Bitcoin Paypal Phish from Microsoft OutLook Part 1
Posted by Dave Yadallee on
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 24 Jun 2026 13:18:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))
(envelope-from)
id 1wcT5r-000000001tJ-0YwY
for dave@doctor.nl2k.ab.ca;
Wed, 24 Jun 2026 13:17:03 -0600
Resent-From: The Doctor
Resent-Date: Wed, 24 Jun 2026 13:17:03 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-westus2azlp17010076.outbound.protection.outlook.com ([40.93.10.76]:14863 helo=CO1PR03CU002.outbound.protection.outlook.com)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384
(Exim 4.99.3 (FreeBSD))
(envelope-from)
id 1wcQ5e-00000000EIO-2v7v
for doctor@doctor.nl2k.ab.ca;
Wed, 24 Jun 2026 10:04:50 -0600
Received: from DS7PR03CA0276.namprd03.prod.outlook.com (2603:10b6:5:3ad::11)
by SJ0PR18MB3948.namprd18.prod.outlook.com (2603:10b6:a03:2ea::20) with
Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.159.14; Wed, 24 Jun
2026 16:03:33 +0000
Received: from DS2PEPF000061C1.namprd02.prod.outlook.com
(2603:10b6:5:3ad:cafe::12) by DS7PR03CA0276.outlook.office365.com
(2603:10b6:5:3ad::11) with Microsoft SMTP Server (version=TLS1_3,
cipher=TLS_AES_256_GCM_SHA384) id 15.21.159.13 via Frontend Transport; Wed,
24 Jun 2026 16:03:33 +0000
Authentication-Results: spf=pass (sender IP is 209.85.128.69)
smtp.mailfrom=gmail.com; dkim=pass (signature was verified)
header.d=google.com;dkim=pass (signature was verified)
header.d=gmail.com;dmarc=pass action=none header.from=gmail.com;compauth=pass
reason=100
Received-SPF: Pass (protection.outlook.com: domain of gmail.com designates
209.85.128.69 as permitted sender) receiver=protection.outlook.com;
client-ip=209.85.128.69; helo=mail-wm1-f69.google.com; pr=C
Received: from mail-wm1-f69.google.com (209.85.128.69) by
DS2PEPF000061C1.mail.protection.outlook.com (10.167.23.68) with Microsoft
SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.159.10
via Frontend Transport; Wed, 24 Jun 2026 16:03:33 +0000
X-IncomingTopHeaderMarker:
OriginalChecksum:F6CA307189B8C1BDD5ECD583FFC9DB5389DD1CD9ED0075D0930575B56771A862;UpperCasedChecksum:5CDE3BB996492EA290597E0300626D9C666E311B758E0F7B161FD7773759CEC2;SizeAsReceived:3408;Count:15
Received: by mail-wm1-f69.google.com with SMTP id 5b1f17b1804b1-490ace40f13so4714385e9.3
for; Wed, 24 Jun 2026 09:03:33 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=google.com; s=20251104; t=1782317011; x=1782921811; darn=groups.outlook.com;
h=to:from:subject:date:message-id:sender:reply-to:mime-version:from
:to:cc:subject:date:message-id:reply-to;
bh=j7qfQbefDIbcnfG9WW3mIdExZQVh+Wrvf5mRvOAU8KQ=;
b=LvfkABFDBqM+yn4mjvIqFreAv4O4GSWBCkXXR6+1GCI0F2YO8HY8sOXRryPLbAFN/Z
9pWkswnotzir0i/DuIQYLA67Fck2oLpEifY89Ab2dkKMwZ11bKU/3qKwREJbEuXscjs2
+Mbpk/FjJa3SoTEgwn/gsQJdyjG8AgQp7nFwCm3KDHF3cJDk7e13YesYoaFusOutXLly
N97cIajliqgMgaNqmpiFVGQd7ef49PqVogPVDkhMULKIu4SojOy3Yz27X6HhjzCzRFjf
CcIRHXRxkfuF+erVv+nIXTLWsz+T2RRp2csipoSQuZ4D6CxGFyfttemcRaSSSawNWHu8
V0QQ==
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20251104; t=1782317011; x=1782921811; darn=groups.outlook.com;
h=to:from:subject:date:message-id:sender:reply-to:mime-version:from
:to:cc:subject:date:message-id:reply-to;
bh=j7qfQbefDIbcnfG9WW3mIdExZQVh+Wrvf5mRvOAU8KQ=;
b=dQXkCgx1VmzSiFGtD3MihbE4sPXPC4cfla6ysgnahnM8vxQ6SlQT66Q+blHOHahr1i
v1bwYD1s3bFDqdJg75t24i5nCMyA8jPwc21jQctryJFbfLmCLT/hTP2GXaPwCExLlCw+
M3vpXQR5sUteR7MV4tjce/I6SBN4gdLRMhjW6zqKCaKOMxuymuAV7IOgiNfHBixHuH12
LoUscZ/0DPHGTnBMdtP8mmFxriDXZbGn/QgAc6Au82EXWMGx49x5uk0PuxzDBGrWaivI
l+WBKFb/d4VKoUjzQZM9PDgiWm1hG4ew3006CM2GHcbgbeJx3RO6C3QIEOfPVxeMpYT2
I1Lg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20251104; t=1782317011; x=1782921811;
h=to:from:subject:date:message-id:sender:reply-to:mime-version
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
bh=j7qfQbefDIbcnfG9WW3mIdExZQVh+Wrvf5mRvOAU8KQ=;
b=ftFs2gP5xrSySmZb2o16jTOeoVG93AwsjkZdYUSJYXziGSd2vSMC/rCEZpsztdg+ja
KtoaBRD4Q//MOznNh7sL4rNQwQwyQKPOFQxjwwZQqsjinpvXQyCwM2aQje1S0MtGVFDT
01gya+CuaBjjBP3LAszQ8UKolZaDRP2z8uuTuK+oYZXdwQ7BwZgCPpnfVWMyTkby08Mo
NROkUZpp9FuZ69HhxEEN4/4oHQLIQLeNKbzgjlWLCYgpXzYYxkxun8mNxbGNDG8SKGBC
DFyoh1FsD+KARN44kPVUf1gxr6kuMunLWUYCOHXcGUgTDg0iRasi1pKAKyycVLLAdCqT
YwZw==
X-Gm-Message-State: AOJu0YwI/cbxohlPBDFAs9JITlRclyhxfYhJSKUSqFupxvl4XlBJgZOF
d0xcOcV0oiA3W48Cd3/WremfZB9UjrHrwt25LIx64aybzI9d4YkuyXg9kYg8nBJh0mXApRU8Lbb
6epHah2zIxNo5DoIc8SEMOJARa7Z3orL6S8c=
MIME-Version: 1.0
X-Received: by 2002:a05:600c:4f56:b0:490:d354:bcf4 with SMTP id
5b1f17b1804b1-49260875aa9mr56965115e9.27.1782317011543; Wed, 24 Jun 2026
09:03:31 -0700 (PDT)
Reply-To: Haresasz Nxysarwsa
Sender: =?UTF-8?Q?Kalend=C3=A1r_Google?=
Message-ID:
Date: Wed, 24 Jun 2026 16:03:31 +0000
Subject: =?UTF-8?Q?Pozv=C3=A1nky=3A_Important_Transaction_Alert_=2D_BTC_Order_S?=
=?UTF-8?Q?ubmitted_=40_st_24=2E_j=C3=BAn_2026_=28cynthiaperez389903=40groups=2Eoutlo?=
=?UTF-8?Q?ok=2Ecom=29?=
From: Haresasz Nxysarwsa
To: cynthiaperez389903@groups.outlook.com
Content-Type: multipart/mixed; boundary="00000000000059ac340655020496"
X-IncomingHeaderCount: 15
X-EOPAttributedMessage: 0
X-EOPTenantAttributedMessage: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa:0
X-MS-PublicTrafficType: Email
X-MS-TrafficTypeDiagnostic: DS2PEPF000061C1:EE_|SJ0PR18MB3948:EE_
X-MS-Office365-Filtering-Correlation-Id: 8d1e42fe-8a60-4f7b-18a6-08ded20a2420
X-MS-Exchange-EOPDirect: true
X-Sender-IP: 209.85.128.69
X-SID-PRA: HARESSAZNZXRRSXAXZ321@GMAIL.COM
X-SID-Result: PASS
X-MS-Consumer-Group-Expansion-Loop: cynthiaperez389903@groups.outlook.com
X-MS-Exchange-Group-Expansion-Loop: cynthiaperez389903@groups.outlook.com
X-Microsoft-Antispam:
BCL:0;ARA:1444111002|3151999006|5139299004|26000799027|9400799043|9020799019|9000799056|29080799009|32020799003|1680799066|6019299003|26130799012|34130799006|16200799027|6092099016|970799063|3069299007|6149299003|16001999021|4040799016|22000799015|24102599021|3412199025|4302099013|1602099012|1041999012|2145499017|30041999003|21002599022;
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 24 Jun 2026 13:18:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))
(envelope-from
id 1wcT5r-000000001tJ-0YwY
for dave@doctor.nl2k.ab.ca;
Wed, 24 Jun 2026 13:17:03 -0600
Resent-From: The Doctor
Resent-Date: Wed, 24 Jun 2026 13:17:03 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-westus2azlp17010076.outbound.protection.outlook.com ([40.93.10.76]:14863 helo=CO1PR03CU002.outbound.protection.outlook.com)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384
(Exim 4.99.3 (FreeBSD))
(envelope-from
id 1wcQ5e-00000000EIO-2v7v
for doctor@doctor.nl2k.ab.ca;
Wed, 24 Jun 2026 10:04:50 -0600
Received: from DS7PR03CA0276.namprd03.prod.outlook.com (2603:10b6:5:3ad::11)
by SJ0PR18MB3948.namprd18.prod.outlook.com (2603:10b6:a03:2ea::20) with
Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.159.14; Wed, 24 Jun
2026 16:03:33 +0000
Received: from DS2PEPF000061C1.namprd02.prod.outlook.com
(2603:10b6:5:3ad:cafe::12) by DS7PR03CA0276.outlook.office365.com
(2603:10b6:5:3ad::11) with Microsoft SMTP Server (version=TLS1_3,
cipher=TLS_AES_256_GCM_SHA384) id 15.21.159.13 via Frontend Transport; Wed,
24 Jun 2026 16:03:33 +0000
Authentication-Results: spf=pass (sender IP is 209.85.128.69)
smtp.mailfrom=gmail.com; dkim=pass (signature was verified)
header.d=google.com;dkim=pass (signature was verified)
header.d=gmail.com;dmarc=pass action=none header.from=gmail.com;compauth=pass
reason=100
Received-SPF: Pass (protection.outlook.com: domain of gmail.com designates
209.85.128.69 as permitted sender) receiver=protection.outlook.com;
client-ip=209.85.128.69; helo=mail-wm1-f69.google.com; pr=C
Received: from mail-wm1-f69.google.com (209.85.128.69) by
DS2PEPF000061C1.mail.protection.outlook.com (10.167.23.68) with Microsoft
SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.159.10
via Frontend Transport; Wed, 24 Jun 2026 16:03:33 +0000
X-IncomingTopHeaderMarker:
OriginalChecksum:F6CA307189B8C1BDD5ECD583FFC9DB5389DD1CD9ED0075D0930575B56771A862;UpperCasedChecksum:5CDE3BB996492EA290597E0300626D9C666E311B758E0F7B161FD7773759CEC2;SizeAsReceived:3408;Count:15
Received: by mail-wm1-f69.google.com with SMTP id 5b1f17b1804b1-490ace40f13so4714385e9.3
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=google.com; s=20251104; t=1782317011; x=1782921811; darn=groups.outlook.com;
h=to:from:subject:date:message-id:sender:reply-to:mime-version:from
:to:cc:subject:date:message-id:reply-to;
bh=j7qfQbefDIbcnfG9WW3mIdExZQVh+Wrvf5mRvOAU8KQ=;
b=LvfkABFDBqM+yn4mjvIqFreAv4O4GSWBCkXXR6+1GCI0F2YO8HY8sOXRryPLbAFN/Z
9pWkswnotzir0i/DuIQYLA67Fck2oLpEifY89Ab2dkKMwZ11bKU/3qKwREJbEuXscjs2
+Mbpk/FjJa3SoTEgwn/gsQJdyjG8AgQp7nFwCm3KDHF3cJDk7e13YesYoaFusOutXLly
N97cIajliqgMgaNqmpiFVGQd7ef49PqVogPVDkhMULKIu4SojOy3Yz27X6HhjzCzRFjf
CcIRHXRxkfuF+erVv+nIXTLWsz+T2RRp2csipoSQuZ4D6CxGFyfttemcRaSSSawNWHu8
V0QQ==
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20251104; t=1782317011; x=1782921811; darn=groups.outlook.com;
h=to:from:subject:date:message-id:sender:reply-to:mime-version:from
:to:cc:subject:date:message-id:reply-to;
bh=j7qfQbefDIbcnfG9WW3mIdExZQVh+Wrvf5mRvOAU8KQ=;
b=dQXkCgx1VmzSiFGtD3MihbE4sPXPC4cfla6ysgnahnM8vxQ6SlQT66Q+blHOHahr1i
v1bwYD1s3bFDqdJg75t24i5nCMyA8jPwc21jQctryJFbfLmCLT/hTP2GXaPwCExLlCw+
M3vpXQR5sUteR7MV4tjce/I6SBN4gdLRMhjW6zqKCaKOMxuymuAV7IOgiNfHBixHuH12
LoUscZ/0DPHGTnBMdtP8mmFxriDXZbGn/QgAc6Au82EXWMGx49x5uk0PuxzDBGrWaivI
l+WBKFb/d4VKoUjzQZM9PDgiWm1hG4ew3006CM2GHcbgbeJx3RO6C3QIEOfPVxeMpYT2
I1Lg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20251104; t=1782317011; x=1782921811;
h=to:from:subject:date:message-id:sender:reply-to:mime-version
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
bh=j7qfQbefDIbcnfG9WW3mIdExZQVh+Wrvf5mRvOAU8KQ=;
b=ftFs2gP5xrSySmZb2o16jTOeoVG93AwsjkZdYUSJYXziGSd2vSMC/rCEZpsztdg+ja
KtoaBRD4Q//MOznNh7sL4rNQwQwyQKPOFQxjwwZQqsjinpvXQyCwM2aQje1S0MtGVFDT
01gya+CuaBjjBP3LAszQ8UKolZaDRP2z8uuTuK+oYZXdwQ7BwZgCPpnfVWMyTkby08Mo
NROkUZpp9FuZ69HhxEEN4/4oHQLIQLeNKbzgjlWLCYgpXzYYxkxun8mNxbGNDG8SKGBC
DFyoh1FsD+KARN44kPVUf1gxr6kuMunLWUYCOHXcGUgTDg0iRasi1pKAKyycVLLAdCqT
YwZw==
X-Gm-Message-State: AOJu0YwI/cbxohlPBDFAs9JITlRclyhxfYhJSKUSqFupxvl4XlBJgZOF
d0xcOcV0oiA3W48Cd3/WremfZB9UjrHrwt25LIx64aybzI9d4YkuyXg9kYg8nBJh0mXApRU8Lbb
6epHah2zIxNo5DoIc8SEMOJARa7Z3orL6S8c=
MIME-Version: 1.0
X-Received: by 2002:a05:600c:4f56:b0:490:d354:bcf4 with SMTP id
5b1f17b1804b1-49260875aa9mr56965115e9.27.1782317011543; Wed, 24 Jun 2026
09:03:31 -0700 (PDT)
Reply-To: Haresasz Nxysarwsa
Sender: =?UTF-8?Q?Kalend=C3=A1r_Google?=
Message-ID:
Date: Wed, 24 Jun 2026 16:03:31 +0000
Subject: =?UTF-8?Q?Pozv=C3=A1nky=3A_Important_Transaction_Alert_=2D_BTC_Order_S?=
=?UTF-8?Q?ubmitted_=40_st_24=2E_j=C3=BAn_2026_=28cynthiaperez389903=40groups=2Eoutlo?=
=?UTF-8?Q?ok=2Ecom=29?=
From: Haresasz Nxysarwsa
To: cynthiaperez389903@groups.outlook.com
Content-Type: multipart/mixed; boundary="00000000000059ac340655020496"
X-IncomingHeaderCount: 15
X-EOPAttributedMessage: 0
X-EOPTenantAttributedMessage: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa:0
X-MS-PublicTrafficType: Email
X-MS-TrafficTypeDiagnostic: DS2PEPF000061C1:EE_|SJ0PR18MB3948:EE_
X-MS-Office365-Filtering-Correlation-Id: 8d1e42fe-8a60-4f7b-18a6-08ded20a2420
X-MS-Exchange-EOPDirect: true
X-Sender-IP: 209.85.128.69
X-SID-PRA: HARESSAZNZXRRSXAXZ321@GMAIL.COM
X-SID-Result: PASS
X-MS-Consumer-Group-Expansion-Loop: cynthiaperez389903@groups.outlook.com
X-MS-Exchange-Group-Expansion-Loop: cynthiaperez389903@groups.outlook.com
X-Microsoft-Antispam:
BCL:0;ARA:1444111002|3151999006|5139299004|26000799027|9400799043|9020799019|9000799056|29080799009|32020799003|1680799066|6019299003|26130799012|34130799006|16200799027|6092099016|970799063|3069299007|6149299003|16001999021|4040799016|22000799015|24102599021|3412199025|4302099013|1602099012|1041999012|2145499017|30041999003|21002599022;