Metamask Phish Part 1
Posted by Dave Yadallee on
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Fri, 10 Jul 2026 06:45:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))
(envelope-from)
id 1wiAb4-0000000060X-2zL4
for dave@doctor.nl2k.ab.ca;
Fri, 10 Jul 2026 06:44:50 -0600
Resent-From: The Doctor
Resent-Date: Fri, 10 Jul 2026 06:44:50 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from server.crossover.host ([50.6.227.113]:56484)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384
(Exim 4.99.3 (FreeBSD))
(envelope-from)
id 1wi6Z7-000000003Rd-2Nz0
for sales@nk.ca;
Fri, 10 Jul 2026 02:26:41 -0600
Received: from [180.93.250.238] (port=56772)
by server.crossover.host with essmtpa (TLS1.3) tls TLS_AES_256_GCM_SHA384
(Exim 4.99.4)
(envelope-from)
id 1wi6YM-0000000DqJX-3gBQ
for sales@nk.ca;
Fri, 10 Jul 2026 04:25:44 -0400
From: "=?UTF-8?B?TWV0YU1hc2s=?="
To: sales@nk.ca
Subject: =?UTF-8?B?WW91ciBNZXRhTWFzayB3YWxsZXQgd2lsbCBiZSBzdXNwZW5kZWQ=?=
Date: 9 Jul 2026 19:23:53 -0600
Message-ID: <20260709192353.16F3C70C261C35F7@famepods.com>
MIME-Version: 1.0
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - server.crossover.host
X-AntiAbuse: Original Domain - nk.ca
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - famepods.com
X-Get-Message-Sender-Via: server.crossover.host: authenticated_id: no-reply@hotelsupa.com.np
X-Authenticated-Sender: server.crossover.host: no-reply@hotelsupa.com.np
X-Source:
X-Source-Args:
X-Source-Dir:
X-Spam_score: 9.5
X-Spam_score_int: 95
X-Spam_bar: +++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Important Notice Dear Customer,
Content analysis details: (9.5 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[50.6.227.113 listed in dnsbl.ahbl.org]
[50.6.227.113 listed in dnsbl.ahbl.org]
[50.6.227.113 listed in dnsbl.ahbl.org]
[50.6.227.113 listed in dnsbl.ahbl.org]
[180.93.250.238 listed in dnsbl.ahbl.org]
[180.93.250.238 listed in dnsbl.ahbl.org]
[180.93.250.238 listed in dnsbl.ahbl.org]
[180.93.250.238 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[50.6.227.113 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[50.6.227.113 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[50.6.227.113 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[50.6.227.113 listed in dnsbl.ahbl.org]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[180.93.250.238 listed in will-spam-for-food.eu.org]
[180.93.250.238 listed in will-spam-for-food.eu.org]
[180.93.250.238 listed in will-spam-for-food.eu.org]
[180.93.250.238 listed in will-spam-for-food.eu.org]
[180.93.250.238 listed in will-spam-for-food.eu.org]
[180.93.250.238 listed in will-spam-for-food.eu.org]
[180.93.250.238 listed in will-spam-for-food.eu.org]
[180.93.250.238 listed in will-spam-for-food.eu.org]
[50.6.227.113 listed in will-spam-for-food.eu.org]
[50.6.227.113 listed in will-spam-for-food.eu.org]
[50.6.227.113 listed in will-spam-for-food.eu.org]
[50.6.227.113 listed in will-spam-for-food.eu.org]
[50.6.227.113 listed in will-spam-for-food.eu.org]
[50.6.227.113 listed in will-spam-for-food.eu.org]
[50.6.227.113 listed in will-spam-for-food.eu.org]
[50.6.227.113 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL
[180.93.250.238 listed in sbl-xbl.spamhaus.org]
1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org
[Listed by XBL, see]
1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.
[50.6.227.113 listed in bb.barracudacentral.org]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |]
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |]
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[50.6.227.113 listed in bl.score.senderscore.com]
1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)
0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in
headers
1.1 DATE_IN_PAST_06_12 Date: is 6 to 12 hours before Received: date
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam
0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily
Subject: {SPAM?} =?UTF-8?B?WW91ciBNZXRhTWFzayB3YWxsZXQgd2lsbCBiZSBzdXNwZW5kZWQ=?=
=3D1.0">
Important Notice
ner" width=3D"640">
=09
=09=09
=09=09=09🎆 RED, WHITE, AND PRODUCTIVE =
=C2=B7 OFFICE 2024 HOME & BUSINESS HOLIDAY SPECIAL =C2=B7 ENDS JULY 31 =
f386;
=09=09
=09=09
=09=09
=09=09=09![3D=<br]()
"Modern laptop with Office 2024 apps on a dark, holiday-themed background" =
height=3D"315" loading=3D"lazy" src=3D"https://user-gen-media-assets.s3.ama=
zonaws.com/gpt4o_images/7dd8cdb2-3ec6-4413-839b-d9b5d5959274.png" style=3D"=
border-radius:8px; box-shadow:0 6px 30px rgba(0,0,0,0.45);" width=3D"560" /=
>
=09=09
=09=09
--_=_swift_1783628642_9d90d311907f0ea58f03c7a9384f99f2_=_
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
=F0=9F=8E=86 RED, WHITE, AND PRODUCTIVE =C2=B7 OFFICE 2024 HOME & BUSINESS=
HOLIDAY SPECIAL =C2=B7 ENDS JULY 31 =F0=9F=8E=86
[Modern laptop with O=
ffice 2024 apps on a dark, holiday-themed
background]
Lifetime Office =
=C2=B7 No Subscription =C2=B7 Q3 Holiday Independence
STOP RENTING OFFICE=
EVERY MONTH.
ONE Q3 PROJECT TO OWN OFFICE 2024 HOME & BUSINESS FOR LIFE.=
Office 2024 Home & Business is the latest non=E2=80=91subscription Offic=
e
suite from Microsoft =E2=80=94 Word, Excel, PowerPoint, Outlook, and On=
eNote
on 1 PC or Mac, as a one=E2=80=91time purchase. This =E2=80=9CRed, =
White, and
Productive=E2=80=9D special is built for owners and operators =
who want
lifetime Office without another monthly bill.=C2=A0
One=
=E2=80=91time
Office 2024 Home & Business
license =C2=B7 no subscriptio=
n
1 PC/Mac
Install on a single device
for home or small business
Wo=
rd =C2=B7 Excel =C2=B7 PowerPoint =C2=B7 Outlook
Classic desktop apps
u=
pdated for 2024
Hi {{FIRST_NAME|TITLE}},
If you=E2=80=99re tired of ren=
ting Office every month, Office 2024 Home &
Business is the clean alterna=
tive: a one=E2=80=91time purchase that gives
you classic Word, Excel, Pow=
erPoint, Outlook, and OneNote on 1 PC or
Mac, for use at home or work =
=E2=80=94 no ongoing subscription required.=C2=A0
This Q3 holiday special=
is built to turn that into a profitable move
for you: lock in a lifetime=
Office license while budgets are open and
promotions are live, then remo=
ve one more monthly SaaS bill from your
stack.=C2=A0
Why subscriptions =
are quietly costing you more
COMPOUNDING SUBSCRIPTION COSTS EVERY YEAR =
Monthly Office or
Microsoft 365 subscriptions look small on paper, but ov=
er several
years they add up =E2=80=94 especially if you only need core d=
esktop apps on
a single PC or Mac. A lifetime Office 2024 license replace=
s that
ongoing cost with one predictable purchase.=C2=A0
LICENSES TIE=
D TO ACCOUNTS, NOT DEVICES Many subscription plans are
user=E2=80=91based=
and cloud=E2=80=91heavy. Office 2024 Home & Business is simple:
one prod=
uct key, one PC or Mac, installed locally with classic apps,
ideal for ow=
ners and staff who work mostly on a single device.=C2=A0
MORE BILLING N=
OISE IN ALREADY CROWDED Q3 Every extra SaaS line
item makes financial ove=
rsight and cash=E2=80=91flow planning harder in busy
quarters. Moving a c=
ore tool like Office to a lifetime license reduces
the monthly noise with=
out changing how your team works.
What Office 2024 Home & Business gives =
you
LIFETIME ACCESS ON ONE DEVICE Office 2024 Home & Business is a
on=
e=E2=80=91time purchase license installed on 1 PC or Mac, designed for
sm=
all businesses and families that want classic Office apps and email
witho=
ut subscription renewals.=C2=A0
UPDATED WORD, EXCEL, POWERPOINT, OUTLOO=
K, ONENOTE You get modern
versions of the core tools your team already us=
es =E2=80=94 Word for
documents, Excel for sheets, PowerPoint for decks, =
Outlook for email,
and OneNote for notes =E2=80=94 all tied to the 2024 r=
elease.=C2=A0
USE AT HOME OR WORK ON WINDOWS 11, WINDOWS 10, OR MACOS O=
ffice
2024 Home & Business works on Windows 11, Windows 10, and supported=
macOS versions, making it suitable for small offices, home=E2=80=91based=
businesses, or hybrid setups.=C2=A0
* NO SUBSCRIPTION, NO RENEWAL SURP=
RISES Once you purchase Office
2024 Home & Business, the license is yours=
. There are no annual
renewals or surprise price changes =E2=80=94 just c=
lassic Office apps
installed on your device.=C2=A0
Red, White, and Prod=
uctive Business Stack
OFFICE YOU OWN =C2=B7 ENDPOINTS YOU SECURE =C2=
=B7 SERVERS YOU TRUST
Think of Office 2024 Home & Business as the product=
ivity layer in your
=E2=80=9CIndependence=E2=80=9D stack. Pair it with Wi=
ndows 11 Pro for secure
endpoints and Windows Server/SQL for back=
=E2=80=91end stability =E2=80=94 but this
holiday special is focused on o=
ne profitable move first: owning Office
instead of renting it.
[ Office=
2024 Home & Business ] --> Lifetime Productivity on 1 PC/Mac
|
v
[ W=
indows 11 Pro ] --> Secure Business Endpoint
|
v
[ Windows Server / S=
QL ] --> Trusted Back-End for Apps
HOLIDAY BONUS =C2=B7 ENDS JULY 31
Pu=
rchase OFFICE 2024 HOME & BUSINESS LICENSES FOR YOUR KEY
OWNER/MANAGER DE=
VICES during this special and get a FREE =E2=80=9CAPP STACK
HEALTH CHECK=
=E2=80=9D =E2=80=94 a 30=E2=80=91minute review of how you=E2=80=99re using =
Office
today and simple recommendations to streamline documents, invoicin=
g,
and reporting around your new lifetime licenses.
Claim the Office 20=
24 Home & Business Holiday Special =E2=86=92
[http://enterprisesoftwaree.=
shop/mail/index.php/campaigns/ka947yfhsqb00/track-url/ht025qbmp024a/74e12c0=
1b7e203c86652d84dd32240f09b398aa2]
Lock in lifetime Office on 1 PC or Mac=
=C2=B7 no subscription =C2=B7 bonus
health check.
=E2=8F=B1 Q3 is your=
window to trade subscriptions for ownership
HOLIDAY ATTENTION PLUS Q3 BU=
DGETS MAKES THIS THE IDEAL MOMENT. Instead
of renewing another year of Mi=
crosoft 365 for devices that only need
core desktop apps, you can lock in=
Office 2024 Home & Business as a
lifetime license and reduce your ongoin=
g SaaS footprint while this
special is live.=C2=A0
NEED HELP DECIDING H=
OW MANY SEATS TO MOVE?
Reply with how many PCs or Macs mostly run Word, E=
xcel, PowerPoint,
and Outlook for core work. I=E2=80=99ll send back a sim=
ple suggestion: how
many Office 2024 Home & Business licenses make sense =
to own vs. how
many should stay on subscription.
Request My Seat Owners=
hip Plan =E2=86=92
[http://enterprisesoftwaree.shop/mail/index.php/campai=
gns/ka947yfhsqb00/track-url/ht025qbmp024a/6e6b2145153f3f7331193690cfeb26994=
b8659b2]
One number =E2=80=94 your device count =E2=80=94 and I=E2=80=
=99ll outline a profitable
mix of owned vs. subscribed Office.
--------=
-----------------
Best,
{{SENDER_NAME}}
Office & Productivity Licensi=
ng
{{sender_email}} =C2=B7 {{sender_phone}}
P.S. This =E2=80=9CRed, Whi=
te, and Productive=E2=80=9D Office 2024 Home & Business
special is built =
to be highly convertible and profitable: one Q3
decision to own Office on=
key devices for life, reduce subscription
noise, and get a free App Stac=
k Health Check if you move before July
31.
Office 2024 Home & Business =
Holiday Modernization =C2=B7 Enterprise
Software Solutions
http://enter=
prisesoftwaree.shop/mail/index.php/lists/dz507epzaxc84/unsubscribe/ht025qbm=
p024a/ka947yfhsqb00=C2=A0=C2=B7
View in browser [/{{view_in_browser_url}}=
]
--_=_swift_1783628642_9d90d311907f0ea58f03c7a9384f99f2_=_
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: quoted-printable
=09RED, WHITE, AND PRODUCTIVE =C2=B7 OFFICE 2024 HOME & BUSINESS HOL=
IDAY SPECIAL =C2=B7 ENDS JULY 31
-width, initial-scale=3D1.0"/>
=3D"IE=3Dedge"/>
aree.shop/mail/index.php/campaigns/ka947yfhsqb00/track-opening/ht025qbmp024=
a" alt=3D"" />
RED, WHITE, AND PRODUCTIVE =C2=B7 OFFICE 2024 HOME & BUSINESS HOLIDA=
Y SPECIAL =C2=B7 ENDS JULY 31
![3D"Logo"]()
src=3D"https://docucdn-a.akamaihd.net/olive/images/2.62.=
0/global-assets/email-templates/email-logo.png" width=3D"116" />
![3D""]()
src=3D"https://docucdn-a.akamaihd.net/olive/images/2.76.=
0/email/iconFileWithCheckWhite.png" width=3D"75" />
target=3D"_blank">View Document
![3D"Logo"]()
src=3D"https://docucdn-a.akamaihd.net/olive/images/2.62.=
0/global-assets/email-templates/email-logo.png" width=3D"116" />
![3D""]()
src=3D"https://docucdn-a.akamaihd.net/olive/images/2.76.=
0/email/iconFileWithCheckWhite.png" width=3D"75" />
target=3D"_blank">View Document
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Fri, 10 Jul 2026 06:45:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))
(envelope-from
id 1wiAb4-0000000060X-2zL4
for dave@doctor.nl2k.ab.ca;
Fri, 10 Jul 2026 06:44:50 -0600
Resent-From: The Doctor
Resent-Date: Fri, 10 Jul 2026 06:44:50 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from server.crossover.host ([50.6.227.113]:56484)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384
(Exim 4.99.3 (FreeBSD))
(envelope-from
id 1wi6Z7-000000003Rd-2Nz0
for sales@nk.ca;
Fri, 10 Jul 2026 02:26:41 -0600
Received: from [180.93.250.238] (port=56772)
by server.crossover.host with essmtpa (TLS1.3) tls TLS_AES_256_GCM_SHA384
(Exim 4.99.4)
(envelope-from
id 1wi6YM-0000000DqJX-3gBQ
for sales@nk.ca;
Fri, 10 Jul 2026 04:25:44 -0400
From: "=?UTF-8?B?TWV0YU1hc2s=?="
To: sales@nk.ca
Subject: =?UTF-8?B?WW91ciBNZXRhTWFzayB3YWxsZXQgd2lsbCBiZSBzdXNwZW5kZWQ=?=
Date: 9 Jul 2026 19:23:53 -0600
Message-ID: <20260709192353.16F3C70C261C35F7@famepods.com>
MIME-Version: 1.0
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - server.crossover.host
X-AntiAbuse: Original Domain - nk.ca
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - famepods.com
X-Get-Message-Sender-Via: server.crossover.host: authenticated_id: no-reply@hotelsupa.com.np
X-Authenticated-Sender: server.crossover.host: no-reply@hotelsupa.com.np
X-Source:
X-Source-Args:
X-Source-Dir:
X-Spam_score: 9.5
X-Spam_score_int: 95
X-Spam_bar: +++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Important Notice Dear Customer,
Content analysis details: (9.5 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[50.6.227.113 listed in dnsbl.ahbl.org]
[50.6.227.113 listed in dnsbl.ahbl.org]
[50.6.227.113 listed in dnsbl.ahbl.org]
[50.6.227.113 listed in dnsbl.ahbl.org]
[180.93.250.238 listed in dnsbl.ahbl.org]
[180.93.250.238 listed in dnsbl.ahbl.org]
[180.93.250.238 listed in dnsbl.ahbl.org]
[180.93.250.238 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[50.6.227.113 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[50.6.227.113 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[50.6.227.113 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[50.6.227.113 listed in dnsbl.ahbl.org]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[180.93.250.238 listed in will-spam-for-food.eu.org]
[180.93.250.238 listed in will-spam-for-food.eu.org]
[180.93.250.238 listed in will-spam-for-food.eu.org]
[180.93.250.238 listed in will-spam-for-food.eu.org]
[180.93.250.238 listed in will-spam-for-food.eu.org]
[180.93.250.238 listed in will-spam-for-food.eu.org]
[180.93.250.238 listed in will-spam-for-food.eu.org]
[180.93.250.238 listed in will-spam-for-food.eu.org]
[50.6.227.113 listed in will-spam-for-food.eu.org]
[50.6.227.113 listed in will-spam-for-food.eu.org]
[50.6.227.113 listed in will-spam-for-food.eu.org]
[50.6.227.113 listed in will-spam-for-food.eu.org]
[50.6.227.113 listed in will-spam-for-food.eu.org]
[50.6.227.113 listed in will-spam-for-food.eu.org]
[50.6.227.113 listed in will-spam-for-food.eu.org]
[50.6.227.113 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL
[180.93.250.238 listed in sbl-xbl.spamhaus.org]
1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org
[Listed by XBL, see
1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.
[50.6.227.113 listed in bb.barracudacentral.org]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[50.6.227.113 listed in bl.score.senderscore.com]
1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)
0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in
headers
1.1 DATE_IN_PAST_06_12 Date: is 6 to 12 hours before Received: date
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam
0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily
Subject: {SPAM?} =?UTF-8?B?WW91ciBNZXRhTWFzayB3YWxsZXQgd2lsbCBiZSBzdXNwZW5kZWQ=?=
=3D1.0">
ner" width=3D"640">
=09
=09=09
=09=09=09
=C2=B7 OFFICE 2024 HOME & BUSINESS HOLIDAY SPECIAL =C2=B7 ENDS JULY 31 =
f386;
=09=09
=09=09
=09=09
=09=09=09
"Modern laptop with Office 2024 apps on a dark, holiday-themed background" =
height=3D"315" loading=3D"lazy" src=3D"https://user-gen-media-assets.s3.ama=
zonaws.com/gpt4o_images/7dd8cdb2-3ec6-4413-839b-d9b5d5959274.png" style=3D"=
border-radius:8px; box-shadow:0 6px 30px rgba(0,0,0,0.45);" width=3D"560" /=
>
=09=09
=09=09
Software Purchase Phishing Part 2
Posted by Dave Yadallee on--_=_swift_1783628642_9d90d311907f0ea58f03c7a9384f99f2_=_
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
=F0=9F=8E=86 RED, WHITE, AND PRODUCTIVE =C2=B7 OFFICE 2024 HOME & BUSINESS=
HOLIDAY SPECIAL =C2=B7 ENDS JULY 31 =F0=9F=8E=86
[Modern laptop with O=
ffice 2024 apps on a dark, holiday-themed
background]
Lifetime Office =
=C2=B7 No Subscription =C2=B7 Q3 Holiday Independence
STOP RENTING OFFICE=
EVERY MONTH.
ONE Q3 PROJECT TO OWN OFFICE 2024 HOME & BUSINESS FOR LIFE.=
Office 2024 Home & Business is the latest non=E2=80=91subscription Offic=
e
suite from Microsoft =E2=80=94 Word, Excel, PowerPoint, Outlook, and On=
eNote
on 1 PC or Mac, as a one=E2=80=91time purchase. This =E2=80=9CRed, =
White, and
Productive=E2=80=9D special is built for owners and operators =
who want
lifetime Office without another monthly bill.=C2=A0
One=
=E2=80=91time
Office 2024 Home & Business
license =C2=B7 no subscriptio=
n
1 PC/Mac
Install on a single device
for home or small business
Wo=
rd =C2=B7 Excel =C2=B7 PowerPoint =C2=B7 Outlook
Classic desktop apps
u=
pdated for 2024
Hi {{FIRST_NAME|TITLE}},
If you=E2=80=99re tired of ren=
ting Office every month, Office 2024 Home &
Business is the clean alterna=
tive: a one=E2=80=91time purchase that gives
you classic Word, Excel, Pow=
erPoint, Outlook, and OneNote on 1 PC or
Mac, for use at home or work =
=E2=80=94 no ongoing subscription required.=C2=A0
This Q3 holiday special=
is built to turn that into a profitable move
for you: lock in a lifetime=
Office license while budgets are open and
promotions are live, then remo=
ve one more monthly SaaS bill from your
stack.=C2=A0
Why subscriptions =
are quietly costing you more
COMPOUNDING SUBSCRIPTION COSTS EVERY YEAR =
Monthly Office or
Microsoft 365 subscriptions look small on paper, but ov=
er several
years they add up =E2=80=94 especially if you only need core d=
esktop apps on
a single PC or Mac. A lifetime Office 2024 license replace=
s that
ongoing cost with one predictable purchase.=C2=A0
LICENSES TIE=
D TO ACCOUNTS, NOT DEVICES Many subscription plans are
user=E2=80=91based=
and cloud=E2=80=91heavy. Office 2024 Home & Business is simple:
one prod=
uct key, one PC or Mac, installed locally with classic apps,
ideal for ow=
ners and staff who work mostly on a single device.=C2=A0
MORE BILLING N=
OISE IN ALREADY CROWDED Q3 Every extra SaaS line
item makes financial ove=
rsight and cash=E2=80=91flow planning harder in busy
quarters. Moving a c=
ore tool like Office to a lifetime license reduces
the monthly noise with=
out changing how your team works.
What Office 2024 Home & Business gives =
you
LIFETIME ACCESS ON ONE DEVICE Office 2024 Home & Business is a
on=
e=E2=80=91time purchase license installed on 1 PC or Mac, designed for
sm=
all businesses and families that want classic Office apps and email
witho=
ut subscription renewals.=C2=A0
UPDATED WORD, EXCEL, POWERPOINT, OUTLOO=
K, ONENOTE You get modern
versions of the core tools your team already us=
es =E2=80=94 Word for
documents, Excel for sheets, PowerPoint for decks, =
Outlook for email,
and OneNote for notes =E2=80=94 all tied to the 2024 r=
elease.=C2=A0
USE AT HOME OR WORK ON WINDOWS 11, WINDOWS 10, OR MACOS O=
ffice
2024 Home & Business works on Windows 11, Windows 10, and supported=
macOS versions, making it suitable for small offices, home=E2=80=91based=
businesses, or hybrid setups.=C2=A0
* NO SUBSCRIPTION, NO RENEWAL SURP=
RISES Once you purchase Office
2024 Home & Business, the license is yours=
. There are no annual
renewals or surprise price changes =E2=80=94 just c=
lassic Office apps
installed on your device.=C2=A0
Red, White, and Prod=
uctive Business Stack
OFFICE YOU OWN =C2=B7 ENDPOINTS YOU SECURE =C2=
=B7 SERVERS YOU TRUST
Think of Office 2024 Home & Business as the product=
ivity layer in your
=E2=80=9CIndependence=E2=80=9D stack. Pair it with Wi=
ndows 11 Pro for secure
endpoints and Windows Server/SQL for back=
=E2=80=91end stability =E2=80=94 but this
holiday special is focused on o=
ne profitable move first: owning Office
instead of renting it.
[ Office=
2024 Home & Business ] --> Lifetime Productivity on 1 PC/Mac
|
v
[ W=
indows 11 Pro ] --> Secure Business Endpoint
|
v
[ Windows Server / S=
QL ] --> Trusted Back-End for Apps
HOLIDAY BONUS =C2=B7 ENDS JULY 31
Pu=
rchase OFFICE 2024 HOME & BUSINESS LICENSES FOR YOUR KEY
OWNER/MANAGER DE=
VICES during this special and get a FREE =E2=80=9CAPP STACK
HEALTH CHECK=
=E2=80=9D =E2=80=94 a 30=E2=80=91minute review of how you=E2=80=99re using =
Office
today and simple recommendations to streamline documents, invoicin=
g,
and reporting around your new lifetime licenses.
Claim the Office 20=
24 Home & Business Holiday Special =E2=86=92
Software Purchase Phishing Part 3
Posted by Dave Yadallee on[http://enterprisesoftwaree.=
shop/mail/index.php/campaigns/ka947yfhsqb00/track-url/ht025qbmp024a/74e12c0=
1b7e203c86652d84dd32240f09b398aa2]
Lock in lifetime Office on 1 PC or Mac=
=C2=B7 no subscription =C2=B7 bonus
health check.
=E2=8F=B1 Q3 is your=
window to trade subscriptions for ownership
HOLIDAY ATTENTION PLUS Q3 BU=
DGETS MAKES THIS THE IDEAL MOMENT. Instead
of renewing another year of Mi=
crosoft 365 for devices that only need
core desktop apps, you can lock in=
Office 2024 Home & Business as a
lifetime license and reduce your ongoin=
g SaaS footprint while this
special is live.=C2=A0
NEED HELP DECIDING H=
OW MANY SEATS TO MOVE?
Reply with how many PCs or Macs mostly run Word, E=
xcel, PowerPoint,
and Outlook for core work. I=E2=80=99ll send back a sim=
ple suggestion: how
many Office 2024 Home & Business licenses make sense =
to own vs. how
many should stay on subscription.
Request My Seat Owners=
hip Plan =E2=86=92
[http://enterprisesoftwaree.shop/mail/index.php/campai=
gns/ka947yfhsqb00/track-url/ht025qbmp024a/6e6b2145153f3f7331193690cfeb26994=
b8659b2]
One number =E2=80=94 your device count =E2=80=94 and I=E2=80=
=99ll outline a profitable
mix of owned vs. subscribed Office.
--------=
-----------------
Best,
{{SENDER_NAME}}
Office & Productivity Licensi=
ng
{{sender_email}} =C2=B7 {{sender_phone}}
P.S. This =E2=80=9CRed, Whi=
te, and Productive=E2=80=9D Office 2024 Home & Business
special is built =
to be highly convertible and profitable: one Q3
decision to own Office on=
key devices for life, reduce subscription
noise, and get a free App Stac=
k Health Check if you move before July
31.
Office 2024 Home & Business =
Holiday Modernization =C2=B7 Enterprise
Software Solutions
http://enter=
prisesoftwaree.shop/mail/index.php/lists/dz507epzaxc84/unsubscribe/ht025qbm=
p024a/ka947yfhsqb00=C2=A0=C2=B7
View in browser [/{{view_in_browser_url}}=
]
--_=_swift_1783628642_9d90d311907f0ea58f03c7a9384f99f2_=_
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: quoted-printable
=09
IDAY SPECIAL =C2=B7 ENDS JULY 31
-width, initial-scale=3D1.0"/>
=3D"IE=3Dedge"/>
aree.shop/mail/index.php/campaigns/ka947yfhsqb00/track-opening/ht025qbmp024=
a" alt=3D"" />
Y SPECIAL =C2=B7 ENDS JULY 31
Docusign phish from Google Gmail Part 3
Posted by Dave Yadallee onsrc=3D"https://docucdn-a.akamaihd.net/olive/images/2.62.=
0/global-assets/email-templates/email-logo.png" width=3D"116" />
src=3D"https://docucdn-a.akamaihd.net/olive/images/2.76.=
0/email/iconFileWithCheckWhite.png" width=3D"75" />
A document has been sent for your review
target=3D"_blank">View Document
Docusign phish from Google Gmail Part 1
Posted by Dave Yadallee on
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Thu, 09 Jul 2026 14:15:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))
(envelope-from)
id 1whv8Q-000000000kB-0ivr
for dave@doctor.nl2k.ab.ca;
Thu, 09 Jul 2026 14:14:14 -0600
Resent-From: The Doctor
Resent-Date: Thu, 9 Jul 2026 14:14:14 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-pl1-f231.google.com ([209.85.214.231]:47422)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.99.3 (FreeBSD))
(envelope-from)
id 1whuyp-00000000KZ7-3V7k
for root@nk.ca;
Thu, 09 Jul 2026 14:04:26 -0600
Received: by mail-pl1-f231.google.com with SMTP id d9443c01a7336-2cad4170e8eso1667895ad.3
for; Thu, 09 Jul 2026 13:03:31 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=sabeng.it; s=google; t=1783627406; x=1784232206; darn=nk.ca;
h=content-type:mime-version:date:content-transfer-encoding:message-id
:subject:to:from:from:to:cc:subject:date:message-id:reply-to
:content-type;
bh=CBCnKi6yFedusYVAYEog8Pbq6nVfckjxBILUJZflDog=;
b=XXluZxC2wBhKWzSVAKt92Q6gqwKBg28XUJJ5XaUt8M09VIUB7/8yIoMobT+ZJJzuVc
k9CiZAwk9HA2U+UWhuuFzDiMawhV4u/C77srDA9000cTnFYuV6vFyB6rHMkOAKEkYvoM
74s9it4Pj33ikGvAK6Q5k0TscALAk09KI9QN0=
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20251104; t=1783627406; x=1784232206;
h=content-type:mime-version:date:content-transfer-encoding:message-id
:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date
:message-id:reply-to:content-type;
bh=CBCnKi6yFedusYVAYEog8Pbq6nVfckjxBILUJZflDog=;
b=FguH8Xe+ckSY/YN2vQ3cTGO+TmYpSuEd2al2HoXz718YCszeRbLZGkBQ39BBiUQPkm
QU/vEpoJxfF9oMSPzBRJ4mVh9HG87hM4R0wF4KK/50DZXnn+ytFTdawvfy7DtDwduKzL
PfwChHolXySY4G1QEjzU1lQwjz65M7N49StLz1yDf8Us4BxAIK4bBOhclwonYkRRtHZK
1Awn1lwcGRycP6M6ykVYQcE+5wA3RzaFkB3Oct1r+2lTVGuQoz0ArG3RpUHfosfDPExT
F47nC5iUyzGp9g9RmzklqmAzuly3qpEE08bDPwwFBNUVn/yvDJ4n/qGKrKrBecWur7Dn
SnyQ==
X-Gm-Message-State: AOJu0YzJXcupT8DqoKoIGeOMkTngz7tRL2w3p/SLz5ZiEAGcKhQLxVa0
axneouA4RR8jcEQLL3X+2oRIsweeA3J1vPCIWoXGa2PgAecWGE/chFnl97s861JUidhDM9Xf5hF
gEyuxYbnbe+OMOL5UXufwgkAQSR1+ewZmN+YngDVSyX7t0bg=
X-Gm-Gg: AfdE7clRuXw17G+ZSZ0B95UIsFmbiwxTmAdAudUZ+sVy2gvb4MaC0STmnbTtsIbvsol
sejs5aGXCvsmXhsedj3yA+3dUOfVMTyVU+zMBZWrvRTgjGXjBzSwUcPd7Vg2jQaCrsBCtmCsOnR
e15PhALb39eBLgrZuoSHpOuLK9lXQW8kqVK8lRsD1CiCq9ClRet4pSiLdl9yBcbGQdIyvHb0pIj
7EhfRe98we64ybb0jzw98UY4HvUn7IUTWuGE6lGdgFMTRzslOaBrRUU6QYJDfsAN0xM3PVwGOFN
jAcQJFme9Lsd7jQK3c6RnBxvZquSw4fE/8bSRGcaKD9LfxHgD0C9E8ztNWCYOMPpiVsxglFBkmH
1H/SgZ3rGAgkPMfamIR+CRTmA
X-Received: by 2002:a17:903:1ad0:b0:2cc:307c:51f2 with SMTP id d9443c01a7336-2ccea444eaamr100960545ad.22.1783627405718;
Thu, 09 Jul 2026 13:03:25 -0700 (PDT)
Received: from sabprogetti.com ([192.210.236.148])
by smtp-relay.gmail.com with ESMTPS id d9443c01a7336-2ccc9ccd02esm8836255ad.31.2026.07.09.13.03.25
for
(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
Thu, 09 Jul 2026 13:03:25 -0700 (PDT)
X-Relaying-Domain: sabeng.it
From: "Incoming_Payment|Schedule| Online Review/OU=EXCHANGE ADMINISTRATIVE
GROUP (FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=B7A707497B564FD-82405"
To: root@nk.ca
Subject: =?UTF-8?Q?Review_the_Attached_Commercial_Invoice_D?=
=?UTF-8?Q?ocuments_=EF=BF=BD_07/09/2026_=EF=BF=BD_?=
=?UTF-8?Q?root=40nk=2Eca?=
Message-ID: <3f475e98-9361-3962-0a8b-cab42e1033b9@sabeng.it>
Content-Transfer-Encoding: quoted-printable
Date: Thu, 09 Jul 2026 20:03:24 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=utf-8
X-Spam_score: 6.1
X-Spam_score_int: 61
X-Spam_bar: ++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview:  A document has been sent for your review View Document
Please review the attached document at your convenience. Contact the sender
if you have questions.
Content analysis details: (6.1 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
[192.210.236.148 listed in dnsbl.ahbl.org]
[192.210.236.148 listed in dnsbl.ahbl.org]
[192.210.236.148 listed in dnsbl.ahbl.org]
[209.85.214.231 listed in dnsbl.ahbl.org]
[209.85.214.231 listed in dnsbl.ahbl.org]
[209.85.214.231 listed in dnsbl.ahbl.org]
[209.85.214.231 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[209.85.214.231 listed in will-spam-for-food.eu.org]
[209.85.214.231 listed in will-spam-for-food.eu.org]
[209.85.214.231 listed in will-spam-for-food.eu.org]
[209.85.214.231 listed in will-spam-for-food.eu.org]
[209.85.214.231 listed in will-spam-for-food.eu.org]
[209.85.214.231 listed in will-spam-for-food.eu.org]
[209.85.214.231 listed in will-spam-for-food.eu.org]
[209.85.214.231 listed in will-spam-for-food.eu.org]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.214.231 listed in list.dnswl.org]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |]
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |]
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[209.85.214.231 listed in bl.score.senderscore.com]
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.214.231 listed in wl.mailspike.net]
-0.0 SPF_PASS SPF: sender matches SPF record
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars
0.0 NO_RDNS2 Sending MTA has no reverse DNS
0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag
Subject: {SPAM?} =?UTF-8?Q?Review_the_Attached_Commercial_Invoice_D?=
=?UTF-8?Q?ocuments_=EF=BF=BD_07/09/2026_=EF=BF=BD_?=
=?UTF-8?Q?root=40nk=2Eca?=
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Thu, 09 Jul 2026 14:15:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))
(envelope-from
id 1whv8Q-000000000kB-0ivr
for dave@doctor.nl2k.ab.ca;
Thu, 09 Jul 2026 14:14:14 -0600
Resent-From: The Doctor
Resent-Date: Thu, 9 Jul 2026 14:14:14 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-pl1-f231.google.com ([209.85.214.231]:47422)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.99.3 (FreeBSD))
(envelope-from
id 1whuyp-00000000KZ7-3V7k
for root@nk.ca;
Thu, 09 Jul 2026 14:04:26 -0600
Received: by mail-pl1-f231.google.com with SMTP id d9443c01a7336-2cad4170e8eso1667895ad.3
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=sabeng.it; s=google; t=1783627406; x=1784232206; darn=nk.ca;
h=content-type:mime-version:date:content-transfer-encoding:message-id
:subject:to:from:from:to:cc:subject:date:message-id:reply-to
:content-type;
bh=CBCnKi6yFedusYVAYEog8Pbq6nVfckjxBILUJZflDog=;
b=XXluZxC2wBhKWzSVAKt92Q6gqwKBg28XUJJ5XaUt8M09VIUB7/8yIoMobT+ZJJzuVc
k9CiZAwk9HA2U+UWhuuFzDiMawhV4u/C77srDA9000cTnFYuV6vFyB6rHMkOAKEkYvoM
74s9it4Pj33ikGvAK6Q5k0TscALAk09KI9QN0=
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20251104; t=1783627406; x=1784232206;
h=content-type:mime-version:date:content-transfer-encoding:message-id
:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date
:message-id:reply-to:content-type;
bh=CBCnKi6yFedusYVAYEog8Pbq6nVfckjxBILUJZflDog=;
b=FguH8Xe+ckSY/YN2vQ3cTGO+TmYpSuEd2al2HoXz718YCszeRbLZGkBQ39BBiUQPkm
QU/vEpoJxfF9oMSPzBRJ4mVh9HG87hM4R0wF4KK/50DZXnn+ytFTdawvfy7DtDwduKzL
PfwChHolXySY4G1QEjzU1lQwjz65M7N49StLz1yDf8Us4BxAIK4bBOhclwonYkRRtHZK
1Awn1lwcGRycP6M6ykVYQcE+5wA3RzaFkB3Oct1r+2lTVGuQoz0ArG3RpUHfosfDPExT
F47nC5iUyzGp9g9RmzklqmAzuly3qpEE08bDPwwFBNUVn/yvDJ4n/qGKrKrBecWur7Dn
SnyQ==
X-Gm-Message-State: AOJu0YzJXcupT8DqoKoIGeOMkTngz7tRL2w3p/SLz5ZiEAGcKhQLxVa0
axneouA4RR8jcEQLL3X+2oRIsweeA3J1vPCIWoXGa2PgAecWGE/chFnl97s861JUidhDM9Xf5hF
gEyuxYbnbe+OMOL5UXufwgkAQSR1+ewZmN+YngDVSyX7t0bg=
X-Gm-Gg: AfdE7clRuXw17G+ZSZ0B95UIsFmbiwxTmAdAudUZ+sVy2gvb4MaC0STmnbTtsIbvsol
sejs5aGXCvsmXhsedj3yA+3dUOfVMTyVU+zMBZWrvRTgjGXjBzSwUcPd7Vg2jQaCrsBCtmCsOnR
e15PhALb39eBLgrZuoSHpOuLK9lXQW8kqVK8lRsD1CiCq9ClRet4pSiLdl9yBcbGQdIyvHb0pIj
7EhfRe98we64ybb0jzw98UY4HvUn7IUTWuGE6lGdgFMTRzslOaBrRUU6QYJDfsAN0xM3PVwGOFN
jAcQJFme9Lsd7jQK3c6RnBxvZquSw4fE/8bSRGcaKD9LfxHgD0C9E8ztNWCYOMPpiVsxglFBkmH
1H/SgZ3rGAgkPMfamIR+CRTmA
X-Received: by 2002:a17:903:1ad0:b0:2cc:307c:51f2 with SMTP id d9443c01a7336-2ccea444eaamr100960545ad.22.1783627405718;
Thu, 09 Jul 2026 13:03:25 -0700 (PDT)
Received: from sabprogetti.com ([192.210.236.148])
by smtp-relay.gmail.com with ESMTPS id d9443c01a7336-2ccc9ccd02esm8836255ad.31.2026.07.09.13.03.25
for
(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
Thu, 09 Jul 2026 13:03:25 -0700 (PDT)
X-Relaying-Domain: sabeng.it
From: "Incoming_Payment|Schedule| Online Review/OU=EXCHANGE ADMINISTRATIVE
GROUP (FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=B7A707497B564FD-82405"
To: root@nk.ca
Subject: =?UTF-8?Q?Review_the_Attached_Commercial_Invoice_D?=
=?UTF-8?Q?ocuments_=EF=BF=BD_07/09/2026_=EF=BF=BD_?=
=?UTF-8?Q?root=40nk=2Eca?=
Message-ID: <3f475e98-9361-3962-0a8b-cab42e1033b9@sabeng.it>
Content-Transfer-Encoding: quoted-printable
Date: Thu, 09 Jul 2026 20:03:24 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=utf-8
X-Spam_score: 6.1
X-Spam_score_int: 61
X-Spam_bar: ++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview:  A document has been sent for your review View Document
Please review the attached document at your convenience. Contact the sender
if you have questions.
Content analysis details: (6.1 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
[192.210.236.148 listed in dnsbl.ahbl.org]
[192.210.236.148 listed in dnsbl.ahbl.org]
[192.210.236.148 listed in dnsbl.ahbl.org]
[209.85.214.231 listed in dnsbl.ahbl.org]
[209.85.214.231 listed in dnsbl.ahbl.org]
[209.85.214.231 listed in dnsbl.ahbl.org]
[209.85.214.231 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[209.85.214.231 listed in will-spam-for-food.eu.org]
[209.85.214.231 listed in will-spam-for-food.eu.org]
[209.85.214.231 listed in will-spam-for-food.eu.org]
[209.85.214.231 listed in will-spam-for-food.eu.org]
[209.85.214.231 listed in will-spam-for-food.eu.org]
[209.85.214.231 listed in will-spam-for-food.eu.org]
[209.85.214.231 listed in will-spam-for-food.eu.org]
[209.85.214.231 listed in will-spam-for-food.eu.org]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.214.231 listed in list.dnswl.org]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[209.85.214.231 listed in bl.score.senderscore.com]
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.214.231 listed in wl.mailspike.net]
-0.0 SPF_PASS SPF: sender matches SPF record
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars
0.0 NO_RDNS2 Sending MTA has no reverse DNS
0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag
Subject: {SPAM?} =?UTF-8?Q?Review_the_Attached_Commercial_Invoice_D?=
=?UTF-8?Q?ocuments_=EF=BF=BD_07/09/2026_=EF=BF=BD_?=
=?UTF-8?Q?root=40nk=2Eca?=
Docusign phish from Google Gmail part 3
Posted by Dave Yadallee onsrc=3D"https://docucdn-a.akamaihd.net/olive/images/2.62.=
0/global-assets/email-templates/email-logo.png" width=3D"116" />
src=3D"https://docucdn-a.akamaihd.net/olive/images/2.76.=
0/email/iconFileWithCheckWhite.png" width=3D"75" />
A document has been sent for your review
target=3D"_blank">View Document
Docusign phish from Google Gmail part 2
Posted by Dave Yadallee on
=EF=BB=BF
name=3D"viewport" />
name=3D"viewport" />