iPhone Paypal phish from Google Gmail Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 25 Feb 2026 16:27:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vvOH4-000000005W8-0mNh

for dave@doctor.nl2k.ab.ca;

Wed, 25 Feb 2026 16:26:34 -0700

Resent-From: The Doctor

Resent-Date: Wed, 25 Feb 2026 16:26:34 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ot1-f74.google.com ([209.85.210.74]:58504)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vvKsq-00000000AUY-1qAh

for root@doctor.nl2k.ab.ca;

Wed, 25 Feb 2026 12:49:30 -0700

Received: by mail-ot1-f74.google.com with SMTP id 46e09a7af769-7d194b631d6so101648337a34.0

for ; Wed, 25 Feb 2026 11:48:33 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=google.com; s=20230601; t=1772048908; x=1772653708; darn=doctor.nl2k.ab.ca;

h=from:subject:date:message-id:sender:reply-to:mime-version:from:to

:cc:subject:date:message-id:reply-to;

bh=fkLYrUF273UxN1KnL6coedgI+Zo8V27wCw+PndtcrV4=;

b=QNf0uPXucYWYcyxW8zIh66RnQhF7546Ygn/evB8T3krzeenupSkcV0nSgBHWbOkIWt

8pFRv9OTaUPjUXBgAy25x08v4JgKhmw9gDFBO4rcv/EtVpM1qm+b96KrUgXHxDUXR3+7

RMWT5vmOTfO3NRKgOBccsFQTVyND1NKUSAbTJ/6QcEod4XyIyJlwVSo9USFzGpb7FJjg

erLWrszCYa+i3c6IFh78Qkk1AvXFONBYFWQ+XU055C7sQQWvMZVeN4FG/9eertG0OQRr

fcgGFpMOFBkw5GcxIRVm2saKEs8J2R8TBnicQY1XD/K8ung8cfsQlfIrqDD7qdiYD8Aw

3/qA==

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=noatwm-org.20230601.gappssmtp.com; s=20230601; t=1772048908; x=1772653708; darn=doctor.nl2k.ab.ca;

h=from:subject:date:message-id:sender:reply-to:mime-version:from:to

:cc:subject:date:message-id:reply-to;

bh=fkLYrUF273UxN1KnL6coedgI+Zo8V27wCw+PndtcrV4=;

b=gjKdNoJK3xCS1308jMmNSF7A1HFr3YKEiz7aJDe6Gryfr50xZn/bRRNdeu2velfpno

s7hYzs/QnRl3c7C0AMubn9nN7HcFg8CMaYcJMLJE4ZAMndJbcr24+hPmBWEJQCvjhGmK

7EINOJ1/1Y/Zu/8vJ5rh78mz8xisaqDV6+BRIZi6cwJ0JD3hDN/sUxYUg8ES7/uG/s7t

8z5jLTCz7QPDNF97NOgVyK4XXTDnIHYenvKv7Rl9mFjhf/4FGQgszeayh4DE7CcBvIpy

LAAjjyEnWHuWAFByMbcbhsRhCOlqSPzhzJ17ZvyfZwpZZNlM1RaXz059idoqzyoAH2Z8

Mc2A==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1772048908; x=1772653708;

h=from:subject:date:message-id:sender:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=fkLYrUF273UxN1KnL6coedgI+Zo8V27wCw+PndtcrV4=;

b=hxEVsyzrwZLySXH6MLqHXGobp+oUL56UqR3kzAjlVdkGIig8LL0PrbE981pUXHGcFk

5Guc+O9uxtbEqGBoNu4pTMkA2EAoaLAiJHtb5z5HtwAmv3nQevy7A8eEgceHXue09ZMg

XZrMh8aNvN4E9lztT8gR7D+TDbS1TpKPbPlWuM5w9fHH6LpVhDGq+HaJVCdoNDkdNaBz

+JtHdt4XjzL3ws6E7KRfojfuztZDo/a1XaGukJhvo5gALQ2ZqzBpjIu3/Em3Fuke1mIo

z0Hfk6cd49vMjtzsR3gWGbO7jmroz32ZI8GsWaJjG+G9AIFWQK9tOUKiFgIYjy4GIkOv

ePYA==

X-Forwarded-Encrypted: i=1; AJvYcCU2X2Ht3BcxSzJEZe9pj7iNBWlgv2lEiH8yk5qRqpkwZU6bl1mnOtpPCWCCqGIaTFBPRDJN@doctor.nl2k.ab.ca

X-Gm-Message-State: AOJu0Yw9s4V2e6mh/E6xPr4uovj+HSAP7xb0b4gtMr3NcqrxtLBMrZBh

Wj3NsLcQOiIdYXJqwjG67X3gA+7Yo4Df8UAaPPnFSdr4uMusDRJhrBcShV5x0RtEAe4khQvT2DT

FygQ0UPmlryCwFrn02MDgJc5zb93M6AP78fIT0+rYcxUkhw==

MIME-Version: 1.0

X-Received: by 2002:a05:6830:6c11:b0:7d4:9d6f:2b5c with SMTP id

46e09a7af769-7d52be444admt15938383a34.12.1772048907702; Wed, 25 Feb 2026

11:48:27 -0800 (PST)

Reply-To: Joseph Hornyak

Sender: Google Calendar

Message-ID:

Date: Wed, 25 Feb 2026 19:48:27 +0000

Subject: Payment confirmation for Invoice available

From: Joseph Hornyak

Content-Type: multipart/alternative; boundary="000000000000aeae0a064bab49ac"

X-Spam_score: 12.8

X-Spam_score_int: 128

X-Spam_bar: ++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: 2026-02-26 Bill: 376-OVFC-ZPJ Reference Number: 75297844 We

have recorded your recent order. Good day, we’re glad to confirm your recent

purchase from PayPal. Your payment has been received and the [...]



Content analysis details: (12.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.210.74 listed in list.dnswl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.210.74 listed in will-spam-for-food.eu.org]

[209.85.210.74 listed in will-spam-for-food.eu.org]

[209.85.210.74 listed in will-spam-for-food.eu.org]

[209.85.210.74 listed in will-spam-for-food.eu.org]

[209.85.210.74 listed in will-spam-for-food.eu.org]

[209.85.210.74 listed in will-spam-for-food.eu.org]

[209.85.210.74 listed in will-spam-for-food.eu.org]

[209.85.210.74 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.210.74 listed in dnsbl.ahbl.org]

[209.85.210.74 listed in dnsbl.ahbl.org]

[209.85.210.74 listed in dnsbl.ahbl.org]

[209.85.210.74 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.210.74 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.210.74 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.210.74 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.210.74 listed in dnsbl.ahbl.org]

1.2 MISSING_HEADERS Missing To: header

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.210.74 listed in wl.mailspike.net]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 LOTS_OF_MONEY Huge... sums of money

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

1.9 REPLYTO_WITHOUT_TO_CC No description available.

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.6 LONG_INVISIBLE_TEXT Long block of hidden text - bayes poison?

Subject: {SPAM?} Payment confirmation for Invoice available



--000000000000aeae0a064bab49ac

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes

Content-Transfer-Encoding: base64



MjAyNi0wMi0yNiBCaWxsOiAzNzYtT1ZGQy1aUEogUmVmZXJlbmNlIE51bWJlcjogNzUyOTc4NDQg

V2UgaGF2ZSByZWNvcmRlZCAgDQp5b3VyIHJlY2VudCBvcmRlci4gR29vZCBkYXksIHdl4oCZcmUg

Z2xhZCB0byBjb25maXJtIHlvdXIgcmVjZW50IHB1cmNoYXNlICANCmZyb20gUGF5UGFsLiBZb3Vy

IHBheW1lbnQgaGFzIGJlZW4gcmVjZWl2ZWQgYW5kIHRoZSBvcmRlciBpcyBub3cgc2NoZWR1bGVk

ICANCmZvciBwcm9jZXNzaW5nLiBCZWxvdyBhcmUgdGhlIHRyYW5zYWN0aW9uIGRldGFpbHM6IFRy

YW5zYWN0aW9uIERldGFpbHM6ICANCkl0ZW06IGlQaG9uZSAxNyBQcm8gUXVhbnRpdHk6IDF4IFBh

eW1lbnQgTWV0aG9kOiBQYXlQYWwgVG90YWwgQW1vdW50OiAgDQokMTEwMS43NyBGb3IgZnVydGhl

ciBhc3Npc3RhbmNlLCBwbGVhc2UgY29ubmVjdCB3aXRoIG91ciB0ZWFtIHVzaW5nIHRoZSAgDQpj

b250YWN0IGRldGFpbHMgYmVsb3cuIE9yZGVycyBjYW4gYmUgY2FuY2VsZWQgd2l0aGluIDI0IGhv

dXJzIGJ5IGNhbGxpbmcgIA0KMXs4NjN9IDQwOS01MjE4LiDCqSAyMDI1IFBheVBhbCBMTEMg4oCT

IEFsbCByaWdodHMgIA0KcmVzZXJ2ZWQuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g

LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu

IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g

LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu

IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g

LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu

IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuDQoN

ClBheW1lbnQgY29uZmlybWF0aW9uIGZvciBJbnZvaWNlIGF2YWlsYWJsZQ0KV2VkbmVzZGF5IEZl

YiAyNSDii4UgMTFwbSDigJMgVGh1cnNkYXkgRmViIDI2LCAyMDI2IOKLhSAxMDozMHBtDQpDZW50

cmFsIFRpbWUgLSBDaGljYWdvDQoNCg0KDQpPcmdhbml6ZXINCkpvc2VwaCBIb3JueWFrDQpzZWRh

MTk5Njg5QG5vYXR3bS5vcmcNCg0K

--000000000000aeae0a064bab49ac

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable

Web/SEO/App spam from Microsoft Outlook Part 3




ont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; =

color: rgb(0, 0, 0);" class=3D"elementToProof">

We are an Indian based Website Design & Development =

;Company with PHP Development that offers services at a modest ra=

te. 



ont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; =

color: rgb(0, 0, 0);" class=3D"elementToProof">

 



ont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; =

color: rgb(0, 0, 0);" class=3D"elementToProof">

We have a dedicated team of professional designers and developers with many=

years of experience and we thrive on the idea that design makes a differen=

ce.



ont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; =

color: rgb(0, 0, 0);" class=3D"elementToProof">

 



ont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; =

color: rgb(0, 0, 0);" class=3D"elementToProof">

Our Services at a Glance: -



ont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; =

color: rgb(0, 0, 0);" class=3D"elementToProof">

 





  • alibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); margin=

    : 0cm 0cm 0.0001pt 18pt;">

    Web Design using PSD to HTML,

  • beddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size:=

    12pt; color: rgb(0, 0, 0); margin: 0cm 0cm 0.0001pt 18pt;">

    Design Templates - Layout

  • edFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12p=

    t; color: rgb(0, 0, 0); margin: 0cm 0cm 0.0001pt 18pt;">

    Custom Tailored PHP Applications

  • _EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-si=

    ze: 12pt; color: rgb(0, 0, 0); margin: 0cm 0cm 0.0001pt 18pt;">

    Customized Template Design

  • dedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12=

    pt; color: rgb(0, 0, 0); margin: 0cm 0cm 0.0001pt 18pt;">

    Re-Design & Development

  • _EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-si=

    ze: 12pt; color: rgb(0, 0, 0); margin: 0cm 0cm 0.0001pt 18pt;">

    Custom CMS (Content Management System)

  • Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; f=

    ont-size: 12pt; color: rgb(0, 0, 0); margin: 0cm 0cm 0.0001pt 18pt;">

    E-commerce Website Design

  • tos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font=

    -size: 12pt; color: rgb(0, 0, 0); margin: 0cm 0cm 0.0001pt 18pt;">

    Payment Gateway Integration

  • ddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 1=

    2pt; color: rgb(0, 0, 0); margin: 0cm 0cm 0.0001pt 18pt;">

    Custom Mobile Apps & More Info=85.



ont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; =

color: rgb(0, 0, 0);" class=3D"elementToProof">

 



ont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; =

color: rgb(0, 0, 0);" class=3D"elementToProof">

If you are interested, then please share your requirements so tha=

t I can suggest you a solution in accordance.



ont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; =

color: rgb(0, 0, 0);" class=3D"elementToProof">

 



ont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; =

color: rgb(0, 0, 0);" class=3D"elementToProof">

Looking forward to hear you from your side.



ont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; =

color: rgb(0, 0, 0);" class=3D"elementToProof">

 



ont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; =

color: rgb(0, 0, 0);" class=3D"elementToProof">

 



ont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; =

color: rgb(0, 0, 0);" class=3D"elementToProof">

Warm Regards,



ont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; =

color: rgb(0, 0, 0);" class=3D"elementToProof">

Ravi



ont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; =

color: rgb(0, 0, 0);" class=3D"elementToProof">

Marketing Manager (India)



Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=

s=3D"elementToProof">












--_000_TYZPR04MB71779E694389C305EDB7E9F7BC75ATYZPR04MB7177apcp_--

Web/SEO/App spam from Microsoft Outlook Part 2

Content analysis details: (7.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[2603:1096:400:458:0:0:0:5 listed in]

[will-spam-for-food.eu.org]

[2603:1096:400:458:0:0:0:5 listed in]

[will-spam-for-food.eu.org]

[2603:1096:400:458:0:0:0:5 listed in]

[will-spam-for-food.eu.org]

[2603:1096:400:458:0:0:0:5 listed in]

[will-spam-for-food.eu.org]

[2603:1096:400:458:0:0:0:5 listed in]

[will-spam-for-food.eu.org]

[2603:1096:400:458:0:0:0:5 listed in]

[will-spam-for-food.eu.org]

[2603:1096:400:458:0:0:0:5 listed in]

[will-spam-for-food.eu.org]

[2603:1096:400:458:0:0:0:5 listed in]

[will-spam-for-food.eu.org]

[52.103.66.54 listed in will-spam-for-food.eu.org]

[52.103.66.54 listed in will-spam-for-food.eu.org]

[52.103.66.54 listed in will-spam-for-food.eu.org]

[52.103.66.54 listed in will-spam-for-food.eu.org]

[52.103.66.54 listed in will-spam-for-food.eu.org]

[52.103.66.54 listed in will-spam-for-food.eu.org]

[52.103.66.54 listed in will-spam-for-food.eu.org]

[52.103.66.54 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[52.103.66.54 listed in dnsbl.ahbl.org]

[52.103.66.54 listed in dnsbl.ahbl.org]

[52.103.66.54 listed in dnsbl.ahbl.org]

[52.103.66.54 listed in dnsbl.ahbl.org]

[2603:1096:400:458:0:0:0:5 listed in]

[dnsbl.ahbl.org]

[2603:1096:400:458:0:0:0:5 listed in]

[dnsbl.ahbl.org]

[2603:1096:400:458:0:0:0:5 listed in]

[dnsbl.ahbl.org]

[2603:1096:400:458:0:0:0:5 listed in]

[dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[52.103.66.54 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[52.103.66.54 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[52.103.66.54 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[52.103.66.54 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

1.2 MISSING_HEADERS Missing To: header

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[ravi.web288(at)outlook.com]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[ravi.web288(at)outlook.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[52.103.66.54 listed in wl.mailspike.net]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.4 MALFORMED_FREEMAIL Bad headers on message from free email service

Subject: {SPAM?} Re-Design & Development!!



--_000_TYZPR04MB71779E694389C305EDB7E9F7BC75ATYZPR04MB7177apcp_

Content-Type: text/plain; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable



Dear,



Hope you are doing well.



We are an Indian based Website Design & Development Company with PHP Develo=

pment that offers services at a modest rate.



We have a dedicated team of professional designers and developers with many=

years of experience and we thrive on the idea that design makes a differen=

ce.



Our Services at a Glance: -





Web Design using PSD to HTML,

Design Templates - Layout

Custom Tailored PHP Applications

Customized Template Design

Re-Design & Development

Custom CMS (Content Management System)

E-commerce Website Design

Payment Gateway Integration

* Custom Mobile Apps & More Info=85.





If you are interested, then please share your requirements so that I can su=

ggest you a solution in accordance.



Looking forward to hear you from your side.





Warm Regards,

Ravi

Marketing Manager (India)





--_000_TYZPR04MB71779E694389C305EDB7E9F7BC75ATYZPR04MB7177apcp_

Content-Type: text/html; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable








252">








ont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; =

color: rgb(0, 0, 0);" class=3D"elementToProof">

Dear,



ont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; =

color: rgb(0, 0, 0);" class=3D"elementToProof">

 



ont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; =

color: rgb(0, 0, 0);" class=3D"elementToProof">

Hope you are doing well.



ont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; =

color: rgb(0, 0, 0);" class=3D"elementToProof">

 

Web/SEO/App spam from Microsoft Outlook Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 25 Feb 2026 11:28:00 -0700

Received: from mail-japanwestazolkn19012054.outbound.protection.outlook.com ([52.103.66.54]:34277 helo=OS8PR02CU002.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vvJbB-00000000LAG-30JA

for dave@doctor.nl2k.ab.ca;

Wed, 25 Feb 2026 11:27:13 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=nwPTvMdWKLSdgx6tOYIml48ChfmhmGGQcLK005Ie+JZm2AaQeOehB6KaOv3kCE8WDbo2ziu4V9PACYlOF2nPGSLHhgnzTpJrsfSvoIOGgxEyvBkmENx/Cg5fNitF9emV5EghlddI7yF/lPPl7XPj2bRwtnNkJRsy7KGd5hQJOryy0MauDTtXcuBbXr1M8L2pc43PEDfzPwEMrYs5BKZcPijRxbtp7VJdiXpQo2QEzBS0n34jsZMVUX8CNgVdvgzC9yapJ/sGwP1KaDMCNMi1CJyMlzB8lb93UPr5jJNdZA2DCbOsW9jvJ3ad6xLRW08p8+DGbXIWgJ6cx+QJJUKL4A==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=OISx9kS5gfvde6JDa7Q/4/PmpSIjpT0l0ru8GACDq0Q=;

b=rR/H6Pxk8084e++WWwrBcwUZQSLYkXxqAdHaOW/E50mB0igW8qvMb7x8ndpW0tfZpBTJ7UZNj5fu3I3c9nIui9wi/psGbEyNRxzV1wxcYM5ffWI6yF5PMRWmrJIKFk+mp+6oAIOjNZ8Au5VbedMEwOtCzwLw2osS/RLHbmuRPIcIt+zYspD+/wgVo8emSHAIYd7bI2DnFJM6XFDSfAtd84qMAHw7UnWNEznPXP4St6bRF/N+OMIlHZzytDzCcezLC0RYfYrWddTZ7OQ8Rye2B6bFBO/fkmFyEbtCEoAzkRXCfLpF0Zkz5bafzUo79W0PJON1MgfIocvJz8vIvKnbFg==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=OISx9kS5gfvde6JDa7Q/4/PmpSIjpT0l0ru8GACDq0Q=;

b=GNWSbFJ5GpzRhNzsbnXXQa0D4b71bj2IxdNXmTOWwE/KIWfgKSgP2xpMaPlM1qf7WYRSuyMB5fuNzZ4DHdi/BsTIVPzlYm1uePwiBXp9lbE1G5RGs3CsIuFxPGB1M0BoFOKVdEd4QNInCIoVfpRnSy6dIviN1NkRJ6rp7F6tsoDQ8nGmgA85qup8+j9XHz2PRVTCbB6W0G635wZd+WhvurYAhKvnih9FyosE2pK6/JT9OmojWMZEb21Dxs4XENMIb6YhxYLfhkAB5VCz6uOaFt53fm66tyOMVgrJcykXWoLsu32uCh67b9GSeyYnxjhlZFI/y8+uN5iEKaAxdbGs7A==

Received: from TYZPR04MB7177.apcprd04.prod.outlook.com (2603:1096:400:458::5)

by SI6PR04MB7927.apcprd04.prod.outlook.com (2603:1096:4:24b::12) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9654.13; Wed, 25 Feb

2026 18:25:47 +0000

Received: from TYZPR04MB7177.apcprd04.prod.outlook.com

([fe80::a5e7:6830:ceaa:f776]) by TYZPR04MB7177.apcprd04.prod.outlook.com

([fe80::a5e7:6830:ceaa:f776%4]) with mapi id 15.20.9632.017; Wed, 25 Feb 2026

18:25:47 +0000

From: Ravi Sharma

Subject: Re-Design & Development!!

Thread-Topic: Re-Design & Development!!

Thread-Index: AQHcpoQpaSbwbaVbGUW45GZ3r4H7ug==

Date: Wed, 25 Feb 2026 18:25:47 +0000

Message-ID:



Accept-Language: en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

msip_labels:

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: TYZPR04MB7177:EE_|SI6PR04MB7927:EE_

x-ms-office365-filtering-correlation-id: 576618e3-fc3a-4b57-4d9c-08de749b4be8

x-microsoft-antispam:

BCL:0;ARA:14566002|19110799012|8062599012|8060799015|20031999003|39105399006|12121999013|461199028|31061999003|15030799006|15080799012|56899033|40105399003|51015399003|3412199025|440099028|102099032;

x-microsoft-antispam-message-info:

=?Windows-1252?Q?4J7GD5mJ8hmJnCRkyawmAROlnjQS83dqLFb0MrLAgiTDaaW1qCw6SgV2?=

=?Windows-1252?Q?5EQcK8DHYttJP2bpDWgyOk/wad9CwwofjwPKNOx8ZToTkwqHOavchDHW?=

=?Windows-1252?Q?roDcq54j7gxde5W4h7bDJVUPL4s7iw1XzVhJY08PXBKCou7IGof7h0Z7?=

=?Windows-1252?Q?6Y4yGb2nOrjRzWlu15ksK81P6I6eB7TsiJAC9o50tPFMtRRkjo/uz0XT?=

=?Windows-1252?Q?MWpPVqq2C8+pXw+bUeOqQCY1nCf4cFdYbwiEzNXj/i739F1t+OUIFrRQ?=

=?Windows-1252?Q?O3HF9GgHJmOgN3SYARcthFE8myA+wjx9JvQ9raoMCgN6fliJitfC/0cv?=

=?Windows-1252?Q?0O4q5qbikNU2hGm7ll70LjgDqspuj9MC84gRq+mGGa2yo3vNraDbb8O2?=

=?Windows-1252?Q?x1dtL3Nw5OEkwK1fCaQ6NATojGG+y7aDdqRmEGnvAaT5YHzgcbDEeDOT?=

=?Windows-1252?Q?Y2bqkI8eCEcaPLF7J7eMs9QaBC8YDsTotqoaHnPuAk7Ql9CFa/45+3Gn?=

=?Windows-1252?Q?o8ctaH6UUqi4N1NLXK8vfKrYfRM7+6SQyHpqP0VpKhwNnrt07lgtr2df?=

=?Windows-1252?Q?nGUYeHs0SxDqtjJl9FgmWEBiD+vHIekQToJiPu+NyG0fwKWeIn9nTuVq?=

=?Windows-1252?Q?N9iRlzlnV5wWzmp7L+dB5JtSSAcYPZOj+T8uZwXLUswUU48DnRB6SaPu?=

=?Windows-1252?Q?zeGsxE2YQfDKPcyGZLP8XmC5EobSv94Ow0g50le2le8f/JkMyu7tD8px?=

=?Windows-1252?Q?GNewm6Pr0g0Ax9d6gH7+HCg6kjiIRXVXlOASdi5ZnmxqNDW3uf4hGUxM?=

=?Windows-1252?Q?6OHzMthbDzQyFEfXD1y5m0AZ5F1jZOgUtBt0l0TDfGkuKPkjwy376TWb?=

=?Windows-1252?Q?nIq+IIOC3WWmqzfti8mmKUF1/W8yIJmcr+N0cuyGwG9syASLndrzYlHa?=

=?Windows-1252?Q?3iPDCKOtMn93t/ZZN/8F+12r1zuqlUgvN91banveJDCzr+vIxtwl9l9X?=

=?Windows-1252?Q?HXy5yJSwbqQ97HVyWIxumhbK0riNMpSneyPhemc+tIUBhHoat7/jBk50?=

=?Windows-1252?Q?rb3rIWobwwcvpoPG+V0ha/FjvQCQpcmZAy2FtfULCRM62UvjXDYZ6kIo?=

=?Windows-1252?Q?RQc=3D?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?Windows-1252?Q?5/XrrJpUgH7AbJYLvPnGp0okCu/8v+VqvnAExVNHyXHHmbZxnGYHqNDf?=

=?Windows-1252?Q?6G7Rqh9QHy5vQ3SE8HzuDENq6wiwNEtJK9lbIua/DLe3UKw5UmFjiuWT?=

=?Windows-1252?Q?yEZ2LEfTthdrj3bbcJ4eD/AfaK2CB+YSmBi5hLdcaluV2XhSO8Raga9e?=

=?Windows-1252?Q?SylbL15YgorUb48ZmD/rIHo6PKZnQyxkRBbxK5foSYGL7BUEzK+Rqkfa?=

=?Windows-1252?Q?CRKNfOp9M/N1E6jcx4LqncE2yoC8Sw5raln5U59w49j1Srzqhi0qGoJl?=

=?Windows-1252?Q?rm0wOv8VeaWJK2KeX9t7ToeKhcQmSuW1kCUhlCTp3mwAFdyqgFUWR+N6?=

=?Windows-1252?Q?r59gD1JQiful8zakCSaqDm7GKmJl5sCxiC0CbecBLfb9lgajgXdelq7k?=

=?Windows-1252?Q?wxlaFQmx2CR76v/JG6Jhj1fPSyy9a5Zxc77IS2cBb422lrIk7g9oyRXR?=

=?Windows-1252?Q?kwKbrV6dtqShdhUC3Y0PHzG9qDRWO3wGJPzamdIXHM9EiTX+DRgqxtV/?=

=?Windows-1252?Q?RGV6t/6D/WtAovgcx2X1Cwk9txcWcXBIhRru3nRHZ9GalASEMFZboDv+?=

=?Windows-1252?Q?kgbGfSoji7Fkk0hPcZCrNwY9kbTQFPvbrKvZuaHBOVde9xY4sO31Wwx9?=

=?Windows-1252?Q?k+SdGxoYRMpXYWphaJKim1ssmS5BO+LQX4zV2u33M6r6O3bgeDkExhAH?=

=?Windows-1252?Q?q+dhlEbSrIWPCX/IEWi0cSC2uE/tvODfNPj+DwayQ4jjWicttywoI6A1?=

=?Windows-1252?Q?wYYfTLXDB0rOrCoMTa47qUV10Dj72ZJUIGHcNjXTxiGV5qeJBni5QbfO?=

=?Windows-1252?Q?XdWTruSn8BrDPqt9mB/HCFXkp0Dy4ceur3QhE6OlRCjcbiizTLLSkLyQ?=

=?Windows-1252?Q?zrBqX7eaOq6JBKlFyybXX3pHLGxsHCBJVVYcWNOapwDAqBSVNkyAmZ/r?=

=?Windows-1252?Q?Ne4BC3pYtCmFuHf3KQ4IF6al/KtrTGOZxDX3OerHETKps2c6ubTzLsOX?=

=?Windows-1252?Q?U5v1dhETsU5WvWy5y5TrEE9dHGF/a7/b6w3wNr+lCNOYbOguoHaK4jpi?=

=?Windows-1252?Q?M0Hx0NDMKChDDQ17s1/gqQvxZ0hboLcBX6T0cagbA5Plz0Th7h8T8Ukv?=

=?Windows-1252?Q?TZ3n9t0Xx4AEr+WUV0Gjs9zmhFD3hwazPQu60+z3fJuozfaVW+PENcf4?=

=?Windows-1252?Q?Fsan7wddfrDbBqZTfkDsTIUdKPHtKl/f41BYM9kv3yN0NFAYt/ruVJ8g?=

=?Windows-1252?Q?4/rWFpz0du1T3hYTxQqtJfRFT9b1+pdfYwaxvpss5ZcasYky51We1m0w?=

=?Windows-1252?Q?0kq4Y4bgDE35AJUCZGN598uTuLG8rUzjdkPaHBBbHvlqQry8anjCoZ85?=

=?Windows-1252?Q?0mD0BHZ+QSN4dHjNRLW2AxY0wH8p0uzWCI/BPHG3qJbXgPg9FfU3sNrC?=

=?Windows-1252?Q?TqtwlY3xL7GpFQ4Ut2iltJKabyNW9SecbWM9CZxDd/gYzlm1TweeG3wo?=

=?Windows-1252?Q?YWGj4W79?=

Content-Type: multipart/alternative;

boundary="_000_TYZPR04MB71779E694389C305EDB7E9F7BC75ATYZPR04MB7177apcp_"

MIME-Version: 1.0

X-OriginatorOrg: outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: TYZPR04MB7177.apcprd04.prod.outlook.com

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: 576618e3-fc3a-4b57-4d9c-08de749b4be8

X-MS-Exchange-CrossTenant-originalarrivaltime: 25 Feb 2026 18:25:47.5308

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: SI6PR04MB7927

X-Spam_score: 7.7

X-Spam_score_int: 77

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear, Hope you are doing well. We are an Indian based Website

Design & Development Company with PHP Development that offers services at

a modest rate.

Paypal phish from Microsoft Outlook Part 2

Content analysis details: (8.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[2603:10b6:806:34d:0:0:0:12 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:34d:0:0:0:12 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:34d:0:0:0:12 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:34d:0:0:0:12 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:34d:0:0:0:12 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:34d:0:0:0:12 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:34d:0:0:0:12 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:34d:0:0:0:12 listed in]

[will-spam-for-food.eu.org]

[40.93.23.1 listed in will-spam-for-food.eu.org]

[40.93.23.1 listed in will-spam-for-food.eu.org]

[40.93.23.1 listed in will-spam-for-food.eu.org]

[40.93.23.1 listed in will-spam-for-food.eu.org]

[40.93.23.1 listed in will-spam-for-food.eu.org]

[40.93.23.1 listed in will-spam-for-food.eu.org]

[40.93.23.1 listed in will-spam-for-food.eu.org]

[40.93.23.1 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[40.93.23.1 listed in dnsbl.ahbl.org]

[40.93.23.1 listed in dnsbl.ahbl.org]

[40.93.23.1 listed in dnsbl.ahbl.org]

[40.93.23.1 listed in dnsbl.ahbl.org]

[2603:10b6:806:34d:0:0:0:12 listed in]

[dnsbl.ahbl.org]

[2603:10b6:806:34d:0:0:0:12 listed in]

[dnsbl.ahbl.org]

[2603:10b6:806:34d:0:0:0:12 listed in]

[dnsbl.ahbl.org]

[2603:10b6:806:34d:0:0:0:12 listed in]

[dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[40.93.23.1 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[40.93.23.1 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[40.93.23.1 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[40.93.23.1 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[40.93.23.1 listed in list.dnswl.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[40.93.23.1 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 AXB_X_FF_SEZ_S Forefront sez this is spam

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

1.5 TVD_PH_BODY_ACCOUNTS_PRE The body matches phrases such as "accounts

suspended", "account credited", "account

verification"

1.2 TVD_PH_SUBJ_META1 Email has a Phishy looking subject line

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} Payment from Pay Pal LLC for USD 789.96 has been confirmed. If you

believe this to be inaccurate, contact 18102930409. account email

verification code






w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">













<br /><br /> =09<br /><br /> Payment from Pay Pal LLC for USD 789.96 has been confirmed. If you beli=<br /><br /> eve this to be inaccurate, contact 18102930409. account email verification =<br /><br /> code<br /><br /> <br /><br />










dir=3D"ltr" lang=3D"en">













=20


der=3D"0" dir=3D"ltr" lang=3D"en" style=3D"border-left:1px solid #e3e3e3;bo=

rder-right: 1px solid #e3e3e3;">














:1px solid #e3e3e3;">

border-bottom:1px solid #e3e3e3;"> 

:1px solid #e3e3e3; border-bottom:1px solid #e3e3e3;padding:12px 0;">


Light; font-size:18pt; color:#ffffff; font-weight:normal;">

=20


"#FFFFFF">Verify your email address







;border-bottom: 1px solid #e3e3e3;"> 


Paypal phish from Microsoft Outlook Part 3




der=3D"0" dir=3D"ltr" lang=3D"en">

















=20























 
n=3D"2" style=3D"border-bottom:1px solid #e3e3e3; padding:10px 0 20px;"> =09


"0" >








line-height:13pt; color:#000;">


"0" border=3D"0" width=3D"100%" style=3D"" dir=3D"ltr" lang=3D"en">









=20


x; color:#333;">

Tha=

nks for verifying your MatthewPerez1@Dallas217.onmicrosoft.com account!
an>







x; color:#333; font-weight: bold">

You=

r code is: 413730













Segoe UI', Tahoma, sans-serif; font-size:14px; color:#333;">

Sincerely,




Segoe UI', Tahoma, sans-serif; font-size:14px; font-style:italic; color:#33=

3;">

Payment from Pay Pal LL=

C for USD 789.96 has been confirmed. If you believe this to be inaccurate, =

contact 18102930409.









     

tom:1px solid #e3e3e3;">

e3;"> 

top" colspan=3D"6" style=3D"border-bottom:1px solid #e3e3e3; padding:20px 0=

;">


ing=3D"0" border=3D"0" width=3D"585">












g=3D"0" border=3D"0" dir=3D"ltr" lang=3D"en" style=3D"margin-right:30px;">










:'Segoe UI', Tahoma, sans-serif; margin:0px 0px 0px 5px; color:#666; font-s=

ize:10px;">


Info">

Microsoft Corpo=

ration

|

One Microsoft W=

ay Redmond, WA 98052-6399







This message was se=

nt from an unmonitored email address. Please do not reply to this message.


AndLegalLinks" style=3D"color:#0072c6;">






s://privacy.microsoft.com/en-US/privacystatement" id=3D"PrivacyLinkAnchor">

Privacy



|


ps://www.microsoft.com/en-US/servicesagreement/" id=3D"LegalLinkAnchor">

Legal





=20








passwordreset.microsoftonline.com/images/1_MSLogo.png" />








e3;"> 

tom:1px solid #e3e3e3;">







OBKBIJASBKEY5YA76F3UNWPNV4S7LS2VS3M6I3CVHJSUX6UKPODDVZQNUCFHO2T7ULCSZ43K2KV=

OQ7HBNQVOWUGUSP24IH73YLYJLIOYRA5TMXA4TGKMJ4GKD2LGTALXYVOSMWSJ7GEK5PUPJY&i=3D=

AIAADMHHNWTRCRVV56AYVCRRSGQ7R7JQB7NHB7PA2J26WOCIJHBA43PAZXBZVW64JQWCLFFDY6I=

OHW32XIYOG3FQEUFPTNSMKZTI32HYYNJ7V5RISIQHNZYZPKFXEGL3MEE6RHMSUIV5LWLCMQSRLC=

Y2B6R46AFI3WZHRCVSJOHLNZVQZVB7SIESDU67BSTXVFAS2HGFFBI34YOMSSAYZAOJQBOYIGVYA=

KERVU37SHUAMB4INCVHW2YNDIOZAEVOC2RIZ7YZD3EPZHOJHYS5SJRZZJZ5Y2I' width=3D'1'=

height=3D'1' tabindex=3D'-1' aria-hidden=3D'true' alt=3D'' />

=

Paypal phish from Microsoft Outlook Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 25 Feb 2026 12:19:03 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vvKP7-00000000Plh-2uWk

for dave@doctor.nl2k.ab.ca;

Wed, 25 Feb 2026 12:18:37 -0700

Resent-From: The Doctor

Resent-Date: Wed, 25 Feb 2026 12:18:37 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-westus3azacs10201001.outbound.protection.outlook.com ([40.93.23.1]:12316 helo=PH0PR06CU001.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vvJID-00000000JWl-1hC0

for doctor@doctor.nl2k.ab.ca;

Wed, 25 Feb 2026 11:07:36 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=PccDXoOC5s67GjPs/nRCWBtemEUboxhF1oAoW78xeOMmnJad31yQeR+Mo6MGM9PoPnJCXO+wqwz06+Zgn9lug8If8EdEN/4WXe2mC4Ryx6bpQWLhw47JA9L5nZsusCoIfaGQVei27PiGnzPweVUVjuq7JldzcVCbMEhyXPdb0x0S1saztJYO2amRU7+/vSY4tnGMm0QB6hvIJgsffamo1S69BpyCbtFSmbwSN/XgOlQWGZNNHlM/DkNsZvhD1/wT42KhpILHUCfSu+5Ygw9aZx1pDdYEVc+ZFPDE72yHnA0lZK2DoSFmGXWrWvWExmH3ABCgKOmUzVEjHZV96LaD2w==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=WeRnAI+RtU64gK0yjsBMGQNR0j8xH47PCKyCgoRc3xM=;

b=Z11wCossixobIOc+MFvK0VNi7EO3cHnZDIRBIgS5KxFLaBDrJAhQ9ddSIo9c3b9XClgljSWIDqEYZ+nd5nvqWn2owXbS6QUzpk50LD4vWSUwhSFdYJqWs/wu1OzewLDD/WyMeBX5Ltb0aW50wl9wiICTSqMKnK9ISTI3Z2vDEYOsIXQvD+kcA4tMg3mhC3CoH4BdqBSVshtjCyRXZ0jIkuDaWubbPD9yz+vk2lBOXviN5ioxbrkrUDkC4tl8xmyQp1/azX9YTP6sBa79xHStMcYztFmlbHCOoDlMbnWrTCFCM3fIncV7flxaJbB7nixPW4+5Dd/RKM+1ieYLK6jaZQ==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

Received: from substrate.office.com (2603:10b6:806:34d::12) by

SN7PR10MB7003.namprd10.prod.outlook.com with HTTP via

MW4PR04CA0270.NAMPRD04.PROD.OUTLOOK.COM; Wed, 25 Feb 2026 18:06:29 +0000

DKIM-Signature: v=1; a=rsa-sha256; d=microsoftonline.com; s=s1024;

c=relaxed/relaxed; t=1772042788; h=from:to:cc:subject:date:messageid;

bh=WeRnAI+RtU64gK0yjsBMGQNR0j8xH47PCKyCgoRc3xM=;

b=kY3RXOQ++w4mjFLqb/fh02PZfolctgQVksvCFaKbonkUi9vt0QuHzn93sg/zGV1z7gH6ICFY8Pp

3jh572c1OW6dqNMkteQCVMbLP3JC8zQqAOddSG1HTPDtZcWXyL1FfdksIRi38zcjcBlaBfFCCPWsm

fwQXDpNFTOhx9Hi5Fns=

From: msonlineservicesteam@microsoftonline.com

To: doctor@doctor.nl2k.ab.ca

Subject: Payment from Pay Pal LLC for USD 789.96 has been confirmed. If you

believe this to be inaccurate, contact 18102930409. account email

verification code

Date: Wed, 25 Feb 2026 18:06:28 +0000

Message-ID: <[078613e4ae8d4fffa98c702115f4d125-JFZGS42DN5WW25LONFRWC5DJN5XFA3DBORTG64TNFVIHE33EFVGVOMKQPREUCTKTKNIFE7CTKNIFERLNMFUWY7CFPBXVG3LUOA======@microsoft.com]>

X-MS-Iris-MetaData: =?utf-8?q?{=22Type=22=3Anull=2C=22Fields=22=3A{=22InstanceID=22=3A=22078613e4-ae8d-4fff-a98c-?=

=?utf-8?q?702115f4d125=22=2C=22ActivityID=22=3A=22ddb5e152-b509-4e91-9019-fd4911bf0?=

=?utf-8?q?a25=22}}?=

MIME-Version: 1.0

X-TsbHttpDeliveryResponseType: Success

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: quoted-printable

X-MS-PublicTrafficType: Email

client-request-id: 078613e4-ae8d-4fff-a98c-702115f4d125

request-id: 078613e4-ae8d-4fff-a98c-702115f4d125

X-MS-TrafficTypeDiagnostic: SN7PR10MB7003:EE_ICP

X-MS-Exchange-SenderADCheck: 0

X-MS-Exchange-AntiSpam-Relay: 0

X-Microsoft-Antispam:

BCL:0;ARA:13230040|376014|69100299015|7149299003|7049299003|61400799027|3109299003|3613699012|8096899003|4076899003|54012099003|14102899009;

X-Microsoft-Antispam-Message-Info:

=?utf-8?B?c3hxcUNXTDV2YU5pU2YvVUxwcGMwcEdCUExBUFB0cUU5RTEwejJDUGliV1B1?=

=?utf-8?B?bEkvWWI4SVkrZ2s4K3YvbHk4N2hLRHRJaWxKMU5qQnFrR0kvN3hIVC9yMFZs?=

=?utf-8?B?Z3RSeFNHejZOUDFhQUZRSG54ZDYwZS9Bd1hweWJSZ2FmZnlRTGlveFBkS0pO?=

=?utf-8?B?bmhkK1NJL2JhQkVpWVYrdVRxWURIRFVwWVA3ZFJTSjloRUZSV3hqeURucmlW?=

=?utf-8?B?SmhpaG5TbjE5dWNYN0x6SitkR3Zkc3R4MEhqQmhpM2gzUjFWQTR1d1BEUkgx?=

=?utf-8?B?dEd5UDdPekNRY2hrYjBkOUQwMStpWmZXaFFQbEk0WlVEMW5xUTgyNzl2RXJy?=

=?utf-8?B?cGtCeGdKNXdRZTJZRUlzVmRwOXpEbnZId3IyR1hHVHdENC9wV1ExMlRPNU1y?=

=?utf-8?B?aEhBWWZMQWRzUFFqYyt1T1RQQUJnMU4vOGFJQmdBd3RZdndCYW01bHlUWWdU?=

=?utf-8?B?WjFYOHNqTUdXblFaSFBTQ3pLRmUxdlNvTUFMQlA2MHllbElzczZubGM0c2FB?=

=?utf-8?B?VVl1L1RvNVpWUTF2ODI3NER4TTBXd3pjVlhtcWZLNTdSSzF2VDZ3RXNMenYr?=

=?utf-8?B?Y0tqR00yTnMwUk1LS0JKcGxtNEM5S2hKbWJ4alhrVm1RRmVkKy9EOGJGZmxj?=

=?utf-8?B?SU16eXMxT05LcFJRNEt6a0hxOVM2QlZIeHlUYStKcEt1bDRmZnRRcUNxTko2?=

=?utf-8?B?VURObkQvejJPV2djWk01Q3hPYjBoZUVzcE5JQTRpR1oxaS9Ha1BxUFhOWllL?=

=?utf-8?B?ZndocUlaOHJNemtEc2tnczZWME93Ny84MFdEeng0eERqTytxYmYvT1ZXdXZN?=

=?utf-8?B?SUd1V0d2MEsyVzluMWJQYkdYeXNYZ0s0OXo2djdSbXMvZ3ZlRTdDbEV0YzB1?=

=?utf-8?B?MnM5d1ZyemlYREkxRkc3dVBWZTlxR09EcjQzRlM3ZzBsUFdBaWFtSXErSS9z?=

=?utf-8?B?dUpieUdyV1ZTa3lPMmtES1RHV3hpRlNCUldvcVo2bWNvMk0vRXorRmZab3lq?=

=?utf-8?B?WmFXcVA5dXZCSk5SOURZVi9ZNGs1cEhsb280eG12azhVTVk2YXlqZSt1WUFv?=

=?utf-8?B?d1J1RjZ3Tzl3ZU1QdlJDb0REMUI0ZVhRendrMlhTYzQ3NXFGN0dhSXpSY1BT?=

=?utf-8?B?R1dWYXA5cTNVNDRwcm5wNGhMa2g3T0ExQllWNldPbGsxWFFWNEE4b1F2VHNl?=

=?utf-8?B?Ykc3aW5MN2YvR3hXNFJLOFNZMWQvK0F1VDRjdlRZS3pNcnhOZ083dXpGelhU?=

=?utf-8?B?L296UVpHU2pYQTdVaWhKVisxZ2ErMUxwemJTU05BYWRqTlZ2UmREeVkvUVk3?=

=?utf-8?B?Y2gwTll6V3RQTXdrRExmUk9CblltQlJUd1ZWZmJRRUdjU2VRWGdUTmw3ck1D?=

=?utf-8?B?d3FTeGFqaWxFSVM3UnJqaHdpdFFLNjd5ajRrUEM3RzFVTEd1V2srSHdYaVZw?=

=?utf-8?B?MGNMMVJDUldrMDVBSGd1RmFnYTZYTEQvMm9sK29IZndQVnUxWFR5bGd5VkIz?=

=?utf-8?B?QXNuekVJSjBlQlU3LzdGa2pPZ1c5ZTl6aWtBMVhiM090RTdaM2tCVTArdjE1?=

=?utf-8?B?NXFETWdsbU9PUWdRM295b2cxU2xUQnJzdkJVYmZONlZJK1d4YjZ3akVOZzJi?=

=?utf-8?B?WWdOeC9XT29pK2Z6TEJRYm9yanEvQkFHZFlXL1MyQTZOZUN5R1NIUGN5YUpV?=

=?utf-8?B?WExpR2J3TzlnWWR4Z0xVVnY1dnhXK2pvSFcxcHBVeW9uRWdDMkV3Y3BibTZD?=

=?utf-8?B?WFBlRGhZZ0JZS0ZSTTg3Wk1ydmhwMFh0VlNiN1hkSStSdkFIZlRhcjUwVXNs?=

=?utf-8?B?a1ZYalBGYnJzUUxPT2tWWmd4R2VSOC9jVVpTWFFHaGF4cmhYMlJ3U0h1dk1k?=

=?utf-8?B?Vm9JQkg1dUVFVmlJeHcvWXkvSnZEZHBiZXZScGNtakUxU1RiTE1BUjlxUWxM?=

=?utf-8?B?RXdibFp0dFNsNkZ2RG10cmtMbmczV1A1UWZlYkNFVVpnam55YnRNdlQvb3o3?=

=?utf-8?B?L2ZaMFU1ZmRXNExuVXcrY1h5eXRkdFh2b0V3bFR5TXl5Sk9xWUZzUis2RnZF?=

=?utf-8?B?cmtMaU41UjF3TG9QMnZwZWtLRWJLb2NOcW9uNUtxbGpqcVkrWXRWUW1UWmJp?=

=?utf-8?Q?Y7ps=3D?=

X-Forefront-Antispam-Report:

CIP:255.255.255.255;CTRY:;LANG:en;SCL:7;SRV:;IPV:NLI;SFV:SPM;H:;PTR:;CAT:OSPM;SFS:(13230040)(376014)(69100299015)(7149299003)(7049299003)(61400799027)(3109299003)(3613699012)(8096899003)(4076899003)(54012099003)(14102899009);DIR:OUT;SFP:1020;

X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1

X-MS-Exchange-AntiSpam-MessageData-0:

=?utf-8?B?K0JNMlRDaUh6YU5heXVZME9RSzZZc1FZVy9zZ1hKb1ZhVHhwRUk5YVJEeVh0?=

=?utf-8?B?QVFzTnBPTUdCYm9QcEdVMTdIS3NhTzVYM2FKUUxJMHo4Zit2NFNHSHQxVk9o?=

=?utf-8?B?YTR1Y3VPSVlFWHdYUDlHYjUvK3JsbEFScmpIZE40Nlh4WHRCRlMwdzNkenVB?=

=?utf-8?B?d3ptY05TUDAyYnR6eFhZTDFKNzhLOUpEakp0dnVXSHh0UWdkZ2drTkR2bXhQ?=

=?utf-8?B?YTdRc0JBOWtJdmZNcG1oalhDNk9rSVBFNHFtR0FoZ0MwY1JpN21BdjRQTkZu?=

=?utf-8?B?S2dsNFpOUStybzVIdXRiWnk5cjUzT2pkR05PSWRERExYRWVUYzV3L3VQdk9m?=

=?utf-8?B?em9qTGdWallQU0ZpcnZMc2QxbHJlZVZqRVpKZTdiM2grVjdVV1J5L2pEZFVv?=

=?utf-8?B?TWdwc1RZckNPaWJRN1M0Ym11S3gvMnBRdUs3M2tDS3FCalQ2K0xtalZuVEly?=

=?utf-8?B?WFoydnFWeGthanRiRVFlNFVWQjNLZ1BaRkpWb2VwZXlmTXYxQ1RZMjJHWTk2?=

=?utf-8?B?a0VwVENhR3dPWHUybXEvNDNlQ1VrbitUSnF6U095RjV0K2N5RHdYU3NqS016?=

=?utf-8?B?b3RYOVg4TWt3Y3JEMjYyYnhsdFM5K2JrU3hjS04yVjR4QUhyazlGaWlTdnFv?=

=?utf-8?B?akRzUnFBMlVGaW5pS1htZkE0RTdsNjFoeDdXcXo0NTE2elRmRXNpUy8zQ3Fu?=

=?utf-8?B?TFcvbk5XUWw2RjRJbnZNT0dvbE5sd0hNNlMyZUYxcitvcXNGR2hEem9QOTV5?=

=?utf-8?B?QzNuRnRXU1QxeHBoTTN4YTJpWGM1QldnVGNHckUzUWlnWUVUcExkd09LUjFH?=

=?utf-8?B?M0d0OEd5UUZWdGxoVm1yU0l6dXQ1dVFKc0N5aWYzQllXVjVSWkwrYTFrbzZF?=

=?utf-8?B?SS9jWHZhQnh6ZS9jRlFpa2ZvWnNwR3FjYkt4KzZmVVBHTHpyVmxpbVpwS2J5?=

=?utf-8?B?WExlNmcwU3gxdytDc1JIZllrMHZidFpacTFNbHNNM2I5MjB4WEhrMzZlUkVQ?=

=?utf-8?B?YTFHV0ZlZmN0SXdQM2xobnZYbjZQZzlKeng4OWdJa3BVclJhbzF0Nml0SHlI?=

=?utf-8?B?T2ZuZXQxaEE2QXhPNURnZ1E3WUZJRVY3ZHVrYVJkMVFyN0tyS1pRdjlNVFN0?=

=?utf-8?B?Wkx6M2xDSzFSdEkzUmpEUWduaVJVOGRkYldZazMwRzU4VXB1cERYWmFwRGcy?=

=?utf-8?B?NGt4enpYa0Nhcmc1MzFZNDF1ZnZNSlZ0eW9vaXZzcTV4K2NoKzQ0cURVL1Y0?=

=?utf-8?B?SVNobkh1ZzlzVkQ3VERuekl1S2pFTzVoNjFsR2toY29uMGNVOFI1NzZ1SWxL?=

=?utf-8?Q?OuqauZugerF3M=3D?=

X-OriginatorOrg: ideasprod09.onmicrosoft.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: HttpSubmission-SN7PR10MB7003

X-MS-Exchange-CrossTenant-Id: 719f7151-364e-4e2e-83a8-f361c51431d7

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 25 Feb 2026 18:06:28.9721 (UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id:

88ad4618-892f-4b14-78b7-08de74989975

X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN7PR10MB7003

X-Spam_score: 8.9

X-Spam_score_int: 89

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Payment from Pay Pal LLC for USD 789.96 has been confirmed.

If you believe this to be inaccurate, contact 18102930409. account email

verification code Verify your email address Thanks for verifying your

MatthewPerez1@Dallas217.onmicrosoft.com account!

Contract Witness spam from Microsoft Outlook Part 2

Content analysis details: (8.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[193.48.143.83 listed in will-spam-for-food.eu.org]

[193.48.143.83 listed in will-spam-for-food.eu.org]

[193.48.143.83 listed in will-spam-for-food.eu.org]

[193.48.143.83 listed in will-spam-for-food.eu.org]

[193.48.143.83 listed in will-spam-for-food.eu.org]

[193.48.143.83 listed in will-spam-for-food.eu.org]

[193.48.143.83 listed in will-spam-for-food.eu.org]

[193.48.143.83 listed in will-spam-for-food.eu.org]

[193.48.143.88 listed in will-spam-for-food.eu.org]

[193.48.143.88 listed in will-spam-for-food.eu.org]

[193.48.143.88 listed in will-spam-for-food.eu.org]

[193.48.143.88 listed in will-spam-for-food.eu.org]

[193.48.143.88 listed in will-spam-for-food.eu.org]

[193.48.143.88 listed in will-spam-for-food.eu.org]

[193.48.143.88 listed in will-spam-for-food.eu.org]

[193.48.143.88 listed in will-spam-for-food.eu.org]

[2603:10a6:10:4b8:cafe:0:0:58 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:4b8:cafe:0:0:58 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:4b8:cafe:0:0:58 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:4b8:cafe:0:0:58 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:4b8:cafe:0:0:58 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:4b8:cafe:0:0:58 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:4b8:cafe:0:0:58 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:4b8:cafe:0:0:58 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:4b8:0:0:0:6 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:4b8:0:0:0:6 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:4b8:0:0:0:6 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:4b8:0:0:0:6 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:4b8:0:0:0:6 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:4b8:0:0:0:6 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:4b8:0:0:0:6 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:4b8:0:0:0:6 listed in]

[will-spam-for-food.eu.org]

[40.107.160.136 listed in will-spam-for-food.eu.org]

[40.107.160.136 listed in will-spam-for-food.eu.org]

[40.107.160.136 listed in will-spam-for-food.eu.org]

[40.107.160.136 listed in will-spam-for-food.eu.org]

[40.107.160.136 listed in will-spam-for-food.eu.org]

[40.107.160.136 listed in will-spam-for-food.eu.org]

[40.107.160.136 listed in will-spam-for-food.eu.org]

[40.107.160.136 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[40.107.160.136 listed in dnsbl.ahbl.org]

[40.107.160.136 listed in dnsbl.ahbl.org]

[40.107.160.136 listed in dnsbl.ahbl.org]

[40.107.160.136 listed in dnsbl.ahbl.org]

[2603:10a6:10:4b8:0:0:0:6 listed in]

[dnsbl.ahbl.org]

[2603:10a6:10:4b8:0:0:0:6 listed in]

[dnsbl.ahbl.org]

[2603:10a6:10:4b8:0:0:0:6 listed in]

[dnsbl.ahbl.org]

[2603:10a6:10:4b8:0:0:0:6 listed in]

[dnsbl.ahbl.org]

[2603:10a6:10:4b8:cafe:0:0:58 listed in]

[dnsbl.ahbl.org]

[2603:10a6:10:4b8:cafe:0:0:58 listed in]

[dnsbl.ahbl.org]

[2603:10a6:10:4b8:cafe:0:0:58 listed in]

[dnsbl.ahbl.org]

[2603:10a6:10:4b8:cafe:0:0:58 listed in]

[dnsbl.ahbl.org]

[193.48.143.88 listed in dnsbl.ahbl.org]

[193.48.143.88 listed in dnsbl.ahbl.org]

[193.48.143.88 listed in dnsbl.ahbl.org]

[193.48.143.88 listed in dnsbl.ahbl.org]

[193.48.143.83 listed in dnsbl.ahbl.org]

[193.48.143.83 listed in dnsbl.ahbl.org]

[193.48.143.83 listed in dnsbl.ahbl.org]

[193.48.143.83 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[40.107.160.136 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[40.107.160.136 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[40.107.160.136 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[40.107.160.136 listed in dnsbl.ahbl.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[40.107.160.136 listed in wl.mailspike.net]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[40.107.160.136 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

1.2 MISSING_HEADERS Missing To: header

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.9 REPLYTO_WITHOUT_TO_CC No description available.

Subject: {SPAM?} Essential Skills Needed For Witnessing!!

Contract Witness spam from Microsoft Outlook Part 3

--_000_3c687370476e4a4eaf9495443e1aef1cupecfr_

Content-Type: text/plain; charset="us-ascii"

Content-Transfer-Encoding: quoted-printable



Hello, Good Day



How are you? I'm a recruiter for Silesian Steel and we have a unique opport=

unity that I believe aligns well with your status. I am reaching out to see=

if you would be willing to serve as a neutral party to witness the signing=

of an important sales contract I am finalizing. This is a standard practic=

e that can provide peace of mind and strengthen the validity of the contrac=

t. I am happy to discuss this further if you are interested.



I look forward to hearing from you!



Regards

Mohamed Diawara

Executive Recruiter c/o Silesian Steel



--_000_3c687370476e4a4eaf9495443e1aef1cupecfr_

Content-Type: text/html; charset="us-ascii"

Content-Transfer-Encoding: quoted-printable




hemas-microsoft-com:office:word" xmlns:m=3D"http://schemas.microsoft.com/of=

fice/2004/12/omml" xmlns=3D"http://www.w3.org/TR/REC-html40">




>








break-word">



Hello, Good Day
>



 
span>



How are you? I'm a =

recruiter for Silesian Steel and we have a unique opportunity that I believ=

e aligns well with your status. I am reaching out to see if you would be wi=

lling to serve as a neutral party to

witness the signing of an important sales contract I am finalizing. This i=

s a standard practice that can provide peace of mind and strengthen the val=

idity of the contract. I am happy to discuss this further if you are intere=

sted.



 
span>



I look forward to h=

earing from you!



 
span>



Regards<=

/span>



Mohamed Diawara
>



Executive Recruiter=

c/o Silesian Steel











--_000_3c687370476e4a4eaf9495443e1aef1cupecfr_--

Contract Witness spam from Microsoft Outlook Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 25 Feb 2026 12:19:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vvKOw-00000000Pd7-202Y

for dave@doctor.nl2k.ab.ca;

Wed, 25 Feb 2026 12:18:26 -0700

Resent-From: The Doctor

Resent-Date: Wed, 25 Feb 2026 12:18:26 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-francecentralazon11021136.outbound.protection.outlook.com ([40.107.160.136]:14909 helo=PAUP264CU001.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vvJ5I-00000000Edy-18TV

for sales@nk.ca;

Wed, 25 Feb 2026 10:54:15 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=PLzvjcP6QkZH87oggzhQr8ExRKpoxinhPJ6DhYdHiY1Riy6gBSVIsFoY6w/ZoSWMr82EMBmo53F+9E7QbnnU9wOmxSARiaDTIf8FOzplb5H/mOtcilbzuEFmAPmI0fzzc8tX0YzsWFLjtiHZR7Km/f71F9gwL1HYwU/IgNNnf3MIRDyg625jwtzaSQeiARgBVbWoTVsPE614g7PJwY8VcO0kTGRMePFSY/pGwcqTDaEGGvXCprhCcxn0OhGSldR71fOu1xO2VyehmNWcoF1mHlUtdHqfkIw5+zbhzk9VLv5R+4cdmZ3TdEHWX4gyYmDIUDP5PksK0o89F4tLAnZ21A==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=Kf74MipObS8aW5FlQ3tdEZKpEXrKbUM/OEvRvYZLC5I=;

b=EJ1RNPAzvM+Locl39Z64TnpKIuETmMjb3bIn29sEF4+x+EREtk0ufBDRatDnAixFErTZF695VH+0pKSteW8C+WOPM2G5xlshV8X7yKk214eaHZMrTMAW70ESdyWsKnLmOs6gOnACI4iqAvXNbCXpW4GUse/KUspEPpRyqv1hK0LXXDCwHt74+npw51JeJWaxkcboUmVyyaZRebRIqfUE/L64rBNt/fS711ZCqo6ggOlsxXyPGiZ3HbvEX8VyQgIWgiHyjYyZPeC1yQZiEcXplQMeSQa3bB/Dx3UgC6AGYqeRaDEpM5vajTtUiJm4uc7C6J0aLzvreyPqvVD4AoR7Pg==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is

193.48.143.88) smtp.rcpttodomain=journeystheroadhome.org

smtp.mailfrom=u-pec.fr; dmarc=bestguesspass action=none header.from=u-pec.fr;

dkim=none (message not signed); arc=none (0)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=u-pec.fr; s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=Kf74MipObS8aW5FlQ3tdEZKpEXrKbUM/OEvRvYZLC5I=;

b=orWo9b2kbYtil/5lavSSLFaqhBr+0MJtn4t5d1ndchWxhaRbsUHPGbeQM6ypSrmh1jZcwxUUfczWzyUJFxzcx49rRHPuS+xTzgCu2CtJC9f66SopvrJTwJ+WXJxwpP+i4USf8yQFU+BSKbfZirAoFSHX7Z3vPFqF4ncNtTXjkSc=

Received: from DUZPR01CA0354.eurprd01.prod.exchangelabs.com

(2603:10a6:10:4b8::6) by MR1P264MB3394.FRAP264.PROD.OUTLOOK.COM

(2603:10a6:501:28::9) with Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9654.11; Wed, 25 Feb

2026 17:53:06 +0000

Received: from DU2PEPF00028D05.eurprd03.prod.outlook.com

(2603:10a6:10:4b8:cafe::58) by DUZPR01CA0354.outlook.office365.com

(2603:10a6:10:4b8::6) with Microsoft SMTP Server (version=TLS1_3,

cipher=TLS_AES_256_GCM_SHA384) id 15.20.9632.24 via Frontend Transport; Wed,

25 Feb 2026 17:53:06 +0000

X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 193.48.143.88)

smtp.mailfrom=u-pec.fr; dkim=none (message not signed)

header.d=none;dmarc=bestguesspass action=none header.from=u-pec.fr;

Received-SPF: Pass (protection.outlook.com: domain of u-pec.fr designates

193.48.143.88 as permitted sender) receiver=protection.outlook.com;

client-ip=193.48.143.88; helo=pmg01.u-pec.fr; pr=C

Received: from pmg01.u-pec.fr (193.48.143.88) by

DU2PEPF00028D05.mail.protection.outlook.com (10.167.242.165) with Microsoft

SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.9632.12

via Frontend Transport; Wed, 25 Feb 2026 17:53:05 +0000

Received: from pmg01.u-pec.fr (localhost.localdomain [127.0.0.1])

by pmg01.u-pec.fr (Proxmox) with ESMTP id 4D34C3632AC;

Wed, 25 Feb 2026 18:53:05 +0100 (CET)

From: Mohamed Diawara

Subject: Essential Skills Needed For Witnessing!!

Thread-Topic: Essential Skills Needed For Witnessing!!

Thread-Index: Adymf5chHMZXWSCvGkKCuc1RZgs3SA==

Date: Wed, 25 Feb 2026 17:53:04 +0000

Message-ID: <3c687370476e4a4eaf9495443e1aef1c@u-pec.fr>

Reply-To: Mohamed Diawara , Dawid kaminski



Accept-Language: fr-FR, en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

x-originating-ip: [193.48.143.83]

Content-Type: multipart/alternative;

boundary="_000_3c687370476e4a4eaf9495443e1aef1cupecfr_"

MIME-Version: 1.0

X-EOPAttributedMessage: 0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: DU2PEPF00028D05:EE_|MR1P264MB3394:EE_

X-MS-Office365-Filtering-Correlation-Id: 601bd62c-84ba-442b-1bc7-08de7496baa0

X-MS-Exchange-SenderADCheck: 1

X-MS-Exchange-AntiSpam-Relay: 0

X-Microsoft-Antispam:

BCL:0;ARA:13230040|82310400026|1800799024|7416014|376014|786006|32650700017|36860700013|8096899003;

X-Microsoft-Antispam-Message-Info:

v8AmHHa/KnOG027IMGa7UEL7YRrrPzYRFe2mPHYOMdITpKnS4eawot/Rh3XKflMovOsj+qCv4roTjmsvWAp6TufSMmwKbDs+MUfbk3qk2JvbQd7DExMZO0d7/wvMOxCAv1/tyGZr0TPzuBRLUGdesiLY4X1gFuGaAQimj2zQ7lUM3MaMf6CsR0k4rEuKJ+7GRF515nxFz6sfFxuUGNlFuf1jgdqGWmRpuKH0D+8xCBYJncCtAWvoKZPZruKmXhHoOB1UhMQ68iaAyfHxrkLTLtV4AwDREl96sPWTVBfFoaW/VpzVjkUaHXpFwkw59bnM9z1Tw7/Z6z4EFuIlLITHFaMDqkR3Wox7dXqz48J6/veh5Lxa7J8Ees4ZLuMDrGFIdexVAYWpeXUOt169I+UKo2ZNS2LtSOxr/BhXjMtnMQ1DpoDxwGNLTasNT1CMmvZ6WHMNSlobVGNhGxcjIUAk2nYkK/0T5DqEngzelI7baHzSc0jrjxX03epS5yFHicgGywwcxCZ/uO3pYys+Mv6SVvJadSwNey5N6ZeM6wiY2Y9U9k6K1rC7xac662bQvhsN20aLEum95Ppk7t/xiVasy7vMR7UyjQrFUD89Ffo5qz/e2igtXY1+1nPRMMCD2H+uDzlF8ec3o/QQwh2Joq5C28X8XgIHFqLT7u1T+ius6ryX//+pbN77ksVDF0lpbfHPNydxXE/9tKasH4d6xDf+dZz9XFRl/XuBYU4tfi4j1MeXNnqr43SmzGR8gA3MdCmnWk2IfoJEVQary7Rg1QvGoHu3QsBeuP+vHbmKzeoeVjMJxXyg/rAFtNPso+cGX8kQ

X-Forefront-Antispam-Report:

CIP:193.48.143.88;CTRY:FR;LANG:en;SCL:1;SRV:;IPV:CAL;SFV:NSPM;H:pmg01.u-pec.fr;PTR:pmg01.u-pec.fr;CAT:NONE;SFS:(13230040)(82310400026)(1800799024)(7416014)(376014)(786006)(32650700017)(36860700013)(8096899003);DIR:OUT;SFP:1102;

X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1

X-MS-Exchange-AntiSpam-MessageData-0:

ct5SJlfZSwjg1cH/yYyjEZlZEHEiVHZS6HqItbyPEXibcdAi5rQwJl1vgue7yKJE5XUxvEMKRVUGwdiZOzmn2onm9Er4Qc47Hqa0KTwb8oDWtt0Hx2MVtCyTqmluh5zIhiGJagPinWUFPGwiiMCBZTAzx1weN37KkEbRI/Vgem6NAKjJ83Nshjy7+5qAFERYvZBJ/gHVSHw+LaXQxHwYRhhHC8wCWGDNESzszbY2pe0yycJNq9cWVyy1nhHbfZC1UPmx9/BYkwRk2+H3MQc6c/kA21QR4CzF5UKwX5ck+NwW79PAYAis7RqjHZJZL8mk77APpnPRpn8+OYkHsMZypmVL5GBmFbA5+OAyb/aaEDaWUHCJ1mtwkcjtV9cm2apbrad6B3Q1iPPrM8Cs9gj+NL6uSO4BaRc9Y3r7kJoLOsmTygb51KUaAlmzeov1Qj3v

X-OriginatorOrg: u-pec.fr

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 25 Feb 2026 17:53:05.7437

(UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id: 601bd62c-84ba-442b-1bc7-08de7496baa0

X-MS-Exchange-CrossTenant-Id: 144b6294-952d-4b86-87aa-aa8bf2979a47

X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=144b6294-952d-4b86-87aa-aa8bf2979a47;Ip=[193.48.143.88];Helo=[pmg01.u-pec.fr]

X-MS-Exchange-CrossTenant-AuthSource:

DU2PEPF00028D05.eurprd03.prod.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem

X-MS-Exchange-Transport-CrossTenantHeadersStamped: MR1P264MB3394

X-Spam_score: 8.0

X-Spam_score_int: 80

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hello, Good Day How are you? I'm a recruiter for Silesian

Steel and we have a unique opportunity that I believe aligns well with your

status. I am reaching out to see if you would be willing to serve as a neutral

par [...]

Bitcoin phish from Google Gmail Part 4


/InformAction">
emtype=3D"http://schema.org/EmailMessage">
ntent=3D"=E0=B8=89=E0=B8=B1=E0=B8=95=E0=B8=A3=E0=B8=B2=E0=B8=A7=E0=B8=B8=E0=

=B8=92=E0=B8=B4 =E0=B9=80=E0=B8=99=E0=B8=95=E0=B8=A3=E0=B8=AA=E0=B8=B8=E0=

=B8=99=E0=B8=97=E0=B8=A3: Dear Valued Customer, On February 25, 2026, your =

linked PayPal account was charged for a BTC purchase. Order Ref: PP-2026-65=

83 Customer Ref: PC-728491-GH Amount Debited: $849.00 Verification: Approve=

d For immediate help, please dial +1 (806) 230-2037. Support Desk: +1 (806)=

230-2037."/>

schema.org/Event">
rg/EventScheduled"/>
://schema.org/Organization">
dar"/>

eo1kqhbv4rue29hi7"/>
ff; line-height: 1px; height: 0; max-height: 0; width: 0; max-width: 0; opa=

city: 0; overflow: hidden;" itemprop=3D"name">Billing Confirmation Statemen=

t =E2=80=93 Bitcoin Purchase via PayPal
<=

time itemprop=3D"startDate" datetime=3D"20260226">

g=3D"0" cellspacing=3D"0" role=3D"presentation" align=3D"center" style=3D"w=

idth:100%;" class=3D"body-container">
dy>

lign=3D"left">
  <=

/div>
llpadding=3D"0" cellspacing=3D"0" role=3D"presentation" align=3D"center" st=

yle=3D"width:100%;" class=3D"">

=3D"left">


emprop=3D"description">Dear Valued Customer,

On February 25, 2026, your l=

inked PayPal account was charged for a BTC
purchase.
Order Ref: PP-20=

26-6583
Customer Ref: PC-728491-GH
Amount Debited: $849.00
Verific=

ation: Approved

For immediate help, please dial +1 (806) 230-2037.
Sup=

port Desk: +1 (806) 230-2037.


e border=3D"0" cellpadding=3D"0" cellspacing=3D"0" role=3D"presentation" al=

ign=3D"center" style=3D"width:100%;" class=3D"">

der: solid 1px #dadce0; border-radius: 8px; direction: rtl; font-size: 0; p=

adding: 24px 32px; text-align: left; vertical-align: top;" class=3D"main-co=

ntainer-inner">

=3D"font-size: 13px; text-align: left; direction: ltr; display: inline-bloc=

k; vertical-align: top; width: 100%;overflow: hidden; word-wrap: break-word=

;">
tion" width=3D"100%" class=3D"main-column-table-ltr" style=3D"padding-right=

: 32px; padding-left: 0;;table-layout: fixed;">
dy>

-column-td" style=3D"padding:0; vertical-align:top;">
llpadding=3D"0" cellspacing=3D"0" role=3D"presentation" width=3D"100%" styl=

e=3D"table-layout: fixed;">

align: left; word-break: break-word;;padding-bottom:2px;">

t-family: 'Google Sans', Roboto, sans-serif;font-weight: 400; font-=

size: 22px; line-height: 28px;color: #3c4043; text-decoration: none;" class=

=3D"primary-text" role=3D"presentation">Billing Con=

firmation Statement =E2=80=93 Bitcoin Purchase via PayPal

>

ak: break-word;;padding-bottom:24px;">

ns-serif;font-style: normal; font-weight: 400; font-size: 14px; line-height=

: 20px; letter-spacing: 0.2px;color: #3c4043; text-decoration: none;" class=

=3D"primary-text" role=3D"presentation">Thursday Feb 26, 2026
iv>

ord-break: break-word;;padding-bottom:24px;">

oto, sans-serif;font-style: normal; font-weight: 400; font-size: 14px; line=

-height: 20px; letter-spacing: 0.2px;color: #3c4043; text-decoration: none;=

" class=3D"primary-text" role=3D"presentation">
ing=3D"0" cellspacing=3D"0" role=3D"presentation" style=3D"padding-bottom: =

4px;">


c4043; text-decoration: none;font-weight: 700;-webkit-font-smoothing: antia=

liased;margin: 0; padding: 0;">Guests

(Guest list has=

been hidden at organizer's request)


--0000000000004917b1064ba95a48--

Bitcoin phish from Google Gmail Part 3



=20

















Bitcoin phish from Google Gmail Part 2





















=20



=20



=20

Bitcoin phish from Google Gmail Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 25 Feb 2026 12:19:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vvKOe-00000000PQS-2X48

for dave@doctor.nl2k.ab.ca;

Wed, 25 Feb 2026 12:18:08 -0700

Resent-From: The Doctor

Resent-Date: Wed, 25 Feb 2026 12:18:08 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-qk1-f201.google.com ([209.85.222.201]:54401)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from <22415@thamai.ac.th>)

id 1vvIin-00000000P9a-0e2A

for doctor@doctor.nl2k.ab.ca;

Wed, 25 Feb 2026 10:30:59 -0700

Received: by mail-qk1-f201.google.com with SMTP id af79cd13be357-8c70fadd9a3so4061637485a.0

for ; Wed, 25 Feb 2026 09:30:02 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=google.com; s=20230601; t=1772040596; x=1772645396; darn=doctor.nl2k.ab.ca;

h=from:subject:date:message-id:sender:reply-to:mime-version:from:to

:cc:subject:date:message-id:reply-to;

bh=xZPVElSoa37qH72fFgTYppF7GpqFigJ/ctne8NasIms=;

b=3H14fNzFjlv08uGP/Z78IBc1Z81zDXqbIBKFgjUH3NBujtaouzPGiJQa2oKdw1qwxW

ntmOzz6EgYJcljT5pCPB2KXCMus+DliMAo9o3FeTHopu9bvGQsqsJ1q22QzbWAdNbwsQ

LzFx0xgK3F6voi4USWKR/lkVR6WWs1PeWwLQNBPFeMT39Q/Z45MkLV46/uI4neGYY+cX

io5HnxTxdDooCiSWGSNzSd4v3Fe7ziGTt3aqqQdSAZIOqn5uQeoWGgD0pQ2inVUCsgtQ

YPu/ieCMF5XEGCHLGllpucbpn1eaS/rgZKe96u4Pg3YLpRNMEyv2UMLX1CFaQ7SvogJK

idJg==

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=thamai-ac-th.20230601.gappssmtp.com; s=20230601; t=1772040596; x=1772645396; darn=doctor.nl2k.ab.ca;

h=from:subject:date:message-id:sender:reply-to:mime-version:from:to

:cc:subject:date:message-id:reply-to;

bh=xZPVElSoa37qH72fFgTYppF7GpqFigJ/ctne8NasIms=;

b=FZOHkkZEIOjjz2BzkcxWU9MLfxJlSe64JL2EvDg4zk9qdPpIqWyUEdMqx/Gcb9VPxs

DfHXsgDND+tHO4K3BYiyULiWcFEAmT/PAmPKUtqsDMwTXb5REp95T8oyDRk88tGbxpbI

v5U/Xnr1cMBzZStdldzeZrdoZji3CT8fz1QlLIyOOX8SNA+QUFz6LHlqDWcCvpvCiIkw

vaGI3TwDc/fh1IUCu0hA1i2EJbhkUzyiwXnM3JwPSGpEMCh+CH1WBj5XuWyjC+sfdOzY

32WP2R5fqOEe9rV4zCRmWSUSOvIUbWfpGJdOM/h/qqqwPZCct8+lXVJjFe3Gyb460tp8

+Rkw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1772040596; x=1772645396;

h=from:subject:date:message-id:sender:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=xZPVElSoa37qH72fFgTYppF7GpqFigJ/ctne8NasIms=;

b=PKDaFhFOfN0iezF8qPNqf3gWF58pdSymyw1CsUkKbqFo/UBrGjweR4IshoK9FSbfZi

JVZzeWRJlIdyXM9flghvQXOq6/3/isRUK6xKQLqMQPD6mikC1428p5bMJR88wqDQ8sY7

FGOGaXdxVqmwqM1VxxAp9stHvL4mbq71I43yuOf9m/6IbIARs3KKPTWAZ5rcJ5cgoz5L

ISHnK+lXSzfbbhVP+GVdw2LlWSj0p6mojo8k361W0v6NMaJqqUW0jATm7iBbYWXSDCyS

4lAiLYWcRCxtTkJZm4ZGuWhcxEDJW4VySjmSsXPWCyvfPVhc0AYdSODcRiRNp5PzY7Cb

Cc2Q==

X-Forwarded-Encrypted: i=1; AJvYcCU6d7aOuZm/nfNgixsCPh9UGF3bcBLf7Vc4Wae1zj6juBiWm55f9lmUpDJt4fbz2bICFksUDeE=@doctor.nl2k.ab.ca

X-Gm-Message-State: AOJu0YyICuE2WmYRRP4Snm1opJ1jAq4aLdDdDAWBAvP0xj/+HitB0i2I

gbNXFAFcOrWYkpulHCNaLkw8v0mRaxEKlx1CYjK1gYfBlfy/p5DcqmmLeL1VqoLUV14LE+qeu/e

ZtgHnBOOR5ysMphO7qPtVBxboELQGGiGYByaQTOCPOyGhcw==

MIME-Version: 1.0

X-Received: by 2002:a05:620a:370a:b0:8b2:7435:f5ef with SMTP id

af79cd13be357-8cbbd0102dfmt204952185a.41.1772040596273; Wed, 25 Feb 2026

09:29:56 -0800 (PST)

Reply-To: =?UTF-8?B?4LiJ4Lix4LiV4Lij4Liy4Lin4Li44LiS4Li0IOC5gOC4meC4leC4o+C4quC4uOC4mQ==?=

=?UTF-8?B?4LiX4Lij?= <22415@thamai.ac.th>

Sender: Google Calendar

Message-ID:

Date: Wed, 25 Feb 2026 17:29:56 +0000

Subject: Billing Confirmation Statement - Bitcoin Purchase via PayPal

From: =?UTF-8?B?4LiJ4Lix4LiV4Lij4Liy4Lin4Li44LiS4Li0IOC5gOC4meC4leC4o+C4quC4uOC4meC4l+C4ow==?= <22415@thamai.ac.th>

Content-Type: multipart/alternative; boundary="0000000000004917b1064ba95a48"

X-Spam_score: 12.6

X-Spam_score_int: 126

X-Spam_bar: ++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear Valued Customer, On February 25, 2026, your linked PayPal

account was charged for a BTC purchase. Order Ref: PP-2026-6583 Customer

Ref: PC-728491-GH Amount Debited: $849.00 Verification: Approved [...]



Content analysis details: (12.6 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.222.201 listed in list.dnswl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.222.201 listed in will-spam-for-food.eu.org]

[209.85.222.201 listed in will-spam-for-food.eu.org]

[209.85.222.201 listed in will-spam-for-food.eu.org]

[209.85.222.201 listed in will-spam-for-food.eu.org]

[209.85.222.201 listed in will-spam-for-food.eu.org]

[209.85.222.201 listed in will-spam-for-food.eu.org]

[209.85.222.201 listed in will-spam-for-food.eu.org]

[209.85.222.201 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.222.201 listed in dnsbl.ahbl.org]

[209.85.222.201 listed in dnsbl.ahbl.org]

[209.85.222.201 listed in dnsbl.ahbl.org]

[209.85.222.201 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.222.201 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.222.201 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.222.201 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.222.201 listed in dnsbl.ahbl.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.222.201 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

1.2 MISSING_HEADERS Missing To: header

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

1.9 REPLYTO_WITHOUT_TO_CC No description available.

2.6 LONG_INVISIBLE_TEXT Long block of hidden text - bayes poison?

Subject: {SPAM?} Billing Confirmation Statement - Bitcoin Purchase via PayPal



--0000000000004917b1064ba95a48

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes

Content-Transfer-Encoding: base64



RGVhciBWYWx1ZWQgQ3VzdG9tZXIsIE9uIEZlYnJ1YXJ5IDI1LCAyMDI2LCB5b3VyIGxpbmtlZCBQ

YXlQYWwgYWNjb3VudCB3YXMgIA0KY2hhcmdlZCBmb3IgYSBCVEMgcHVyY2hhc2UuIE9yZGVyIFJl

ZjogUFAtMjAyNi02NTgzIEN1c3RvbWVyIFJlZjogIA0KUEMtNzI4NDkxLUdIIEFtb3VudCBEZWJp

dGVkOiAkODQ5LjAwIFZlcmlmaWNhdGlvbjogQXBwcm92ZWQgRm9yIGltbWVkaWF0ZSAgDQpoZWxw

LCBwbGVhc2UgZGlhbCArMSAoODA2KSAyMzAtMjAzNy4gU3VwcG9ydCBEZXNrOiArMSAoODA2KSAy

MzAtMjAzNy4NCg0KQmlsbGluZyBDb25maXJtYXRpb24gU3RhdGVtZW50IOKAkyAgQml0Y29pbiBQ

dXJjaGFzZSB2aWEgUGF5UGFsDQpUaHVyc2RheSBGZWIgMjYsIDIwMjYNCg0KDQoNCk9yZ2FuaXpl

cg0K4LiJ4Lix4LiV4Lij4Liy4Lin4Li44LiS4Li0IOC5gOC4meC4leC4o+C4quC4uOC4meC4l+C4

ow0KMjI0MTVAdGhhbWFpLmFjLnRoDQoNCkd1ZXN0cw0KKEd1ZXN0IGxpc3QgaGFzIGJlZW4gaGlk

ZGVuIGF0IG9yZ2FuaXplcidzIHJlcXVlc3QpDQoNCg==

--0000000000004917b1064ba95a48

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable




schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-microsoft-com:office:offi=

ce">
t=3D"text/html; charset=3DUTF-8">
=3Ddevice-width,initial-scale=3D1">
ight dark">

Web/SEO/App spam from Microsoft Outlook Part 3


d-color: rgb(255, 255, 255); margin: 0px; font-family: Calibri, Helvetica, =

sans-serif; font-size: 11pt; color: rgb(0, 0, 0);" class=3D"elementToProof"=

>

From: Amjad khan



d-color: rgb(255, 255, 255); margin: 0px; font-family: Calibri, Helvetica, =

sans-serif; font-size: 11pt; color: rgb(0, 0, 0);" class=3D"elementToProof"=

>

Sent: Friday, December 13, 2024 12:58 PM


Subject: Re: Cost ......



d-color: rgb(255, 255, 255); margin: 0px; font-family: Calibri, Helvetica, =

sans-serif; font-size: 11pt; color: rgb(0, 0, 0);" class=3D"elementToProof"=

>

 



ht: normal; background-color: rgb(255, 255, 255); margin: 0cm 0cm 12pt; fon=

t-family: Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0,=

0);" class=3D"elementToProof">

Hello,





I checked your website, you have an impressive site, but the ranking is not=

good on Google, Yahoo and Bing. 





Would you like to optimize your site? I will be happy to share with you our=

pricing and proposals.





May I send you a quo=

te? If interested!






Waiting for a quick reply



ht: normal; background-color: rgb(255, 255, 255); margin: 0cm 0cm 0.0001pt;=

font-family: Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0=

, 0, 0);" class=3D"elementToProof">

Thanks,



Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">












--_000_KL1PR0302MB53134CDE1B6A51EEEFBDCA37CE75AKL1PR0302MB5313_--