Yu4Y=

10-2BnRLNF6LX5anAZOquEWUI8mcz00Djjvqj-2FyNiZN4Whod3Q7rSFZb5DXMpgkCi7Qjj1tGx=

GisOd5Ef-2FbwkTz-2F9BS7GG9TLAqzyXGApff8mAzhmQzVIEa7zOsVeWc1w8LtAlyKBxgy-2Bn=

n4udzrrRFA2EquzLYDJ1J0-2FqHtx0c-3D" alt=3D"" width=3D"1" height=3D"1" borde=

r=3D"0" style=3D"height:1px !important;width:1px !important;border-width:0 =

!important;margin-top:0 !important;margin-bottom:0 !important;margin-right:=

0 !important;margin-left:0 !important;padding-top:0 !important;padding-bott=

om:0 !important;padding-right:0 !important;padding-left:0 !important;"/>
ody>



--8dace98af8dc3247defdd50653b565544fe5d2563ed636b11827e20f1c9c--