NetKnow Corporate Blog

Blank spam from Google Gmail

Posted by Dave Yadallee on Saturday, January 31. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 30 Jan 2026 18:21:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vlzeu-000000003dd-2jOo

for dave@doctor.nl2k.ab.ca;

Fri, 30 Jan 2026 18:20:20 -0700

Resent-From: The Doctor

Resent-Date: Fri, 30 Jan 2026 18:20:20 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pj1-f42.google.com ([209.85.216.42]:55543)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vlyRp-00000000JHG-3w0n

for root@nl2k.ab.ca;

Fri, 30 Jan 2026 17:02:55 -0700

Received: by mail-pj1-f42.google.com with SMTP id 98e67ed59e1d1-3530715386cso1791540a91.2

for ; Fri, 30 Jan 2026 16:01:58 -0800 (PST)

ARC-Seal: i=1; a=rsa-sha256; t=1769817712; cv=none;

d=google.com; s=arc-20240605;

b=QsZ/EwENFbuTpN8U3Xrj+2+234rN3o4LwScfZqL80vnxqSLJiqCXs7khy21ixXoErZ

2h0/a8h0B7CjCZIyUL8VCpU+XstTSYuO9xgMkUaYwh6iQ2eqIZI5Lob/Lu+rq6CtO8pZ

9OzQRgrHCn+rLxB9C/MsTudOJiHcZWHW9M5VHNiiJ6IDJ1FjNXKVtyyVjJ/vuwmsIQak

oOdChN3udSBog2g29bK8L6Pm3JOG+87bktFPzf4sUmj+3OjcYOs0OHEnI6X2p7QUdOFI

j8d7tM2qYp83K/x5N/ZCy66wfOV07SG44nf11GBiMau9z1sWjlUDTuzD0wjwXqX92Slj

VSuw==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;

h=to:subject:message-id:date:mime-version:from:dkim-signature;

bh=k8etg7NZxSAsyLQ7l/6nW4n2MEPnPzNtGxN8qV+gBRY=;

fh=xlaqb4BBoLdJtBZev3L7vUQ7NrRWtYUi797wkNVG1OA=;

b=FOtbMVwFVWeUVF2bUdgKSi7ZulE2m7Ng3x62q2xTi0UbIwpg4aCrYoxElxtUcWh7Er

ulpX3WMqIziu7b9KqIgwkHjP9dZrqkYDRjChD5YV4FJrFP7w6F2to5mhqeULVXqD9eF8

9SpUk6n9V/2CNcWfxdBJ+lzB+VxdiqfvM91qlj5lcXm5fpUHMHUHBOjskADl/n+H9v36

ISZmwlPnUDHvbX70RClzh/areSbzSqlgYFp05pNJd97kRBAX+yZ25irMK9/CZ4uLYOpw

qbbtNDE3wXM8Y5eJMd8K7Vg2halvYQgvOjZ7tYIz6LUTaRW6J5JwdQBoATg9VnWNJXCn

EoDw==;

darn=nl2k.ab.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=algohatch-com.20230601.gappssmtp.com; s=20230601; t=1769817712; x=1770422512; darn=nl2k.ab.ca;

h=to:subject:message-id:date:mime-version:from:from:to:cc:subject

:date:message-id:reply-to;

bh=k8etg7NZxSAsyLQ7l/6nW4n2MEPnPzNtGxN8qV+gBRY=;

b=ZmZba7UtW/ZZn+l8dH+96KMjbqRkevHy8hnh1QTV7IoVuPCJ9h8bU0LC10BrzSpk+3

3BftvF2Vf97wiRB+FXhmHl+3wXwu4P6SaOVPIXLSP3p4xQF1lBtakqU4JSMSH9FKoo03

7q+/ZuJeGu2X9ZH5Kq1j/6H+fjj+327qCOlnvcs8Nea3fGF513R8IncNVbplJ8taLRuC

QQuh33klOhkxEFooxMQpugez5tify94famSdbrOu1tUT79EEtEFTylwtFFqOIHzVI2pG

Ppr64qA8MQfOZ7/SORdDOqG7rtDhFcAqLCbjSx8zI/VJH7vZcwewc8rTYu/FD/jUhCRI

nqFQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1769817712; x=1770422512;

h=to:subject:message-id:date:mime-version:from:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=k8etg7NZxSAsyLQ7l/6nW4n2MEPnPzNtGxN8qV+gBRY=;

b=c0fKfaiumZkDjtIKQq5R8JNSy6ZikGKX7vB2MV6ioEd1wnmsY9ssJ7VLCWCH9fcywt

+ZHLNCbI0gKAoBN5qIrRt3tVrWDEirMq4+KW0Q0tq8uj7OSEd+/z2CpbKWjQZNpWJ/CY

TgzRChhkL1F+vF6qjsIAbsFNHa4L5ZMpCTP+8Xp3oYo8K48YgP1xUyjdpagcd1gL5p86

vGJUPyz6Y7bTBWHozTkoSwukj/hI4HSPG8oId5zW2z6+SfeOQcdcLdTqZoKOwDLaXOvR

C7VwV3SM5t0UM5JtpOTGgWCjku4S/SF8tpeQsjQDuAvR9n8XRdoMvHro3D52+IfhFsz2

DE6w==

X-Gm-Message-State: AOJu0Ywma2kEd3bzbWsS+OemTmmjw1/GHH9x/WJwfOQ6jfZ5nYgDJEmN

GX5QaHQk6R8PFeYKUYt9Es2qeKFKwDQvNLyT7SaDoq54Jo9KSL0TZNtGynSHt9waBOlLTenpVD9

gTHVvYnziubAsrY4Wqwb7Pw9vzcHredmHwHgcfZm23NLejXzk9uUFEg==

X-Gm-Gg: AZuq6aJzz3J2gEpyUqqZdsnYT9DU7tgHqzh7MOX0VqNwRks75ZUmy07DFF2ltA1we8Z

4jH1qFV33YbZrArdUIsTOGCgyPiGE1TgX3Yv5Do6l4+7WftsSWW/2m62SLZgod9OSwfaZztNYyM

Ujj4Te1tZyztq7a+toh+UZvGcKTpAKi3vEVvrHXGThqp5AtCFhizWaJcw8p6zfeOyjgGQ8gaIZq

FLKK9TGBKMgIkFiJk4YYvzzjOQxOP01mclC5etujL53/LNWH57xYhA0ads/STsbWAjzr9e0qA==

X-Received: by 2002:a17:90a:fc4f:b0:32e:a5ae:d00 with SMTP id

98e67ed59e1d1-3543b30827emr4724003a91.13.1769817711818; Fri, 30 Jan 2026

16:01:51 -0800 (PST)

Received: from 132669333290 named unknown by gmailapi.google.com with

HTTPREST; Fri, 30 Jan 2026 16:01:50 -0800

Received: from 132669333290 named unknown by gmailapi.google.com with

HTTPREST; Fri, 30 Jan 2026 16:01:50 -0800

From: Funnelbotai

MIME-Version: 1.0

Date: Fri, 30 Jan 2026 16:01:50 -0800

X-Gm-Features: AZwV_QhBtMeRubFtHRGciT1oeuvmuNfRHGMQgflGd7rbXiwdnAA8SA1XiVZu0yA

Message-ID:

Subject: 3526229540

To: root@nl2k.ab.ca

Content-Type: multipart/alternative; boundary="00000000000007c35c0649a3cc1e"

X-Spam_score: 5.0

X-Spam_score_int: 50

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: 3526229540 3526229540

Content analysis details: (5.0 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.216.42 listed in will-spam-for-food.eu.org]

[209.85.216.42 listed in will-spam-for-food.eu.org]

[209.85.216.42 listed in will-spam-for-food.eu.org]

[209.85.216.42 listed in will-spam-for-food.eu.org]

[209.85.216.42 listed in will-spam-for-food.eu.org]

[209.85.216.42 listed in will-spam-for-food.eu.org]

[209.85.216.42 listed in will-spam-for-food.eu.org]

[209.85.216.42 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.216.42 listed in dnsbl.ahbl.org]

[209.85.216.42 listed in dnsbl.ahbl.org]

[209.85.216.42 listed in dnsbl.ahbl.org]

[209.85.216.42 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.216.42 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.216.42 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.216.42 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.216.42 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.216.42 listed in list.dnswl.org]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.216.42 listed in wl.mailspike.net]

0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to

background

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 TVD_SPACE_RATIO No description available.

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

Subject: {SPAM?} 3526229540

--00000000000007c35c0649a3cc1e

Content-Type: text/plain; charset="UTF-8"

3526229540

--00000000000007c35c0649a3cc1e

Content-Type: text/html; charset="UTF-8"

3526229540

--00000000000007c35c0649a3cc1e--

Web/SEO/App Spam Part 1

Posted by Dave Yadallee on Saturday, January 31. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 30 Jan 2026 20:58:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vm26h-00000000M99-1E29

for dave@doctor.nl2k.ab.ca;

Fri, 30 Jan 2026 20:57:11 -0700

Resent-From: The Doctor

Resent-Date: Fri, 30 Jan 2026 20:57:11 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [119.252.152.100] (port=55242 helo=f4mail-152-100.rediffmail.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vm1UA-00000000HfE-3nWW

for sales@nk.ca;

Fri, 30 Jan 2026 20:17:30 -0700

Received: from f4mail-235-95.rediffmail.com (unknown [10.50.250.70])

by f4mail-152-100.rediffmail.com (Postfix) with ESMTP id B777F1D0FFD

for ; Sat, 31 Jan 2026 00:21:09 +0530 (IST)

X-REDIFF-Delivered-Remotely-To: sales@nk.ca

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rediffmail.com;

s=mail; t=1769767440;

bh=37zK//1sslrgdOqG68DBUWf8yunVD3R3CbL6isY3Wk8=;

h=MIME-Version:From:Date:Message-ID:Subject:To;

b=ZUc39CFcChdaNceAOAtIGhnnhX+MvL4xz4rtvj1sW4EiTj28COIyDX2wuWw5LVxJi

r5+OF9Y35YpDzMAkwcEcJ8IaXLiM5Dvp6bCgiHkQeshEH11WXqscIs+6a2NxIWfbyn

QxMV7l1oXBkc/wvZhZCVQfFgLuAUeIXN0krsOLEE=

Received: (qmail 4614 invoked by uid 510); 30 Jan 2026 10:04:00 -0000

x-m-msg: 046ff8f93a0a14e4ab1644d58c74dc5e; a6da7d6asas6dasd77; 5dad65ad5sd;

X-OUT-VDRT-SpamState: 0\LEGIT

X-OUT-VDRT-SpamScore: 0

X-OUT-VDRT-SpamCause: "gggruggvucftvghtrhhoucdtuddrgeefuddrtddtucetufdoteggodetrfdotffvucfrrhhofhhilhgvmecutffgfffkhffhnecuuegrihhlohhuthemuceftddtnecunecujfgurhepffggvffkjghsuffhtgesrgdtreertddtjeenucfhrhhomhepfdhshhifvghtrgcukhgrshihrghpfdcuoehshhifvghtrghkrghshigrphesrhgvughifhhfmhgrihhlrdgtohhmqeenucggtffrrghtthgvrhhnpeegkedvgfeuledtudduteduhedttdehveeiudfhhfduteeljefhteekteeggeejgeenucfkphepuddvvddrudeiuddrheefrdefkeenucevlhhushhtvghrufhiiigvpedtnecurfgrrhgrmhepmhgrihhlfhhrohhmpehshhifvghtrghkrghshigrphesrhgvughifhhfmhgrihhlrdgtohhmpdhnsggprhgtphhtthhopeehpdhmohguvgepshhmthhpohhuthdprhgtphhtthhopehmuhhkvghshhhshhgrrhhmrghrnhhfsehgmhgrihhlrdgtohhmpdhrtghpthhtohepjhgshigtkhesugihmhhonhdrtggrpdhrtghpthhtohepihhnfhhosehfrhgrshgvrhhrvghsthgruhhrrghnthdrtggrpdhrtghpthhtohepihhnfhhosegvrghsthgruhhsthhinhgrthhhlhgvthhitggtlhhusgdrtghomhdprhgtphhtthhopegrsghlrggsvghlshdvsegrohhlrdgtohhm"

X-Dedup-Identifier: 1769767440_4613_4611_f4-235-95

Date: 30 Jan 2026 10:04:00 -0000

MIME-Version: 1.0

To: "mukeshsharmarnf "

Received: from unknown 122.161.53.38 by rediffmail.com via HTTP; 30 Jan 2026

10:04:00 -0000

Message-ID: <1769767405.S.12344.6537.f4mail-235-81.rediffmail.com.1769767440.4601@webmail.rediffmail.com>

In-Reply-To: <1769767370.S.11761.1246.f4mail-235-93.rediffmail.com.1769767405.6521@webmail.rediffmail.com>

Sender: shwetakasyap@rediffmail.com

Sensitivity:

Subject: =?utf-8?B?UmU6IFNjcmVlbnNob3Q=?=

From: "shweta kasyap"

Content-Type: multipart/alternative;

boundary="=_4ac79d69e6f22fdb5892f36474efb969"

X-Spam_score: 6.8

X-Spam_score_int: 68

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Good day!! I’d like to send your website ranking

performance report that shows you a few errors on your website.

Content analysis details: (6.8 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[119.252.152.100 listed in will-spam-for-food.eu.org]

[119.252.152.100 listed in will-spam-for-food.eu.org]

[119.252.152.100 listed in will-spam-for-food.eu.org]

[119.252.152.100 listed in will-spam-for-food.eu.org]

[119.252.152.100 listed in will-spam-for-food.eu.org]

[119.252.152.100 listed in will-spam-for-food.eu.org]

[119.252.152.100 listed in will-spam-for-food.eu.org]

[119.252.152.100 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[119.252.152.100 listed in dnsbl.ahbl.org]

[119.252.152.100 listed in dnsbl.ahbl.org]

[119.252.152.100 listed in dnsbl.ahbl.org]

[119.252.152.100 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[119.252.152.100 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[119.252.152.100 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[119.252.152.100 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[119.252.152.100 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[119.252.152.100 listed in sa-accredit.habeas.com]

0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The

query to Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[119.252.152.100 listed in sa-trusted.bondedsender.org]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[shwetakasyap(at)rediffmail.com]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[119.252.152.100 listed in bl.score.senderscore.com]

0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[119.252.152.100 listed in bl.score.senderscore.com]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

3.5 STYLE_GIBBERISH Nonsense in HTML

h:0px">
tyle=3D"font-style:normal">
pan style=3D"font-variant-caps:normal">
n style=3D"letter-spacing:normal">
text-transform:none">
px">
fff">
decoration-style:initial">
an style=3D"line-height:normal">
ans-serif"">
mily:Georgia, "serif"">“If ye=

s, May I send those errors?
e:10.5pt"> F=

ree of charge.”<=

/span>
>

h:0px">
tyle=3D"font-style:normal">
pan style=3D"font-variant-caps:normal">
n style=3D"letter-spacing:normal">
text-transform:none">
px">
fff">
decoration-style:initial">
an style=3D"line-height:normal">
ans-serif"">
y:Georgia, "serif"">Thanks,
pan><=

/span>

--=_4ac79d69e6f22fdb5892f36474efb969--

Categories: Spam and Phish

0 Comments

Project investment spam from Microsoft Outlook Part 2
Posted by Dave Yadallee on Friday, January 30. 2026

Content analysis details: (10.9 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[2603:10a6:10:618:0:0:0:5 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:618:0:0:0:5 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:618:0:0:0:5 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:618:0:0:0:5 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:618:0:0:0:5 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:618:0:0:0:5 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:618:0:0:0:5 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:618:0:0:0:5 listed in]

[will-spam-for-food.eu.org]

[52.103.35.79 listed in will-spam-for-food.eu.org]

[52.103.35.79 listed in will-spam-for-food.eu.org]

[52.103.35.79 listed in will-spam-for-food.eu.org]

[52.103.35.79 listed in will-spam-for-food.eu.org]

[52.103.35.79 listed in will-spam-for-food.eu.org]

[52.103.35.79 listed in will-spam-for-food.eu.org]

[52.103.35.79 listed in will-spam-for-food.eu.org]

[52.103.35.79 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[52.103.35.79 listed in dnsbl.ahbl.org]

[52.103.35.79 listed in dnsbl.ahbl.org]

[52.103.35.79 listed in dnsbl.ahbl.org]

[52.103.35.79 listed in dnsbl.ahbl.org]

[2603:10a6:10:618:0:0:0:5 listed in]

[dnsbl.ahbl.org]

[2603:10a6:10:618:0:0:0:5 listed in]

[dnsbl.ahbl.org]

[2603:10a6:10:618:0:0:0:5 listed in]

[dnsbl.ahbl.org]

[2603:10a6:10:618:0:0:0:5 listed in]

[dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[52.103.35.79 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[52.103.35.79 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[52.103.35.79 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[52.103.35.79 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[khalifmohammed41(at)outlook.com]

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[m.khalif2016(at)gmail.com]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

1.2 MISSING_HEADERS Missing To: header

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[khalifmohammed41(at)outlook.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[52.103.35.79 listed in wl.mailspike.net]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.4 MALFORMED_FREEMAIL Bad headers on message from free email service

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.9 REPLYTO_WITHOUT_TO_CC No description available.

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different

freemails

Subject: {SPAM?} Project funding/loan

--_000_DU4PR07MB11594A48C79112058B002DD9DD29FADU4PR07MB11594eu_

Content-Type: text/plain; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

Greetings,

Al Ghurair Investment is offering single digit interest loan for private an=

d corporate bodies, to finance their projects across the globe.

With our flexible security and an option of early repayment and/or conversi=

on into equity, our project financing is the best you can get. Our track re=

cords are there to speak volume.

Kindly submit your business plan to my official email addresses below, for =

consideration.

Mohammed Khalif

Foreign Loan Consultant

Email: m.khalif2016@gmail.com

m.khalif@al-ghurairinvestmentgroup.cc

--_000_DU4PR07MB11594A48C79112058B002DD9DD29FADU4PR07MB11594eu_

Content-Type: text/html; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

1">

Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=

s=3D"elementToProof">

Greetings,

Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=

s=3D"elementToProof">

Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=

s=3D"elementToProof">

Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=

s=3D"elementToProof">

Al Ghurair Investment is offering single digit interest loan for private an=

d corporate bodies, to finance their projects across the globe.

Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=

s=3D"elementToProof">

Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=

s=3D"elementToProof">

With our flexible security and an option of early repayment and/or conversi=

on into equity, our project financing is the best you can get. Our track re=

cords are there to speak volume.

Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=

s=3D"elementToProof">

Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=

s=3D"elementToProof">

Kindly submit your business plan to my official email addresses below, for =

consideration.

Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=

s=3D"elementToProof">

Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=

s=3D"elementToProof">

Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=

s=3D"elementToProof">

Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=

s=3D"elementToProof">

Mohammed Khalif

Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=

s=3D"elementToProof">

Foreign Loan Consultant

Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=

s=3D"elementToProof">

Email: m.khalif2016@gmail.com

Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=

s=3D"elementToProof">

m.khalif@al-ghurairinvestmentgroup.cc

Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=

s=3D"elementToProof">

Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=

s=3D"elementToProof">

Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">

--_000_DU4PR07MB11594A48C79112058B002DD9DD29FADU4PR07MB11594eu_--

Categories: Microsoft Outlook Hotmail Spam

0 Comments

Project investment spam from Microsoft Outlook Part 1
Posted by Dave Yadallee on Friday, January 30. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 30 Jan 2026 13:21:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vluyl-00000000KZS-2UWt

for dave@doctor.nl2k.ab.ca;

Fri, 30 Jan 2026 13:20:31 -0700

Resent-From: The Doctor

Resent-Date: Fri, 30 Jan 2026 13:20:31 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-swedencentralazolkn19013079.outbound.protection.outlook.com ([52.103.35.79]:20674 helo=GVXPR05CU001.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vltv4-00000000AMl-178S

for sales@nk.ca;

Fri, 30 Jan 2026 12:12:53 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=m+taud6X/9xNsdnNQ4q83oIs2qZLHhe1zEhZbqEmMZh5sgNeYvE7+tqe00QhrXR5qOCGIsQnk3TIaVb6ytcvtCfEL9JID9zcjulV72f1M9OVJ8H7/cjCNQatkabDYotlBcjV/87YFQjDIMGUwAblLMz4tzUOU2Mp7nQmdFZtJKGivyfkLOYTJdns5ZhjKhcV/2S459yI5KZeYHAtUbWBYSMH1612Em4veROysp+27MF8reTwOzagIZxSZEGTDL1EIXIj3IDOIQrBlrfICmyM+aseBDUb3JOGV6KCsC1gH/Z9ZE+DZJ74g798Ki1C2V2/MphrOOaUOStIKm6vXg1opg==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=vpN1Mv/h15mUdqfwFimbiJWIzAHNFvGSHXeRlUjP5fs=;

b=t+TRHqX/uylBWEfKx8A0qxMzdrDR4QR2X3Ue8LTHdfyU/DNx3KL05eOzwLRovCVZ8C5Uj1pizk/V4SSPvyKv4gzVO/2Jqt7e15n3hkoSBw4KgGd8bUqve4BgqiVOljKCG61L7yiCTpLEVKwS2yoB8vdFliuEjE0cW7LAvIsplcg8m6viUscGw5UGPOts3nWunMnZj+S7p0TPvyFn871vQSpDa4My85ITtJcvdubRlYmCxUXQVT7yJooNvSVa7Y9DC9WVeZAdP+Y5mJKAK+R+079Kx4VB7cmq+k2m5cbeq3yKKrlQpUAhru/gcYluXGjUZtlLxPMED/ybR4amqd7fQg==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=vpN1Mv/h15mUdqfwFimbiJWIzAHNFvGSHXeRlUjP5fs=;

b=TLh0vwPQbARxb+lnLs3XrlmL3qQwbn6JYmm4Z/C/Zn9afy/v5EQ18Pjds4as88c/yabbzMk0/QnJ/SiN5W+gt/dBA+GEEuLtrTA9+ztIEnbfpAkGp2p1K3hzmZUSLNQZ4GoUy1HmpkLM0IsxgVuSrj97g3SIYBpTihI1DFcJRadhdyn9UT8hBSi+iF9yKgiXuM10l5uv634ivMQLVp4SwzonediiXOU61P7rl+bEt/yRy/AHktDxYK1cewDQhL2Sef8267QFSFLvjEnu4x4nMHxaWvSAAckKVY6Li9ubUHR3DwH/VBnUpFsOD/4VoPYDVSBP6t4xkhk9EdJAp1y4/Q==

Received: from DU4PR07MB11594.eurprd07.prod.outlook.com (2603:10a6:10:618::5)

by GVXPR07MB9822.eurprd07.prod.outlook.com (2603:10a6:150:11a::14) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9564.11; Fri, 30 Jan

2026 19:11:36 +0000

Received: from DU4PR07MB11594.eurprd07.prod.outlook.com

([fe80::f552:3ff6:ee97:679b]) by DU4PR07MB11594.eurprd07.prod.outlook.com

([fe80::f552:3ff6:ee97:679b%6]) with mapi id 15.20.9564.010; Fri, 30 Jan 2026

19:11:36 +0000

From: Khalif Mohammed

Subject: Project funding/loan

Thread-Topic: Project funding/loan

Thread-Index: AQHckhxAkNJbo740T0O25JVdX5mGzA==

Date: Fri, 30 Jan 2026 19:11:36 +0000

Message-ID:

Reply-To: "m.khalif2016@gmail.com"

Accept-Language: en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

msip_labels:

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: DU4PR07MB11594:EE_|GVXPR07MB9822:EE_

x-ms-office365-filtering-correlation-id: a20c6a27-abb8-40eb-0053-08de60336383

x-ms-exchange-slblob-mailprops:

9IecXKUgicB5Y5xtj3Bi4po1AHQXatGhZQJ7VCU6lf2I0QCUPp3vR0WpW7B4Qk28w4QNO83tpPzs8Wl41CP1jcAz88cEGdK/fXWUiGquZqiDi+gU1OiV/LnwlM07nQ/S+9mCC6N74EjsTJZOFirmggtpHIrMiNxCd/Dl6qLwqtlhNV9KQD+P0uw0gKE36wsSIeTUwfQbMyjn4dzIFHx0O2LdsF+EYDAI7uertUpvSDIq9es5EFXABwpVce1z+9IDGi1wf49B87cBNbLJcPFIPjzRD83rRKWknw1iRuGn9s4a7kVri83MDPectSzaeS3lR/7td8S/iM7R7SpFmG4oVVt1G05Ev4MWGjBn1sp5YA6MxQafuUa3NwqLoG0eEgLBf6V3tlcUKn4qBYNDb2mLM3dtIdRD9jnodlrk7/WJSkcnwqMosr+FDfLT8kHCrCdg0tGiDjNdMydpb3mcWRv8sq4uPHXML2n2ru8bmEWxe+Y8QPeaVKkPYuk8gdBuBHvnLs+t/x8Jj99WjYfVT+yZamDcDGbIt0LkyNuevpzkaD/S6ShVu6+/YAE9bpVnwEh6jdzx1so047Cdl5ILQTy6UpC9zKlpsyKZVOHdyf36ks1TtYpNC0v8LA7y1mDQTBL3OYMGcJRSB97Xc6hINP0wtvFpbrSxq51e/hZfmxb/b/qQVPPlLcmcxmUr9vT7bgtiOV0VusyWNvMV067SuKwnH8u7UXEaR3SBuw8GlyNN37ZgRLN609zNMA==

x-microsoft-antispam:

BCL:0;ARA:14566002|5062599005|461199028|11091999009|31061999003|7071999006|12121999013|19110799012|6115599003|8060799015|8062599012|39105399006|20031999003|15030799006|15080799012|440099028|3412199025|41105399003|40105399003|39145399003|35041999009|102099032|56899033;

x-microsoft-antispam-message-info:

=?iso-8859-1?Q?ZTlL5AAR6T7U2UUbtPujeOYHFnT/0w2FX3R2ZILFThPK48SxhFbjeduW/f?=

=?iso-8859-1?Q?ATCz464R3EE5P+JUHuEcSwb5ngee+2+oVzj3vHphq5sTWzETg3FRNeYXe0?=

=?iso-8859-1?Q?vasSKikk8580qrWrS+6g5u6+nj979hliEufteUo/bgkEAY/1W6PAf8LEoB?=

=?iso-8859-1?Q?dQKxvMfK5ziw7gRr6H1Sszriiju+EAPN68ZE+9Wi2vwiYRxFPj4554Dy21?=

=?iso-8859-1?Q?m/XNLej7eBk4zgUq4PxV55hpdNFzp/wT9+3G6KTwmXUDgWDHMec61zKoEh?=

=?iso-8859-1?Q?FoNVuNFcmpka80lx/gLwwlXR3GOQfrgaDDBYNoz+b5nAN+j1uVpP+0Ku/M?=

=?iso-8859-1?Q?GHXLn0rMCJ//vrWDIFAlfRffQ99PfpzK1XiG+yvn6xdRksmiuZDGDu/mxV?=

=?iso-8859-1?Q?9zXyo7jIK+yuJZyiZgoqvGWPZBt/XSaugrnr6J4hbvD45QoKbnd/xkkftQ?=

=?iso-8859-1?Q?gFhVLxpT0RKSgvIlZXJGLoAgAetKFk9y+Fw91/L4nIOxJmDm3L1fJduB++?=

=?iso-8859-1?Q?FYVXH39Pidp12pURt3DpS2SZveehJQpDMTpYLfirAziPeG0fwEDrtPhplD?=

=?iso-8859-1?Q?BVuQkSfL1/qe4oZxs6gLfBfby7+T2qBHpg4fYlw3LG/C+k6PwS6A/D4h0N?=

=?iso-8859-1?Q?NxBI5Q3Yx85KkLxzq3qBtVFfngFfdT7pfbWXD945MhbGvQs+eWdU9cMc08?=

=?iso-8859-1?Q?Hvza31ElMUjz40MA7H2n9P38ZMaXoPc58VAfcurINzIV9hLwJesw3dWg0G?=

=?iso-8859-1?Q?ErF26mf7DgO7cd0iUur2dgN6SayfHWG0QkKKwERU9XI3la/dTOywjwPLS8?=

=?iso-8859-1?Q?0tXeNSkny9eiV3NqOOQuTZJSPvmLw6YSXHAqhqJ3NSP/sgHEro3LYVDSzx?=

=?iso-8859-1?Q?I6HY7wTn6fWrqFRNYfCTzIrkzRym8d4tnFUQg5lJfsgGsjT0PDhZZpiLw8?=

=?iso-8859-1?Q?iO1fgRclOJJOCwdmAFhvrIFwmuIYcr5duH7MHcQ2Z73HWeBxLbAkCuwx7R?=

=?iso-8859-1?Q?P3LiAsv45XGX0AtIfwdx7mFU+blaD32YjxumYsMqoD/kuR+6gSC5YDAaTW?=

=?iso-8859-1?Q?gKl/JZP0vZGBo7jVHAGQnVVSXssXlg3KOf5X55OkOoCP+XPIQzFqSLHVRG?=

=?iso-8859-1?Q?LfNwmpOhMQgP4IjsTOs57z7TuXOgDLnlSI7wo36E96wzsX5bqTXG5rJ/HC?=

=?iso-8859-1?Q?DMRPYNH0VOg3f7tJHA2PCEroRk2PHMNc9Fieut2KQsHLCPX5IIt14aNq8y?=

=?iso-8859-1?Q?LtCAAH4kXhLaHBAJYJ2c/XLRegVkAyWDSF0GlJDrL55E6sT3oqrBy6oO2L?=

=?iso-8859-1?Q?s3EVlxkUv65hxJE+JA7AETn/HHNN1AfKWwa+tfPFm4LKnuLKL8fIPP+cI2?=

=?iso-8859-1?Q?usfOpi8HHajYgECokHPAC6FbkoDVHUxKTwPwNTd4nVcbTPUJoVnz+8BUw/?=

=?iso-8859-1?Q?v6H9ezeSbGT1ejB5KOIxhMyHVwCHOeMbRRbPCbrGXQGmiQJk5WkJ/KdCnS?=

=?iso-8859-1?Q?Mq1/3pkgetTIYIe3PD3Y8V7VptRs/axiFgIH7e2b9gBTTzouoV7xylUFRF?=

=?iso-8859-1?Q?Is/eJEY=3D?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?iso-8859-1?Q?AimzrvRHcBKsrZF4/VNt6/EJZEVz9Mp/s8lPl73ggeuOl9mMYRotL7Xaxx?=

=?iso-8859-1?Q?M6YrMOdQhwDnJ4kbS2qtvVuu4ViR2AVt4d/JCCwG96oPRkoUEg66Qj+aQB?=

=?iso-8859-1?Q?wTKvRbbyYOJa5L+CDydncwy1/Y62Yy0KVztBFmJiuWsrCIGUPZHEXcKWQ9?=

=?iso-8859-1?Q?G9eZ+cCLxxXuhIbcYN9KUNB5dpPoF2XwmE7mvUf4G1gSwDbaY/4lWGOYXN?=

=?iso-8859-1?Q?A4zcY/rtZN+++VrziIvixY3EjIlSdssGLI/EAhVMb/Ol/9nkD7oBa7Ep5/?=

=?iso-8859-1?Q?QVbWjgU2dhAYzUfEOKG/ZNb/IpmfPXy8K3Spj9fdAr6lGmOwEcL5ckovaV?=

=?iso-8859-1?Q?+LwcjdPSGm+8VcgyvAqxqCnFRuludXbP9QxOaPhsywYGw9zeFIFFEiYcAc?=

=?iso-8859-1?Q?mukP3Zzlv+COUqwWj/8HfR3+m0rCScQ+IaZicUxs83QlGKtX9JA39r691E?=

=?iso-8859-1?Q?VLrVtmRgFZWLXwkh4Bb7ayVcM24u/6BiJsEChgrNr4jaqDo/I8EuU3i72R?=

=?iso-8859-1?Q?1rK2QirL7CurQamhA9jOlumc3xBFzz9ryCAJv+zEGXsTNsCzvzgsKfK6v5?=

=?iso-8859-1?Q?Q1riiueTLJygV6eNiG9Vb68TYvLcGhZcuQuTcHZQonGVmVkl0RWmLA9lCh?=

=?iso-8859-1?Q?+jco1ZrUJXrEIlq+J2vlV26mjCiTaY01cKw388GFf65Y5uQzIXskYan2qL?=

=?iso-8859-1?Q?Ja82ge2G8AYKHd3nMOgi6VyXttgXcbwH3DiyHKHMDQizoKMK5floqL4mTp?=

=?iso-8859-1?Q?4Zkbtj+Wa3Txv7EZsHFw+sekYvAMqSrAbS7Lbj5ggL+vBXFcV7V4JXZ0ec?=

=?iso-8859-1?Q?jtx4LdWt5SNy+67QVigw4jVZu2l4IA1laUSpEc5z8itvVQb+rYMdLaiVmC?=

=?iso-8859-1?Q?BEmCOXYZS1RxqAlfT2wCowYO99zHrRCL68rb0KX9aWNg4AGPWTbtBqtwHN?=

=?iso-8859-1?Q?fn0BhR6RDVGrIOqVGPjyM/dXOr2k7J4Qu9jekBbpNWlQ+30Y9WJKKeekrJ?=

=?iso-8859-1?Q?1el4Qw00XuDFUk/OTKuOsWgAEOVYgrQn0gYdWbw04eoQV0E5xle54Zhsmw?=

=?iso-8859-1?Q?cm6dG5tIQwFs7S6uypJOzb959xKkTG5LVQ4Bys4oVk7aQo/vv9dqfLEkC+?=

=?iso-8859-1?Q?4JsO4iM85+bAHFfp2n07esBTHriZgkkwdSifHQusRYmBVWnJ5UhZXkpWSx?=

=?iso-8859-1?Q?B6o4DKXhtmik5yhGEFUgNvxRoEBZx0CXUo/Y8oLhLmGNBOznAGl31QYnjV?=

=?iso-8859-1?Q?25/wSD0Aovo9ToI7nL+8A25JJNaoQwLbdlxY1uXhtCBa/1waTWdxYj1EAX?=

=?iso-8859-1?Q?hfsShYxsTcq+uRJ03KcHelhIlbUQIfw5KVMpsJtFeFklasDAXVbnhIdTte?=

=?iso-8859-1?Q?rRFkPU8UEwycK1UL0gFobc79pjnzfq0vy9PewzwBhKrJhBYP4p01bVgihX?=

=?iso-8859-1?Q?1w9IFZRDkVFaWOIQ?=

Content-Type: multipart/alternative;

boundary="_000_DU4PR07MB11594A48C79112058B002DD9DD29FADU4PR07MB11594eu_"

MIME-Version: 1.0

X-OriginatorOrg: outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: DU4PR07MB11594.eurprd07.prod.outlook.com

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: a20c6a27-abb8-40eb-0053-08de60336383

X-MS-Exchange-CrossTenant-originalarrivaltime: 30 Jan 2026 19:11:36.1486

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: GVXPR07MB9822

X-Spam_score: 10.9

X-Spam_score_int: 109

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Greetings, Al Ghurair Investment is offering single digit

interest loan for private and corporate bodies, to finance their projects

across the globe. With our flexible security and an option of early repayment

and/or conversion into equity, our project financing is the best you can

get. Our track records are there to speak volume.

Categories: Microsoft Outlook Hotmail Spam

0 Comments

McAfee Phish from Google Gmail Part 4
Posted by Dave Yadallee on Friday, January 30. 2026

/InformAction">
Event">
eduled"/>
rg/Organization">
n>
EFwme1"/>
ight: 1px; height: 0; max-height: 0; width: 0; max-width: 0; opacity: 0; ov=

erflow: hidden;" itemprop=3D"name">Good morning, Transaction is cleared for=

next steps
atetime=3D"20260131T064629Z">
20260131T064629Z">
pacing=3D"0" role=3D"presentation" align=3D"center" style=3D"width:100%;" c=

lass=3D"body-container">

>

0" cellspacing=3D"0" role=3D"presentation" align=3D"center" style=3D"width:=

100%;" class=3D"">=

itemscope itemtype=3D"http://schema.org/EmailMessage">

iption">Good morning, Transaction is cleared for next steps

" role=3D"presentation" align=3D"center" style=3D"width:100%;" class=3D""><=

tbody>=

tion: rtl; font-size: 0; padding: 24px 32px; text-align: left; vertical-ali=

gn: top;" class=3D"main-container-inner">

tr; display: inline-block; vertical-align: top; width: 100%;overflow: hidde=

n; word-wrap: break-word;">
g=3D"0" role=3D"presentation" width=3D"100%" class=3D"main-column-table-ltr=

" style=3D"padding-right: 32px; padding-left: 0;;table-layout: fixed;">
dy>=

">
ion" width=3D"100%" style=3D"table-layout: fixed;">
tr>

ze: 0; padding: 0; text-align: left; word-break: break-word;;padding-bottom=

:2px;">

;font-weight: 400; font-size: 22px; line-height: 28px;color: #3c4043; text-=

decoration: none;" class=3D"primary-text" role=3D"presentation">
rop=3D"name">Good morning, Transaction is cleared for next steps
v>

rd-break: break-word;;padding-bottom:24px;">

to, sans-serif;font-style: normal; font-weight: 400; font-size: 14px; line-=

height: 20px; letter-spacing: 0.2px;color: #3c4043; text-decoration: none;"=

class=3D"primary-text" role=3D"presentation">
ime itemprop=3D"startDate" datetime=3D"20260131T064629Z">
rop=3D"endDate" datetime=3D"20260131T064629Z">Saturday =

Jan 31, 2026 =E2=8B=85 12:46am (Central Time - Chicago)

break-word;;padding-bottom:24px;">

serif;font-style: normal; font-weight: 400; font-size: 14px; line-height: 2=

0px; letter-spacing: 0.2px;color: #3c4043; text-decoration: none;" class=3D=

"primary-text" role=3D"presentation">
McAfee
Transaction Date: S=

aturday, 31 January 2026
Transaction No: URJR-1621-SRFJ
Customer Supp=

ort Request - { 1-582- 238-0725 }
Your plan has been renewed.
G=

ood morning,
We=E2=80=99re informing you that your McAfee subscriptio=

n will renew automatically as scheduled. A payment of $552.77 via Auto Debi=

t is planned for your 1 Year term.
Billing Activity Confirmation:
=

=E2=80=A2 Plan: Full Membership
=E2=80=A2 Quantity: 2x
=E2=80=A2 Term=

Duration: 1 Year
=E2=80=A2 Billing Mode: Auto Debit
=E2=80=A2 Amount=

Due: $552.77
If you=E2=80=99d like to review or stop the renewal, pl=

ease contact +1 (859) 204-6320.
All the best,
McAfee, Inc.

pan>
day, 31 January 2026Transaction No: URJR-1621-SRFJCustomer Support Request =

- { 1-582- 238-0725 }Your plan has been renewed.Good morning,We’r=

e informing you that your McAfee subscription will renew automatically as s=

cheduled. A payment of $552.77 via Auto Debit is planned for your 1 Year te=

rm.Billing Activity Confirmation:• Plan: Full Membership•=

Quantity: 2x• Term Duration: 1 Year• Billing Mode: Auto =

Debit• Amount Due: $552.77If you’d like to review or sto=

p the renewal, please contact +1 (859) 204-6320.All the best,McAfee, Inc."=

/>

ft; word-break: break-word;;padding-bottom:24px;">

: Roboto, sans-serif;font-style: normal; font-weight: 400; font-size: 14px;=

line-height: 20px; letter-spacing: 0.2px;color: #3c4043; text-decoration: =

none;" class=3D"primary-text" role=3D"presentation">
lpadding=3D"0" cellspacing=3D"0" role=3D"presentation" style=3D"padding-bot=

tom: 4px;">

r: #3c4043; text-decoration: none;font-weight: 700;-webkit-font-smoothing: =

antialiased;margin: 0; padding: 0;">Guests
(Guest lis=

t has been hidden at organizer's request)

--0000000000003a1e1b06499e8e06--

Categories: Google Gmail Spam, Phish

0 Comments

McAfee Phish from Google Gmail Part 3
Posted by Dave Yadallee on Friday, January 30. 2026

@font-face {

font-family: 'Google Sans';

font-style: normal;

font-weight: 700;

src: url(//fonts.gstatic.com/s/googlesans/v14/4UabrENHsxJlGDuGo1OIlLV154t=

zCwM.ttf) format('truetype');

}

=20

=20

=20

=20

Categories: Google Gmail Spam, Phish

0 Comments

McAfee Phish from Google Gmail Part 2
Posted by Dave Yadallee on Friday, January 30. 2026

r: #3c4043; text-decoration: none;font-weight: 700;-webkit-font-smoothing: = antialiased;margin: 0; padding: 0;">Guests

r: #3c4043; text-decoration: none;font-weight: 700;-webkit-font-smoothing: =

antialiased;margin: 0; padding: 0;">Guests