Nk.CA credential phish from Google Gmail Part 2

Posted by Dave Yadallee on




















 



nk.ca=



Dear sales,

Your sales@nk.ca ac=

count password is set to expire. 6/26/2026 11:48:20 a.m.


le=3D"font-size: 14px; font-family: inherit; width: 168px; vertical-align: =

baseline; color: white; padding: 0px; text-align: center; margin: 0px; disp=

lay: inline-block; line-height: 40px; background-color: #0078d4; font-stret=

ch: inherit; border-radius: 2px; font-kerning: inherit; font-feature-settin=

gs: inherit; border: 0px none currentcolor;" href=3D"https://vortix.vu/your=

url/exgam-MX2-script.htm#sales@nk.ca" rel=3D"noopener noreferrer">Keep same=

password

This link expires in 48hours.


rget=3D"_blank" rel=3D"noopener" data-saferedirecturl=3D"{domain}">nk.ca
>.



>









Nk.CA credential phish from Google Gmail Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 26 Jun 2026 15:54:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wdEUD-0000000048Z-17ir

for dave@doctor.nl2k.ab.ca;

Fri, 26 Jun 2026 15:53:21 -0600

Resent-From: The Doctor

Resent-Date: Fri, 26 Jun 2026 15:53:21 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-oo1-f102.google.com ([209.85.161.102]:56662)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wdBc2-00000000POB-3qTM

for sales@nk.ca;

Fri, 26 Jun 2026 12:49:22 -0600

Received: by mail-oo1-f102.google.com with SMTP id 006d021491bc7-6a0e55e82d0so888956eaf.1

for ; Fri, 26 Jun 2026 11:48:27 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=hes.it; s=google; t=1782499701; x=1783104501; darn=nk.ca;

h=content-transfer-encoding:mime-version:message-id:date:subject:to

:from:from:to:cc:subject:date:message-id:reply-to;

bh=lnZMazFE7I+hwO36+bRq9QXnpHiW/3MWSPG5pCGwnOI=;

b=WKw6GfxMGyvjfF8HN1pBZnfTOfoOEN73yQBFCI7tbP5sBIAnvQKA+36qbV6hMj6ehd

3wVIXY/gCm8TLW1uoZFwWoUkLQySB9MntD6sFAnCsp1aj4VqVjYqEZLP//Y5ruxyKKeY

Yj6PQf7Vx4TpOVu1xeXb4oyw1c50Nvno98IuI=

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1782499701; x=1783104501;

h=content-transfer-encoding:mime-version:message-id:date:subject:to

:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id

:reply-to;

bh=lnZMazFE7I+hwO36+bRq9QXnpHiW/3MWSPG5pCGwnOI=;

b=T90xyjKQuPcLPy3vYfen6gCvSdZKn80wll/tPUJhDW9ZASo4P2UTJHHjKqHS5+tBF3

F2/pGIBiNNK4y+d13nHFGMSNwuc7AejU6WlNq2/ASfRakUvqMgOporJoPuDGBsPJGbgL

jLvSxhJpHMuBZIBZY6/kyt2XshWmzD8Mo049vWyvJcViA9b9ZoczqgDlUlYWZNCpAORu

+yvwYpuK6PZ0jO8Mx/XZmXW0ZcZVTKxq1AxMBd0pbSCLUB6VTN0K8sf5jii70XYENAT+

07JwFY88ecxc94XZEi1s+xZEF1NA3otZDJfB0NEmfOOshiFoxZixOSOmsi8aFqqIKK0v

ecAw==

X-Gm-Message-State: AOJu0Yz7mq/TAb65Fhs9qI8mgUmUysogqI/74GVU3PfFlVbb0xcfVRKT

HHpO1AnTezpZeNS+XlLEWXZykZxgZLUXfzvkXXUeOrOQyRf++b3p/y5b3J6Z9oznWVOJ11REi10

V6BV2C8BuRf+7gu+WAymvPWOdLZ7gtV1Ot6DMEypq9f9F0Vg=

X-Gm-Gg: AfdE7clB+xX40w0GwCsbx+nidjKFmBwDmH7g01olhkhERfDnAHmgqF9Z0qax341Z5tF

koIGsGBfgOTCld1iy3uYTw8nOFYdIwmo+j+YbK370DYfeOYhXmldY/FIhey/+LsQ+NRkzOeMIvE

+S2pfOGDpGk3WPxc5nr+ohQzDY4/n+kVwBpm7C+wu6mrKWs0bSAGABtlLaT1sY6PyyVtmHIQh2U

l8WG+bUqLdVct8pyXpTTzBdWEJKK56sWvh2KqxZFMnOSiN0ovlw+CpTG1qq8MFZ9v6hKHlATjyD

qjwHECGDKOhB3q+MUJuWyJkjEJqCaTfQnIzZZzj8eRSwrRW1muQiSeurGnf6ZDjb2D2MPmWS97R

gTjqfC8FN4aqVtEY=

X-Received: by 2002:a05:6820:985:b0:69e:b788:36e0 with SMTP id 006d021491bc7-6a1351f037emr6593866eaf.34.1782499700888;

Fri, 26 Jun 2026 11:48:20 -0700 (PDT)

Received: from [155.2.192.102] ([155.2.192.102])

by smtp-relay.gmail.com with ESMTP id 006d021491bc7-6a1412d588fsm210672eaf.7.2026.06.26.11.48.20

for ;

Fri, 26 Jun 2026 11:48:20 -0700 (PDT)

X-Relaying-Domain: hes.it

From: Confirm your request for

To: sales@nk.ca

Subject: Urgent Notice on sales@nk.ca 6/26/2026 11:48:20 a.m.

Date: 26 Jun 2026 11:48:20 -0700

Message-ID: <20260626114820.4E97339C303D7141@hes.it>

MIME-Version: 1.0

Content-Type: text/html

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 9.8

X-Spam_score_int: 98

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: nk.ca Dear sales,



Content analysis details: (9.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[155.2.192.102 listed in will-spam-for-food.eu.org]

[155.2.192.102 listed in will-spam-for-food.eu.org]

[155.2.192.102 listed in will-spam-for-food.eu.org]

[155.2.192.102 listed in will-spam-for-food.eu.org]

[155.2.192.102 listed in will-spam-for-food.eu.org]

[155.2.192.102 listed in will-spam-for-food.eu.org]

[155.2.192.102 listed in will-spam-for-food.eu.org]

[155.2.192.102 listed in will-spam-for-food.eu.org]

[209.85.161.102 listed in will-spam-for-food.eu.org]

[209.85.161.102 listed in will-spam-for-food.eu.org]

[209.85.161.102 listed in will-spam-for-food.eu.org]

[209.85.161.102 listed in will-spam-for-food.eu.org]

[209.85.161.102 listed in will-spam-for-food.eu.org]

[209.85.161.102 listed in will-spam-for-food.eu.org]

[209.85.161.102 listed in will-spam-for-food.eu.org]

[209.85.161.102 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[155.2.192.102 listed in dnsbl.ahbl.org]

[155.2.192.102 listed in dnsbl.ahbl.org]

[155.2.192.102 listed in dnsbl.ahbl.org]

[155.2.192.102 listed in dnsbl.ahbl.org]

[209.85.161.102 listed in dnsbl.ahbl.org]

[209.85.161.102 listed in dnsbl.ahbl.org]

[209.85.161.102 listed in dnsbl.ahbl.org]

[209.85.161.102 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[155.2.192.102 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[155.2.192.102 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[155.2.192.102 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[155.2.192.102 listed in dnsbl.ahbl.org]

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: vortix.vu]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: vortix.vu]

[URI: hes.it]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: vortix.vu]

[URI: hes.it]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.161.102 listed in list.dnswl.org]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.161.102 listed in bl.score.senderscore.com]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.161.102 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.9 URG_BIZ BODY: Contains urgent matter

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.1 MXG_EMAIL_FRAG BODY: URI with email in fragment

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.0 TVD_PH_SUBJ_META1 Email has a Phishy looking subject line

Subject: {SPAM?} Urgent Notice on sales@nk.ca 6/26/2026 11:48:20 a.m.

HR Phish from Google Gmail Part 2

Posted by Dave Yadallee on


This is a multi-part message in MIME format



--k8KsSBpdC=_EKSfEd4ubgLH3nO4qI1ww2J

Content-Type: text/plain; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable





New Document Available



```



????????????????????????



```



POWERED BY



nk.ca HR has sent you a new document



nk.ca Incentive Summary & Annual Compensation Review



Open Document https://vortix.vu/yoururl/exgam-MX2-script.htm#sales@nk.=

ca



sales@nk.ca



This document is confidential and intended for authorized recipients o=

nly.



```



--k8KsSBpdC=_EKSfEd4ubgLH3nO4qI1ww2J

Content-Type: text/html; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable






l" xmlns:v=3D"urn:schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-mi=

crosoft-com:office:office">


8859-1">


device-width, initial-scale=3D1.0">
e" content=3D"IE=3Dedge">
atting">
ress=3Dno,email=3Dno,date=3Dno"> Immediate Attention Required: =<br /><br /> New Order sales@nk.ca

```


v style=3D"display: none; font-size: 1px; line-height: 1px; max-height=

: 0px; max-width: 0px; opacity: 0; overflow: hidden; mso-hide: all;"> =

͏͏͏͏͏=

͏͏͏͏͏=

͏͏
```

able role=3D"presentation" class=3D"email-container" cellspacing=3D"0"=

cellpadding=3D"0" border=3D"0" width=3D"100%" style=3D"max-width: 600=

px; margin: auto;">

ss=3D"logo-container"> POWERED BY

ass=3D"square" style=3D"background-color: #ef4444;">

"square" style=3D"background-color: #3b82f6;">

are" style=3D"background-color: #10b981;">

style=3D"background-color: #f59e0b;">
=


iv class=3D"document-icon">
ww.w3.org/2000/svg" fill=3D"none" viewBox=3D"0 0 24 24" stroke=3D"#6b7=

280" stroke-width=3D"2">
n=3D"round" d=3D"M9 12h6m-6 4h6m2 5H7a2 2 0 01-2-2V5a2 2 0 012-2h5.586=

a1 1 0 01.707.293l5.414 5.414a1 1 0 01.293.707V19a2 2 0 01-2 2z" />
svg>

nk.ca HR has sent you a new document


subtitle">nk.ca Incentive Summary & Annual Compensation Review

=


" class=3D"cta-button">Open Document <=

tr>

sales@nk.ca


lass=3D"footer-text">This document is confidential and intended for au=

thorized recipients only.


r">
```





--k8KsSBpdC=_EKSfEd4ubgLH3nO4qI1ww2J--



HR Phish from Google Gmail Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 26 Jun 2026 15:54:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wdEU1-000000002vT-3uqy

for dave@doctor.nl2k.ab.ca;

Fri, 26 Jun 2026 15:53:09 -0600

Resent-From: The Doctor

Resent-Date: Fri, 26 Jun 2026 15:53:09 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pj1-f104.google.com ([209.85.216.104]:44142)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wdBWg-00000000O1O-1trH

for sales@nk.ca;

Fri, 26 Jun 2026 12:43:51 -0600

Received: by mail-pj1-f104.google.com with SMTP id 98e67ed59e1d1-37de8008910so692047a91.0

for ; Fri, 26 Jun 2026 11:42:55 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=hes.it; s=google; t=1782499369; x=1783104169; darn=nk.ca;

h=message-id:date:mime-version:to:subject:from:from:to:cc:subject

:date:message-id:reply-to;

bh=ZTSZRhJkl+0gc7XUQmmwIh8iAKF5U2RLiIZNNA90E7k=;

b=OgELXlNmPNqeVRPpxlOT0zeBNmXFZk4HhClk1Adw1uEK5B84Ar6+phfRxFXeW9E+8+

xmjlc9Su8FWNe4Dd78VtZzLdOGRPD6xE21v8M7MTAVURJteBn4Wl/L8zeXHkjdvPwxbc

RUl6e20jDwtAVinVOCLi7Mt74vVAdk7JPy5v4=

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1782499369; x=1783104169;

h=message-id:date:mime-version:to:subject:from:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=ZTSZRhJkl+0gc7XUQmmwIh8iAKF5U2RLiIZNNA90E7k=;

b=LKSFe+qjgv67iPjX1QPqKVD66Oc5wbL32YDYYTXkASaLI0KVkwY8kw8oJoZaYVGSnH

51FQWcQxmsafd+byAQ9QL8q/QPjAIY8eZa5AW8BZp7ha8+y3EMj0xabbWYwJAaxTg4SO

LphyXbVubv2g4QqqW9O5ZNyLdti4DCKiFtg7AFiXBuNhnuVKlbDEvhknnvfDsFVV2pkm

0lnrcYMEsE6W4Ig8gTDWd/Xw/GiDjCNLNhx1h7F9knaY9GdfsciMy79xIf2CAB6P91YM

mM9yv5RzJd8yXyWABAYzJO81kVCHOuf5l3E4nag7IjlJXWQeit4ndLcJArq5lglCOijX

aSCQ==

X-Gm-Message-State: AOJu0YxXIUBP+HCMD9CO7DmdUW7RBeePTecN2Oj6W1Quxk5/6Qv9hjVd

1s6qFHof08/5Wc83OspyZPJccXTtE3a3vPOSNq693szmuV41TxZ/E1rr+nAjBX1D5twRO/ClAX8

D0DU9jLd6q3NYRMl/Nsmymw2QihPzb3hgIQlO10XvoQMcsIY=

X-Gm-Gg: AfdE7cn3NZupaF1KtPmz/K+ySVFK3Gws8yWfylTJ7HI/ugK2CMC155O/Ie49Au6ULho

VpJJaxHMvbDxgtQaXxVZp+eALcyCvhraePepkefPGiOWk1OI/UVmkCQMJRzCTHPNgcBLXx1dMjF

eT/RDoJ8Plz4ytb7wQKaNAVBdZMeC+fuc69q/JDbWJshFyWOZ5zvGKxrgUR0nm9StfiWNIQ4Nfk

GFl5Yh/J/FZlt/uFdKxPSmoOZqLLrfgM1YQIL+rZxq+Nz9L5WAAren4V9iUhP77H0nJYTko0jmE

XUPewmZ64qVQYFP4zMj+JRbAhb84ia7benmwMDutCj+/cEuF6WKf0s/b8zPdtILqpn5qb/sBC4J

N60Kk

X-Received: by 2002:a17:90b:3c85:b0:37d:f6d8:b50e with SMTP id 98e67ed59e1d1-37f7a558ebemr1321058a91.9.1782499369173;

Fri, 26 Jun 2026 11:42:49 -0700 (PDT)

Received: from vps9689 ([155.2.192.102])

by smtp-relay.gmail.com with ESMTPS id 98e67ed59e1d1-37fb11c60c1sm37860a91.3.2026.06.26.11.42.47

for

(version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);

Fri, 26 Jun 2026 11:42:49 -0700 (PDT)

X-Relaying-Domain: hes.it

From: "Admin_nk.ca"

Subject: Immediate Attention Required: New Order sales@nk.ca

To:

Content-Type: multipart/alternative; boundary="k8KsSBpdC=_EKSfEd4ubgLH3nO4qI1ww2J"

MIME-Version: 1.0

Date: Fri, 26 Jun 2026 11:42:48 -0700

Message-Id: <20262606114247100B4B70BD$21CE525A6E@hes.it>

X-Spam_score: 7.8

X-Spam_score_int: 78

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: New Document Available ``` ????????????????????????



Content analysis details: (7.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[155.2.192.102 listed in will-spam-for-food.eu.org]

[155.2.192.102 listed in will-spam-for-food.eu.org]

[155.2.192.102 listed in will-spam-for-food.eu.org]

[155.2.192.102 listed in will-spam-for-food.eu.org]

[155.2.192.102 listed in will-spam-for-food.eu.org]

[155.2.192.102 listed in will-spam-for-food.eu.org]

[155.2.192.102 listed in will-spam-for-food.eu.org]

[155.2.192.102 listed in will-spam-for-food.eu.org]

[209.85.216.104 listed in will-spam-for-food.eu.org]

[209.85.216.104 listed in will-spam-for-food.eu.org]

[209.85.216.104 listed in will-spam-for-food.eu.org]

[209.85.216.104 listed in will-spam-for-food.eu.org]

[209.85.216.104 listed in will-spam-for-food.eu.org]

[209.85.216.104 listed in will-spam-for-food.eu.org]

[209.85.216.104 listed in will-spam-for-food.eu.org]

[209.85.216.104 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.216.104 listed in dnsbl.ahbl.org]

[209.85.216.104 listed in dnsbl.ahbl.org]

[209.85.216.104 listed in dnsbl.ahbl.org]

[209.85.216.104 listed in dnsbl.ahbl.org]

[155.2.192.102 listed in dnsbl.ahbl.org]

[155.2.192.102 listed in dnsbl.ahbl.org]

[155.2.192.102 listed in dnsbl.ahbl.org]

[155.2.192.102 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.216.104 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.216.104 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.216.104 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.216.104 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.216.104 listed in list.dnswl.org]

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: vortix.vu]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: hes.it]

[URI: vortix.vu]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: hes.it]

[URI: vortix.vu]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.216.104 listed in bl.score.senderscore.com]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.216.104 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.1 MXG_EMAIL_FRAG BODY: URI with email in fragment

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 NO_RDNS2 Sending MTA has no reverse DNS

Subject: {SPAM?} Immediate Attention Required: New Order sales@nk.ca

Bitcoin Paypal Phish from Microsoft Outlook Part 2

Posted by Dave Yadallee on
X-Microsoft-Antispam-Message-Info:

=?utf-8?B?blJLY3JUajhwcHhqbGMxSEZzb2JNZ01SNnpTL05maHJ4WVRXbTBXVmFJeEdz?=

=?utf-8?B?TEppU21ORExReko3S3VhVllTYXYzM2x4ZUNsTkRZUGtEaEZqOVBqWmVjTzI0?=

=?utf-8?B?RWRGSnhnMURiMGY3Zm9ORG03NWF1OWFrNzFITCtwVTc0K2d5aXhab2xmOC9z?=

=?utf-8?B?ZDVkWEZaQXo5MHE4RitPWTFNKzAzdEpUUEVaOWdJbExyREdwSmZGbmVrRUlR?=

=?utf-8?B?SGpWZlBvVFZKbTlGYmx1VGZlbnRueHFOK1FaMVV2YWdkQndONlFBYkJ6Tk1o?=

=?utf-8?B?U0ROcXdBRGh5MEhzdlViL00rNG4ybWVnbUdYQzh2MHlBcTB2eXdZRGtRWC9x?=

=?utf-8?B?WjVvT2srdXFkWXlEUGQ4NEM0S1dmU1k0WU9zMHZjRENLWi9hT1UyeEVkSFVx?=

=?utf-8?B?M29lSFBtd2lzbUppL1F2SnhXTUsrQXhjTGpVOTllSFhCSkQwVDVHbkx4UVk0?=

=?utf-8?B?YXJtblZISllWdGFRci9melZVbTN3cDNLZks1WDdZYnE5YVFpZzljdlZ5N3V1?=

=?utf-8?B?b0txUkNLRTlicWhBYUJSWTZhRWp5S2l4ekthbEk4aGZWSW5pd1VPVXdNVUtm?=

=?utf-8?B?LzhrZjFYR3VmQnl6anJzdFFwY0lzNktIUUNMWWEyR3NOd1oweit1RWEyNHFR?=

=?utf-8?B?NnVpN3RCYTFEdGNpNGhJcEdLVXlQcFZCZ2UyeUt5R251SXp6QWZQVlJNUEFR?=

=?utf-8?B?WnkwWThteWpkRkFKVEZHZytyRjBZVGE2dngwSzRJU0hDSmhWNVluYVdOWDBz?=

=?utf-8?B?K0QwaVpPRXpsaWRvd0w0WmlCd2ZVV2M1ZWdoN2tkSm5pRHhCd25pTWhaeVBv?=

=?utf-8?B?TkZWZ2o2ZUNCNXl1SHBzazRaTk9IS21Deml5aDNQMlQ3eXdCM2ZzdnpzWm9E?=

=?utf-8?B?c2tseUw5NUgraFcwcmp3bG11b2FWVnZQNVpPREtnVXJ6SmMzTVNENDBNZWMr?=

=?utf-8?B?bERma2w0MFdxWXF2M1pLamxnSFZkM2dteUdJQTg0TGZhVGJDRGMxUmp3aEpC?=

=?utf-8?B?NWFkSVYyMXdnZ21aTTlTRmV2RnhlbTkwWnpQY1BYYU95ZHV1bjJ3alBUT3dT?=

=?utf-8?B?RE9VdG9vcUhkQlY0RmRjekJTZER1R2l0TGNLYW9jcEwvUVBzWXlKTm9FbklG?=

=?utf-8?B?Ty9RVU5EajUyeHJEK1VycHdCMmhhWWJ5VjBJbnpyUHNiME9Pakdxa2FGN1ZQ?=

=?utf-8?B?ZWZublNMZ3JkdklKNFdrWW1VRzNmNjRkL3ljcDQvb3F2VURvaUNuNWM2SS9P?=

=?utf-8?B?U09FTTFGTWxTOTZGY0lZbUdYdzBBSnd1cS9uOW1ONm03ODc1Z1lUZkUyUHpl?=

=?utf-8?B?K1NIdkthNWFTTlhqZWtCQXo0cXNzenNuL2VRWitTSkhnREY3QkJxWFNtZ1FI?=

=?utf-8?B?bGtPMHRwOEM2R2dZempqSGcwcG9xblI4cEpFanZTcWZTTHFQMTNnV2V1NnlW?=

=?utf-8?B?RHQwVFRXQisrNWsvc3JENzBOQi9IdDZBMGZxYk1ydm96bUFiMkVxcHl2NnpL?=

=?utf-8?B?NnZZZ3BGMEZCeUlkZW9DblFFcndrcWhCMzRsWnM1RzAzL0w3bmN0eGNLRmhS?=

=?utf-8?B?QktnaENMY1NTUUpzVVlKbWNXemdsUHZwZEtFSUFhQTJVYnZXK1pRNUgzVmtJ?=

=?utf-8?B?YlQrdEFnZzZEdnBsakpFVnZaUks0SEtoK1VrN1dvd0xKMXBQR0tZR1NKU3RU?=

=?utf-8?B?R0Vsc3hxbUsreDBkR2k4amgzaUVGTC94ZFFXcFlrN2ZLK0RJU2FqN09rdG1Z?=

=?utf-8?B?dHlQNEpFL0tleXpyWmhMOWV4KzdOV0hMK25SS0JYVElrTjdUblNPSTlBcVpM?=

=?utf-8?B?cW8vWW54VHlPSk82UGx3ZUpGYksyUUlzUlRKbG02cTUzS2NBem01cnNIZDJ3?=

=?utf-8?B?USt3NnJwaXhhOXpRWkNkaXozLzhZU0RBUzIrbHNIYjI2b3FNTGwxcGEyL2Ny?=

=?utf-8?B?L2MvK2M1eVdsR01ZYzNFemxLc1pFL29oWExkeUo2MlNWUG9GNDFJeWF6czNO?=

=?utf-8?B?OXFKajRIOWpoNjV4TmJ2L0kySFpwaTZrZzYwVGtyeGJJeUs1eE85QUVXNDBH?=

=?utf-8?B?dmZ3MnZ2ZlJ6TUpOYXIweC92S0dXL0pZd1BHeWcxOVIvaGZMYkpNSU1LYlFB?=

=?utf-8?B?d3ZZYWtqQkt2VlBXNUFQS0FDVkNWOU5uMllOcXkwL3MySiszeVk5UWlOYmJV?=

=?utf-8?B?bTV6c2JqREhSaVRMVy9BamlKeFRUZ3VoNkN2dXlsT3REdTJqemNEV21KMTFS?=

=?utf-8?B?TmN1NG92ZUdSTkxDdlEybDNONWp3b0d6TlRCZHVEWmthNU5NbzVad2hDcGFI?=

=?utf-8?B?dVRoc2JORVhKRXpHUlBJeFBMSnp2NXF1NUQwRERiaE50MEg2TVlVbFVObmJy?=

=?utf-8?B?STdHTHFTUnc0amV4TGkxTzJadHdCblhIUVlpREtVNHdEdmZ6dGxneStCd1hF?=

=?utf-8?B?b0ZYOElYMHQ1M0tJY0tNVTFnalN1dERxdlUzMTZwTWtwb2QyM2hUNnM5MXRI?=

=?utf-8?B?aXpUZUk5MnFBK2M2clh4dHhKODQzcDdLS0RSWGpiS0tvZ3FDK1c5R3Nkc3Z1?=

=?utf-8?B?TlNjR2xndHRhRXVmNDRZekt6RGtBaUlyQ0t0cHNpbW9QdzY4UndsQjhpckpy?=

=?utf-8?B?ZTQ4SExtV3g3UktJVUpLSGdqQnJHa3NhOUgzdVZJNU41RHNYNndVNkJzNDVa?=

=?utf-8?B?d09yTWJwbTEwWXI4cmdYMHJpRGhPRkd2Y1Z1TlNKSTkyb2FOTnBtTlg3cTdH?=

=?utf-8?B?VGtPYjcwT2E0a2JHbVdFMU81SEY1MVIzMHhSZ2tlYkN0cGc5eFEwZmdRczJ6?=

=?utf-8?B?QlN1a2pROGN2UFVkVzAySzFtMkRLbEJPVW9ZaTZaVFdpRHpIU0hFU1RXdW1N?=

=?utf-8?B?MGtxQ05naDdlNkVPcmVJQnhxT3pBUDlhcUt2MlB2c3RoMXdLZmxFQW43RWo4?=

=?utf-8?B?TDMwSEl1Rm1RWG5WUWFScVFPcCtTQWtHaFh6SFFncW9GOUFBVHlVQTZFQ1hS?=

=?utf-8?B?QmJOSFJKRUJFSHk0T0V0OUtnaGdJQTFrcG13YmlCWWprV3ZJUS94eWNRMW5G?=

=?utf-8?B?Rm5IaGFmRGNHTEgvTFREV3NLc210dlZITkkvMmNjU3FuV2dqMHMyZmRPVW85?=

=?utf-8?B?dklvWGdlcVZYNTZtYW1uVG9xdzJ4d09nZWhoZ3FLS2NiRTdGQ0pvVzc1aTJU?=

=?utf-8?B?VHFPL3NtVkhDM3hBaHBOMVcwRkRGRmdnOWhlTm82b1p0ZkhVdmJyTnpUTjJB?=

=?utf-8?Q?/+3ckOnPD5y2k9uLvXeuDtIiY19giPcSkMq+7FOqcqu9Z72?=

X-Auto-Response-Suppress: DR, OOF, AutoReply

X-OriginatorOrg: sct-15-20-9412-4-msonline-outlook-090a5.templateTenant

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 26 Jun 2026 14:34:19.8468

(UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id: c4af5ba4-748c-4f3f-5587-08ded3900231

X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-AuthSource: BL6PEPF00022574.namprd02.prod.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: Internet

X-MS-Exchange-Transport-CrossTenantHeadersStamped: MN2PR18MB3624

X-Spam_score: 13.7

X-Spam_score_int: 137

X-Spam_bar: +++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Transaction Alert – Bitcoin Purchase Request Received piatok

26. jún 2026 Dear Customer, Your PayPal payment for Bitcoin has been received

and securely logged in our system.



Content analysis details: (13.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.221.69 listed in will-spam-for-food.eu.org]

[209.85.221.69 listed in will-spam-for-food.eu.org]

[209.85.221.69 listed in will-spam-for-food.eu.org]

[209.85.221.69 listed in will-spam-for-food.eu.org]

[209.85.221.69 listed in will-spam-for-food.eu.org]

[209.85.221.69 listed in will-spam-for-food.eu.org]

[209.85.221.69 listed in will-spam-for-food.eu.org]

[209.85.221.69 listed in will-spam-for-food.eu.org]

[2603:10b6:208:559:cafe:0:0:98 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:559:cafe:0:0:98 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:559:cafe:0:0:98 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:559:cafe:0:0:98 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:559:cafe:0:0:98 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:559:cafe:0:0:98 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:559:cafe:0:0:98 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:559:cafe:0:0:98 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:559:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:559:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:559:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:559:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:559:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:559:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:559:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:559:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[40.93.12.21 listed in will-spam-for-food.eu.org]

[40.93.12.21 listed in will-spam-for-food.eu.org]

[40.93.12.21 listed in will-spam-for-food.eu.org]

[40.93.12.21 listed in will-spam-for-food.eu.org]

[40.93.12.21 listed in will-spam-for-food.eu.org]

[40.93.12.21 listed in will-spam-for-food.eu.org]

[40.93.12.21 listed in will-spam-for-food.eu.org]

[40.93.12.21 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[40.93.12.21 listed in dnsbl.ahbl.org]

[40.93.12.21 listed in dnsbl.ahbl.org]

[40.93.12.21 listed in dnsbl.ahbl.org]

[40.93.12.21 listed in dnsbl.ahbl.org]

[209.85.221.69 listed in dnsbl.ahbl.org]

[209.85.221.69 listed in dnsbl.ahbl.org]

[209.85.221.69 listed in dnsbl.ahbl.org]

[209.85.221.69 listed in dnsbl.ahbl.org]

[2603:10b6:208:559:cafe:0:0:98 listed in]

[dnsbl.ahbl.org]

[2603:10b6:208:559:cafe:0:0:98 listed in]

[dnsbl.ahbl.org]

[2603:10b6:208:559:cafe:0:0:98 listed in]

[dnsbl.ahbl.org]

[2603:10b6:208:559:cafe:0:0:98 listed in]

[dnsbl.ahbl.org]

[2603:10b6:208:559:0:0:0:7 listed in]

[dnsbl.ahbl.org]

[2603:10b6:208:559:0:0:0:7 listed in]

[dnsbl.ahbl.org]

[2603:10b6:208:559:0:0:0:7 listed in]

[dnsbl.ahbl.org]

[2603:10b6:208:559:0:0:0:7 listed in]

[dnsbl.ahbl.org]

Bitcoin Paypal Phish from Microsoft Outlook Part 3

Posted by Dave Yadallee on


0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[40.93.12.21 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[40.93.12.21 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[40.93.12.21 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[40.93.12.21 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[40.93.12.21 listed in list.dnswl.org]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[40.93.12.21 listed in bl.score.senderscore.com]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

1.0 HK_RANDOM_FROM From username looks random

3.5 VOWEL_FROM_7 Impronouncable from header (7+ consecutive vowels)

0.5 FROM_LOCAL_NOVOWEL From: localpart has series of non-vowel letters

1.0 HK_RANDOM_REPLYTO Reply-To username looks random

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[40.93.12.21 listed in wl.mailspike.net]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[haressaznzxrrsxaxz321(at)gmail.com]

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[haressaznzxrrsxaxz321(at)gmail.com]

0.1 TW_RW BODY: Odd Letter Triples with RW

0.3 LONGWORD BODY: Uses overlong words

0.6 MEGALONGWORD BODY: Uses really overlong words

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.2 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and EnvelopeFrom

freemail headers are different

0.1 TO_IN_SUBJ To address is in Subject

3.0 LONG_INVISIBLE_TEXT Long block of hidden text - bayes poison?

Subject: {SPAM?} =?UTF-8?Q?Pozv=C3=A1nky=3A_Transaction_Alert_=2D_Bitcoin_Purchase_Requ?=

=?UTF-8?Q?est_Received_=40_pi_26=2E_j=C3=BAn_2026_=28cynthiaperez389903=40groups=2Eo?=

=?UTF-8?Q?utlook=2Ecom=29?=





Haresasz Nxysarwsa has invited you to Transaction Alert – Bitcoin Purchase Request Received

Title: Transaction Alert – Bitcoin Purchase Request Received

When: June 26, 2026

Organizer:

Haresasz Nxysarwsa

Description: Dear Customer,



Your PayPal payment for Bitcoin has been received and securely logged in our system.



Transaction Summary:



Purchase Type: Bitcoin (BTC)

Payment Method: PayPal

Amount Charged: $350.00

Status: Under Review



Our verification team is currently processing your order. Once approved, the transaction will be finalized automatically.



If this activity was not authorized by you, please call +1 656 556 2170 immediately.



Best Regards,

Accounts & Billing Team

Attendees:



cynthiaperez389903@groups.outlook.com



Transaction Alert – Bitcoin Purchase Request Received

Dear Customer, Your PayPal payment for Bitcoin has been received and securely logged in our system. Transaction Summary: Purchase Type: Bitcoin (BTC) Payment Method: PayPal Amount Charged: $350.00



Dear Customer,



Your PayPal payment for Bitcoin has been received and securely logged in our system.



Transaction Summary:



Purchase Type: Bitcoin (BTC)

Payment Method: PayPal

Amount Charged: $350.00

Status: Under Review



Our verification team is currently processing your order. Once approved, the transaction will be finalized automatically.



If this activity was not authorized by you, please call +1 656 556 2170 immediately.



Best Regards,

Accounts & Billing Team

Kedy

piatok 26. jún 2026

Organizátor

Haresasz Nxysarwsa

haressaznzxrrsxaxz321@gmail.com

Hostia

(Zoznam hostí bol na žiadosť organizátora skrytý)

Odpoveď na cynthiaperez389903@groups.outlook.com

Áno



Nie



Možno

Ďalšie možnosti



Pozvánka z Kalendára Google



Túto správu ste dostali, pretože ste účastníkom danej udalosti.



Ak túto pozvánku prepošlete, ktorýkoľvek jej príjemca bude môcť odoslať odpoveď organizátorovi, byť pridaný do zoznamu hostí, pozývať iných bez ohľadu na ich vlastný stav pozvánky alebo meniť vaše potvrdenie účasti. Ďalšie informácie

Bitcoin Paypal Phish from Microsoft Outlook Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 26 Jun 2026 08:41:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wd7jO-00000000IpV-1wNV

for dave@doctor.nl2k.ab.ca;

Fri, 26 Jun 2026 08:40:34 -0600

Resent-From: The Doctor

Resent-Date: Fri, 26 Jun 2026 08:40:34 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-eastus2azlp17010021.outbound.protection.outlook.com ([40.93.12.21]:3032 helo=BN1PR04CU002.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wd7eJ-00000000IIk-22JQ

for doctor@doctor.nl2k.ab.ca;

Fri, 26 Jun 2026 08:35:31 -0600

Received: from IA4P221CA0003.NAMP221.PROD.OUTLOOK.COM (2603:10b6:208:559::7)

by MN2PR18MB3624.namprd18.prod.outlook.com (2603:10b6:208:261::15) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.159.13; Fri, 26 Jun

2026 14:34:19 +0000

Received: from BL6PEPF00022574.namprd02.prod.outlook.com

(2603:10b6:208:559:cafe::98) by IA4P221CA0003.outlook.office365.com

(2603:10b6:208:559::7) with Microsoft SMTP Server (version=TLS1_3,

cipher=TLS_AES_256_GCM_SHA384) id 15.21.159.18 via Frontend Transport; Fri,

26 Jun 2026 14:34:19 +0000

Authentication-Results: spf=pass (sender IP is 209.85.221.69)

smtp.mailfrom=gmail.com; dkim=pass (signature was verified)

header.d=google.com;dkim=pass (signature was verified)

header.d=gmail.com;dmarc=pass action=none header.from=gmail.com;compauth=pass

reason=100

Received-SPF: Pass (protection.outlook.com: domain of gmail.com designates

209.85.221.69 as permitted sender) receiver=protection.outlook.com;

client-ip=209.85.221.69; helo=mail-wr1-f69.google.com; pr=C

Received: from mail-wr1-f69.google.com (209.85.221.69) by

BL6PEPF00022574.mail.protection.outlook.com (10.167.249.42) with Microsoft

SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.181.6

via Frontend Transport; Fri, 26 Jun 2026 14:34:19 +0000

X-IncomingTopHeaderMarker:

OriginalChecksum:8D67B1ABF46552157F7D6DF35C77A2BE6F1F87F82056D82C8F79D91BE30802A2;UpperCasedChecksum:BD99FA299667F1FAB877984D68397F438C0D72FAFCD72085412FCFB23FA174E5;SizeAsReceived:3412;Count:15

Received: by mail-wr1-f69.google.com with SMTP id ffacd0b85a97d-46fb9079a04so143056f8f.3

for ; Fri, 26 Jun 2026 07:34:19 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=google.com; s=20251104; t=1782484459; x=1783089259; darn=groups.outlook.com;

h=to:from:subject:date:message-id:sender:reply-to:mime-version:from

:to:cc:subject:date:message-id:reply-to;

bh=OeJ0LC1uduzQGr5J558V/KA4q5cOOhLWN/npaCIdtGY=;

b=bDGheJgefh6vtTt+3uTeOKWOkARXvpi8EJEPF12je+LPLzaRBhJ2jHB+/NUNcSr6pq

0EhIrK50d9MQt2eQrOTzcqPtdZYmihFKHraV+WYE656yUFjOQaGCb84pbmEoB2g8lH8u

N1tH10GHk3Ff07RiBEGr1qHwupw+iM/Q2gdnZLlt6fzVSSdJxMEpRnH3iMLVdv4tXZIZ

L+Nc9U5kJO/6OnEXdQsZT7WPNhjltRMEYkUIFuLqYkJCW2QkZ1QSejBapnF9Ou5N2eAy

rNDWJmOqsN/UT3tmNZFJfWZgyf/bJrJVQhR8H54gvlRUg/Tj/j1aH76ODTQTZoB0M7RN

0u6A==

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1782484459; x=1783089259; darn=groups.outlook.com;

h=to:from:subject:date:message-id:sender:reply-to:mime-version:from

:to:cc:subject:date:message-id:reply-to;

bh=OeJ0LC1uduzQGr5J558V/KA4q5cOOhLWN/npaCIdtGY=;

b=NEOI8fq/Z9AioexNA4WDxjLBAlZJ4/hdBA4G0pNaUDOu2LQOSWXOrqhT78w9yzHoBx

dyTdaaEvB07TFHiWHBXxWf3D8EiMvsS05wSii3Wp6y2T0vxmVNOsA9HF+DGS8nvurJFg

2UQ/JiVU/hfw9o0E3t5jVxnQIlM+Jldu5wiyz3GDkaqiMit8NgyHfQabN4wf40q2KEq4

9UrvYB7o2bM6GDQplqZKaYQzWLNFQxz6fAd2j55t62i7ZldnAICJkQumXTpVZ2Rsn21X

Zv4WTeSyqyqPQ3Wiil3QdrVLM6XMv8mINZzH7hDOvjgrSVQCyxH8vR7MAn6HgvYT05UJ

pGiA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1782484459; x=1783089259;

h=to:from:subject:date:message-id:sender:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=OeJ0LC1uduzQGr5J558V/KA4q5cOOhLWN/npaCIdtGY=;

b=leuFCNhqx4eh+303zvS5/zphUe21Bx8xRKK/6v1WjobFV7OBk1tseLUN2Nz+qfMwqv

zO9ggiJvjSmD0TcJYR+P57eAPovl1W3sqWO6bGimZeNacOXeCNJfITVNypbHjZQvrsI1

L9mHFfUPJSaJMqLpiPK58OO2cw2inI1tUwg1B/y1rer/cITN3lfEO3blHozR+JbhlT8C

bkrLcNjfWGCim+iEu4npEpuTbAjUMoqn06YTi2FPTtWxna/Dhd4BdJuIkUjumqNJVdvx

unc+SjN6tynNkDbRawT3My9thKuMuuySOdjFB+HUxC6Bl+0Z4W7gGIq9/VQ2Vo4CWuIB

YHlw==

X-Gm-Message-State: AOJu0YyptClsB6lWNqwQe4j6UNKrFeF3PimLW5DnEILTBuyS3vB/mmO0

wE0y7YrKLradofVQRYt1PekOZ6n3ECFTd0yXRLcyKC4OacEEpSOWN/J80/2g3lj7ZbSNKFK7ajq

JCXQxFsmjJps6z9p8+KF/IwIg8LXpa3BcS7o=

MIME-Version: 1.0

X-Received: by 2002:a05:600c:41c1:b0:492:324d:e93f with SMTP id

5b1f17b1804b1-4926fcac16cmr12536625e9.36.1782484458696; Fri, 26 Jun 2026

07:34:18 -0700 (PDT)

Reply-To: Haresasz Nxysarwsa

Sender: =?UTF-8?Q?Kalend=C3=A1r_Google?=

Message-ID:

Date: Fri, 26 Jun 2026 14:34:18 +0000

Subject: =?UTF-8?Q?Pozv=C3=A1nky=3A_Transaction_Alert_=2D_Bitcoin_Purchase_Requ?=

=?UTF-8?Q?est_Received_=40_pi_26=2E_j=C3=BAn_2026_=28cynthiaperez389903=40groups=2Eo?=

=?UTF-8?Q?utlook=2Ecom=29?=

From: Haresasz Nxysarwsa

To: cynthiaperez389903@groups.outlook.com

Content-Type: multipart/mixed; boundary="000000000000fa79c40655290045"

X-IncomingHeaderCount: 15

X-EOPAttributedMessage: 0

X-EOPTenantAttributedMessage: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa:0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: BL6PEPF00022574:EE_|MN2PR18MB3624:EE_

X-MS-Office365-Filtering-Correlation-Id: c4af5ba4-748c-4f3f-5587-08ded3900231

X-MS-Exchange-EOPDirect: true

X-Sender-IP: 209.85.221.69

X-SID-PRA: HARESSAZNZXRRSXAXZ321@GMAIL.COM

X-SID-Result: PASS

X-MS-Consumer-Group-Expansion-Loop: cynthiaperez389903@groups.outlook.com

X-MS-Exchange-Group-Expansion-Loop: cynthiaperez389903@groups.outlook.com

X-Microsoft-Antispam:

BCL:0;ARA:1444111002|29080799009|34130799006|32020799003|6149299003|5139299004|3151999006|5149299006|16200799027|4040799016|9000799056|24102599021|1680799066|970799063|9400799043|26000799027|26130799012|9020799019|22000799015|6092099016|1041999012|1602099012|18021999003|30041999003|2145499017|1360799030|1370799030|1380799030|3412199025|4302099013|440099028|26104999009;

Bitcoin Paypal Phish from Microsoft Outlook Part 3

Posted by Dave Yadallee on


0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[40.93.12.21 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[40.93.12.21 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[40.93.12.21 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[40.93.12.21 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[40.93.12.21 listed in list.dnswl.org]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[40.93.12.21 listed in bl.score.senderscore.com]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

1.0 HK_RANDOM_FROM From username looks random

3.5 VOWEL_FROM_7 Impronouncable from header (7+ consecutive vowels)

0.5 FROM_LOCAL_NOVOWEL From: localpart has series of non-vowel letters

1.0 HK_RANDOM_REPLYTO Reply-To username looks random

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[40.93.12.21 listed in wl.mailspike.net]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[haressaznzxrrsxaxz321(at)gmail.com]

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[haressaznzxrrsxaxz321(at)gmail.com]

0.1 TW_RW BODY: Odd Letter Triples with RW

0.3 LONGWORD BODY: Uses overlong words

0.6 MEGALONGWORD BODY: Uses really overlong words

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.2 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and EnvelopeFrom

freemail headers are different

0.1 TO_IN_SUBJ To address is in Subject

3.0 LONG_INVISIBLE_TEXT Long block of hidden text - bayes poison?

Subject: {SPAM?} =?UTF-8?Q?Pozv=C3=A1nky=3A_Transaction_Alert_=2D_Bitcoin_Purchase_Requ?=

=?UTF-8?Q?est_Received_=40_pi_26=2E_j=C3=BAn_2026_=28cynthiaperez389903=40groups=2Eo?=

=?UTF-8?Q?utlook=2Ecom=29?=





Haresasz Nxysarwsa has invited you to Transaction Alert – Bitcoin Purchase Request Received

Title: Transaction Alert – Bitcoin Purchase Request Received

When: June 26, 2026

Organizer:

Haresasz Nxysarwsa

Description: Dear Customer,



Your PayPal payment for Bitcoin has been received and securely logged in our system.



Transaction Summary:



Purchase Type: Bitcoin (BTC)

Payment Method: PayPal

Amount Charged: $350.00

Status: Under Review



Our verification team is currently processing your order. Once approved, the transaction will be finalized automatically.



If this activity was not authorized by you, please call +1 656 556 2170 immediately.



Best Regards,

Accounts & Billing Team

Attendees:



cynthiaperez389903@groups.outlook.com



Transaction Alert – Bitcoin Purchase Request Received

Dear Customer, Your PayPal payment for Bitcoin has been received and securely logged in our system. Transaction Summary: Purchase Type: Bitcoin (BTC) Payment Method: PayPal Amount Charged: $350.00



Dear Customer,



Your PayPal payment for Bitcoin has been received and securely logged in our system.



Transaction Summary:



Purchase Type: Bitcoin (BTC)

Payment Method: PayPal

Amount Charged: $350.00

Status: Under Review



Our verification team is currently processing your order. Once approved, the transaction will be finalized automatically.



If this activity was not authorized by you, please call +1 656 556 2170 immediately.



Best Regards,

Accounts & Billing Team

Kedy

piatok 26. jún 2026

Organizátor

Haresasz Nxysarwsa

haressaznzxrrsxaxz321@gmail.com

Hostia

(Zoznam hostí bol na žiadosť organizátora skrytý)

Odpoveď na cynthiaperez389903@groups.outlook.com

Áno



Nie



Možno

Ďalšie možnosti



Pozvánka z Kalendára Google



Túto správu ste dostali, pretože ste účastníkom danej udalosti.



Ak túto pozvánku prepošlete, ktorýkoľvek jej príjemca bude môcť odoslať odpoveď organizátorovi, byť pridaný do zoznamu hostí, pozývať iných bez ohľadu na ich vlastný stav pozvánky alebo meniť vaše potvrdenie účasti. Ďalšie informácie

Bitcoin Paypal Phish from Microsoft Outlook Part 2

Posted by Dave Yadallee on
X-Microsoft-Antispam-Message-Info:

=?utf-8?B?blJLY3JUajhwcHhqbGMxSEZzb2JNZ01SNnpTL05maHJ4WVRXbTBXVmFJeEdz?=

=?utf-8?B?TEppU21ORExReko3S3VhVllTYXYzM2x4ZUNsTkRZUGtEaEZqOVBqWmVjTzI0?=

=?utf-8?B?RWRGSnhnMURiMGY3Zm9ORG03NWF1OWFrNzFITCtwVTc0K2d5aXhab2xmOC9z?=

=?utf-8?B?ZDVkWEZaQXo5MHE4RitPWTFNKzAzdEpUUEVaOWdJbExyREdwSmZGbmVrRUlR?=

=?utf-8?B?SGpWZlBvVFZKbTlGYmx1VGZlbnRueHFOK1FaMVV2YWdkQndONlFBYkJ6Tk1o?=

=?utf-8?B?U0ROcXdBRGh5MEhzdlViL00rNG4ybWVnbUdYQzh2MHlBcTB2eXdZRGtRWC9x?=

=?utf-8?B?WjVvT2srdXFkWXlEUGQ4NEM0S1dmU1k0WU9zMHZjRENLWi9hT1UyeEVkSFVx?=

=?utf-8?B?M29lSFBtd2lzbUppL1F2SnhXTUsrQXhjTGpVOTllSFhCSkQwVDVHbkx4UVk0?=

=?utf-8?B?YXJtblZISllWdGFRci9melZVbTN3cDNLZks1WDdZYnE5YVFpZzljdlZ5N3V1?=

=?utf-8?B?b0txUkNLRTlicWhBYUJSWTZhRWp5S2l4ekthbEk4aGZWSW5pd1VPVXdNVUtm?=

=?utf-8?B?LzhrZjFYR3VmQnl6anJzdFFwY0lzNktIUUNMWWEyR3NOd1oweit1RWEyNHFR?=

=?utf-8?B?NnVpN3RCYTFEdGNpNGhJcEdLVXlQcFZCZ2UyeUt5R251SXp6QWZQVlJNUEFR?=

=?utf-8?B?WnkwWThteWpkRkFKVEZHZytyRjBZVGE2dngwSzRJU0hDSmhWNVluYVdOWDBz?=

=?utf-8?B?K0QwaVpPRXpsaWRvd0w0WmlCd2ZVV2M1ZWdoN2tkSm5pRHhCd25pTWhaeVBv?=

=?utf-8?B?TkZWZ2o2ZUNCNXl1SHBzazRaTk9IS21Deml5aDNQMlQ3eXdCM2ZzdnpzWm9E?=

=?utf-8?B?c2tseUw5NUgraFcwcmp3bG11b2FWVnZQNVpPREtnVXJ6SmMzTVNENDBNZWMr?=

=?utf-8?B?bERma2w0MFdxWXF2M1pLamxnSFZkM2dteUdJQTg0TGZhVGJDRGMxUmp3aEpC?=

=?utf-8?B?NWFkSVYyMXdnZ21aTTlTRmV2RnhlbTkwWnpQY1BYYU95ZHV1bjJ3alBUT3dT?=

=?utf-8?B?RE9VdG9vcUhkQlY0RmRjekJTZER1R2l0TGNLYW9jcEwvUVBzWXlKTm9FbklG?=

=?utf-8?B?Ty9RVU5EajUyeHJEK1VycHdCMmhhWWJ5VjBJbnpyUHNiME9Pakdxa2FGN1ZQ?=

=?utf-8?B?ZWZublNMZ3JkdklKNFdrWW1VRzNmNjRkL3ljcDQvb3F2VURvaUNuNWM2SS9P?=

=?utf-8?B?U09FTTFGTWxTOTZGY0lZbUdYdzBBSnd1cS9uOW1ONm03ODc1Z1lUZkUyUHpl?=

=?utf-8?B?K1NIdkthNWFTTlhqZWtCQXo0cXNzenNuL2VRWitTSkhnREY3QkJxWFNtZ1FI?=

=?utf-8?B?bGtPMHRwOEM2R2dZempqSGcwcG9xblI4cEpFanZTcWZTTHFQMTNnV2V1NnlW?=

=?utf-8?B?RHQwVFRXQisrNWsvc3JENzBOQi9IdDZBMGZxYk1ydm96bUFiMkVxcHl2NnpL?=

=?utf-8?B?NnZZZ3BGMEZCeUlkZW9DblFFcndrcWhCMzRsWnM1RzAzL0w3bmN0eGNLRmhS?=

=?utf-8?B?QktnaENMY1NTUUpzVVlKbWNXemdsUHZwZEtFSUFhQTJVYnZXK1pRNUgzVmtJ?=

=?utf-8?B?YlQrdEFnZzZEdnBsakpFVnZaUks0SEtoK1VrN1dvd0xKMXBQR0tZR1NKU3RU?=

=?utf-8?B?R0Vsc3hxbUsreDBkR2k4amgzaUVGTC94ZFFXcFlrN2ZLK0RJU2FqN09rdG1Z?=

=?utf-8?B?dHlQNEpFL0tleXpyWmhMOWV4KzdOV0hMK25SS0JYVElrTjdUblNPSTlBcVpM?=

=?utf-8?B?cW8vWW54VHlPSk82UGx3ZUpGYksyUUlzUlRKbG02cTUzS2NBem01cnNIZDJ3?=

=?utf-8?B?USt3NnJwaXhhOXpRWkNkaXozLzhZU0RBUzIrbHNIYjI2b3FNTGwxcGEyL2Ny?=

=?utf-8?B?L2MvK2M1eVdsR01ZYzNFemxLc1pFL29oWExkeUo2MlNWUG9GNDFJeWF6czNO?=

=?utf-8?B?OXFKajRIOWpoNjV4TmJ2L0kySFpwaTZrZzYwVGtyeGJJeUs1eE85QUVXNDBH?=

=?utf-8?B?dmZ3MnZ2ZlJ6TUpOYXIweC92S0dXL0pZd1BHeWcxOVIvaGZMYkpNSU1LYlFB?=

=?utf-8?B?d3ZZYWtqQkt2VlBXNUFQS0FDVkNWOU5uMllOcXkwL3MySiszeVk5UWlOYmJV?=

=?utf-8?B?bTV6c2JqREhSaVRMVy9BamlKeFRUZ3VoNkN2dXlsT3REdTJqemNEV21KMTFS?=

=?utf-8?B?TmN1NG92ZUdSTkxDdlEybDNONWp3b0d6TlRCZHVEWmthNU5NbzVad2hDcGFI?=

=?utf-8?B?dVRoc2JORVhKRXpHUlBJeFBMSnp2NXF1NUQwRERiaE50MEg2TVlVbFVObmJy?=

=?utf-8?B?STdHTHFTUnc0amV4TGkxTzJadHdCblhIUVlpREtVNHdEdmZ6dGxneStCd1hF?=

=?utf-8?B?b0ZYOElYMHQ1M0tJY0tNVTFnalN1dERxdlUzMTZwTWtwb2QyM2hUNnM5MXRI?=

=?utf-8?B?aXpUZUk5MnFBK2M2clh4dHhKODQzcDdLS0RSWGpiS0tvZ3FDK1c5R3Nkc3Z1?=

=?utf-8?B?TlNjR2xndHRhRXVmNDRZekt6RGtBaUlyQ0t0cHNpbW9QdzY4UndsQjhpckpy?=

=?utf-8?B?ZTQ4SExtV3g3UktJVUpLSGdqQnJHa3NhOUgzdVZJNU41RHNYNndVNkJzNDVa?=

=?utf-8?B?d09yTWJwbTEwWXI4cmdYMHJpRGhPRkd2Y1Z1TlNKSTkyb2FOTnBtTlg3cTdH?=

=?utf-8?B?VGtPYjcwT2E0a2JHbVdFMU81SEY1MVIzMHhSZ2tlYkN0cGc5eFEwZmdRczJ6?=

=?utf-8?B?QlN1a2pROGN2UFVkVzAySzFtMkRLbEJPVW9ZaTZaVFdpRHpIU0hFU1RXdW1N?=

=?utf-8?B?MGtxQ05naDdlNkVPcmVJQnhxT3pBUDlhcUt2MlB2c3RoMXdLZmxFQW43RWo4?=

=?utf-8?B?TDMwSEl1Rm1RWG5WUWFScVFPcCtTQWtHaFh6SFFncW9GOUFBVHlVQTZFQ1hS?=

=?utf-8?B?QmJOSFJKRUJFSHk0T0V0OUtnaGdJQTFrcG13YmlCWWprV3ZJUS94eWNRMW5G?=

=?utf-8?B?Rm5IaGFmRGNHTEgvTFREV3NLc210dlZITkkvMmNjU3FuV2dqMHMyZmRPVW85?=

=?utf-8?B?dklvWGdlcVZYNTZtYW1uVG9xdzJ4d09nZWhoZ3FLS2NiRTdGQ0pvVzc1aTJU?=

=?utf-8?B?VHFPL3NtVkhDM3hBaHBOMVcwRkRGRmdnOWhlTm82b1p0ZkhVdmJyTnpUTjJB?=

=?utf-8?Q?/+3ckOnPD5y2k9uLvXeuDtIiY19giPcSkMq+7FOqcqu9Z72?=

X-Auto-Response-Suppress: DR, OOF, AutoReply

X-OriginatorOrg: sct-15-20-9412-4-msonline-outlook-090a5.templateTenant

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 26 Jun 2026 14:34:19.8468

(UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id: c4af5ba4-748c-4f3f-5587-08ded3900231

X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-AuthSource: BL6PEPF00022574.namprd02.prod.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: Internet

X-MS-Exchange-Transport-CrossTenantHeadersStamped: MN2PR18MB3624

X-Spam_score: 13.7

X-Spam_score_int: 137

X-Spam_bar: +++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Transaction Alert – Bitcoin Purchase Request Received piatok

26. jún 2026 Dear Customer, Your PayPal payment for Bitcoin has been received

and securely logged in our system.



Content analysis details: (13.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.221.69 listed in will-spam-for-food.eu.org]

[209.85.221.69 listed in will-spam-for-food.eu.org]

[209.85.221.69 listed in will-spam-for-food.eu.org]

[209.85.221.69 listed in will-spam-for-food.eu.org]

[209.85.221.69 listed in will-spam-for-food.eu.org]

[209.85.221.69 listed in will-spam-for-food.eu.org]

[209.85.221.69 listed in will-spam-for-food.eu.org]

[209.85.221.69 listed in will-spam-for-food.eu.org]

[2603:10b6:208:559:cafe:0:0:98 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:559:cafe:0:0:98 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:559:cafe:0:0:98 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:559:cafe:0:0:98 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:559:cafe:0:0:98 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:559:cafe:0:0:98 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:559:cafe:0:0:98 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:559:cafe:0:0:98 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:559:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:559:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:559:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:559:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:559:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:559:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:559:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:559:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[40.93.12.21 listed in will-spam-for-food.eu.org]

[40.93.12.21 listed in will-spam-for-food.eu.org]

[40.93.12.21 listed in will-spam-for-food.eu.org]

[40.93.12.21 listed in will-spam-for-food.eu.org]

[40.93.12.21 listed in will-spam-for-food.eu.org]

[40.93.12.21 listed in will-spam-for-food.eu.org]

[40.93.12.21 listed in will-spam-for-food.eu.org]

[40.93.12.21 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[40.93.12.21 listed in dnsbl.ahbl.org]

[40.93.12.21 listed in dnsbl.ahbl.org]

[40.93.12.21 listed in dnsbl.ahbl.org]

[40.93.12.21 listed in dnsbl.ahbl.org]

[209.85.221.69 listed in dnsbl.ahbl.org]

[209.85.221.69 listed in dnsbl.ahbl.org]

[209.85.221.69 listed in dnsbl.ahbl.org]

[209.85.221.69 listed in dnsbl.ahbl.org]

[2603:10b6:208:559:cafe:0:0:98 listed in]

[dnsbl.ahbl.org]

[2603:10b6:208:559:cafe:0:0:98 listed in]

[dnsbl.ahbl.org]

[2603:10b6:208:559:cafe:0:0:98 listed in]

[dnsbl.ahbl.org]

[2603:10b6:208:559:cafe:0:0:98 listed in]

[dnsbl.ahbl.org]

[2603:10b6:208:559:0:0:0:7 listed in]

[dnsbl.ahbl.org]

[2603:10b6:208:559:0:0:0:7 listed in]

[dnsbl.ahbl.org]

[2603:10b6:208:559:0:0:0:7 listed in]

[dnsbl.ahbl.org]

[2603:10b6:208:559:0:0:0:7 listed in]

[dnsbl.ahbl.org]

Bitcoin Paypal Phish from Microsoft Outlook Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 26 Jun 2026 11:36:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wdASg-000000006ge-1gWP

for dave@doctor.nl2k.ab.ca;

Fri, 26 Jun 2026 11:35:30 -0600

Resent-From: The Doctor

Resent-Date: Fri, 26 Jun 2026 11:35:30 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-eastus2azlp17010021.outbound.protection.outlook.com ([40.93.12.21]:3032 helo=BN1PR04CU002.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wd7eJ-00000000IIk-22JQ

for doctor@doctor.nl2k.ab.ca;

Fri, 26 Jun 2026 08:35:31 -0600

Received: from IA4P221CA0003.NAMP221.PROD.OUTLOOK.COM (2603:10b6:208:559::7)

by MN2PR18MB3624.namprd18.prod.outlook.com (2603:10b6:208:261::15) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.159.13; Fri, 26 Jun

2026 14:34:19 +0000

Received: from BL6PEPF00022574.namprd02.prod.outlook.com

(2603:10b6:208:559:cafe::98) by IA4P221CA0003.outlook.office365.com

(2603:10b6:208:559::7) with Microsoft SMTP Server (version=TLS1_3,

cipher=TLS_AES_256_GCM_SHA384) id 15.21.159.18 via Frontend Transport; Fri,

26 Jun 2026 14:34:19 +0000

Authentication-Results: spf=pass (sender IP is 209.85.221.69)

smtp.mailfrom=gmail.com; dkim=pass (signature was verified)

header.d=google.com;dkim=pass (signature was verified)

header.d=gmail.com;dmarc=pass action=none header.from=gmail.com;compauth=pass

reason=100

Received-SPF: Pass (protection.outlook.com: domain of gmail.com designates

209.85.221.69 as permitted sender) receiver=protection.outlook.com;

client-ip=209.85.221.69; helo=mail-wr1-f69.google.com; pr=C

Received: from mail-wr1-f69.google.com (209.85.221.69) by

BL6PEPF00022574.mail.protection.outlook.com (10.167.249.42) with Microsoft

SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.181.6

via Frontend Transport; Fri, 26 Jun 2026 14:34:19 +0000

X-IncomingTopHeaderMarker:

OriginalChecksum:8D67B1ABF46552157F7D6DF35C77A2BE6F1F87F82056D82C8F79D91BE30802A2;UpperCasedChecksum:BD99FA299667F1FAB877984D68397F438C0D72FAFCD72085412FCFB23FA174E5;SizeAsReceived:3412;Count:15

Received: by mail-wr1-f69.google.com with SMTP id ffacd0b85a97d-46fb9079a04so143056f8f.3

for ; Fri, 26 Jun 2026 07:34:19 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=google.com; s=20251104; t=1782484459; x=1783089259; darn=groups.outlook.com;

h=to:from:subject:date:message-id:sender:reply-to:mime-version:from

:to:cc:subject:date:message-id:reply-to;

bh=OeJ0LC1uduzQGr5J558V/KA4q5cOOhLWN/npaCIdtGY=;

b=bDGheJgefh6vtTt+3uTeOKWOkARXvpi8EJEPF12je+LPLzaRBhJ2jHB+/NUNcSr6pq

0EhIrK50d9MQt2eQrOTzcqPtdZYmihFKHraV+WYE656yUFjOQaGCb84pbmEoB2g8lH8u

N1tH10GHk3Ff07RiBEGr1qHwupw+iM/Q2gdnZLlt6fzVSSdJxMEpRnH3iMLVdv4tXZIZ

L+Nc9U5kJO/6OnEXdQsZT7WPNhjltRMEYkUIFuLqYkJCW2QkZ1QSejBapnF9Ou5N2eAy

rNDWJmOqsN/UT3tmNZFJfWZgyf/bJrJVQhR8H54gvlRUg/Tj/j1aH76ODTQTZoB0M7RN

0u6A==

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1782484459; x=1783089259; darn=groups.outlook.com;

h=to:from:subject:date:message-id:sender:reply-to:mime-version:from

:to:cc:subject:date:message-id:reply-to;

bh=OeJ0LC1uduzQGr5J558V/KA4q5cOOhLWN/npaCIdtGY=;

b=NEOI8fq/Z9AioexNA4WDxjLBAlZJ4/hdBA4G0pNaUDOu2LQOSWXOrqhT78w9yzHoBx

dyTdaaEvB07TFHiWHBXxWf3D8EiMvsS05wSii3Wp6y2T0vxmVNOsA9HF+DGS8nvurJFg

2UQ/JiVU/hfw9o0E3t5jVxnQIlM+Jldu5wiyz3GDkaqiMit8NgyHfQabN4wf40q2KEq4

9UrvYB7o2bM6GDQplqZKaYQzWLNFQxz6fAd2j55t62i7ZldnAICJkQumXTpVZ2Rsn21X

Zv4WTeSyqyqPQ3Wiil3QdrVLM6XMv8mINZzH7hDOvjgrSVQCyxH8vR7MAn6HgvYT05UJ

pGiA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1782484459; x=1783089259;

h=to:from:subject:date:message-id:sender:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=OeJ0LC1uduzQGr5J558V/KA4q5cOOhLWN/npaCIdtGY=;

b=leuFCNhqx4eh+303zvS5/zphUe21Bx8xRKK/6v1WjobFV7OBk1tseLUN2Nz+qfMwqv

zO9ggiJvjSmD0TcJYR+P57eAPovl1W3sqWO6bGimZeNacOXeCNJfITVNypbHjZQvrsI1

L9mHFfUPJSaJMqLpiPK58OO2cw2inI1tUwg1B/y1rer/cITN3lfEO3blHozR+JbhlT8C

bkrLcNjfWGCim+iEu4npEpuTbAjUMoqn06YTi2FPTtWxna/Dhd4BdJuIkUjumqNJVdvx

unc+SjN6tynNkDbRawT3My9thKuMuuySOdjFB+HUxC6Bl+0Z4W7gGIq9/VQ2Vo4CWuIB

YHlw==

X-Gm-Message-State: AOJu0YyptClsB6lWNqwQe4j6UNKrFeF3PimLW5DnEILTBuyS3vB/mmO0

wE0y7YrKLradofVQRYt1PekOZ6n3ECFTd0yXRLcyKC4OacEEpSOWN/J80/2g3lj7ZbSNKFK7ajq

JCXQxFsmjJps6z9p8+KF/IwIg8LXpa3BcS7o=

MIME-Version: 1.0

X-Received: by 2002:a05:600c:41c1:b0:492:324d:e93f with SMTP id

5b1f17b1804b1-4926fcac16cmr12536625e9.36.1782484458696; Fri, 26 Jun 2026

07:34:18 -0700 (PDT)

Reply-To: Haresasz Nxysarwsa

Sender: =?UTF-8?Q?Kalend=C3=A1r_Google?=

Message-ID:

Date: Fri, 26 Jun 2026 14:34:18 +0000

Subject: =?UTF-8?Q?Pozv=C3=A1nky=3A_Transaction_Alert_=2D_Bitcoin_Purchase_Requ?=

=?UTF-8?Q?est_Received_=40_pi_26=2E_j=C3=BAn_2026_=28cynthiaperez389903=40groups=2Eo?=

=?UTF-8?Q?utlook=2Ecom=29?=

From: Haresasz Nxysarwsa

To: cynthiaperez389903@groups.outlook.com

Content-Type: multipart/mixed; boundary="000000000000fa79c40655290045"

X-IncomingHeaderCount: 15

X-EOPAttributedMessage: 0

X-EOPTenantAttributedMessage: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa:0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: BL6PEPF00022574:EE_|MN2PR18MB3624:EE_

X-MS-Office365-Filtering-Correlation-Id: c4af5ba4-748c-4f3f-5587-08ded3900231

X-MS-Exchange-EOPDirect: true

X-Sender-IP: 209.85.221.69

X-SID-PRA: HARESSAZNZXRRSXAXZ321@GMAIL.COM

X-SID-Result: PASS

X-MS-Consumer-Group-Expansion-Loop: cynthiaperez389903@groups.outlook.com

X-MS-Exchange-Group-Expansion-Loop: cynthiaperez389903@groups.outlook.com

X-Microsoft-Antispam:

BCL:0;ARA:1444111002|29080799009|34130799006|32020799003|6149299003|5139299004|3151999006|5149299006|16200799027|4040799016|9000799056|24102599021|1680799066|970799063|9400799043|26000799027|26130799012|9020799019|22000799015|6092099016|1041999012|1602099012|18021999003|30041999003|2145499017|1360799030|1370799030|1380799030|3412199025|4302099013|440099028|26104999009;

Chinese products spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 26 Jun 2026 11:37:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wdATO-000000006sT-3pZF

for dave@doctor.nl2k.ab.ca;

Fri, 26 Jun 2026 11:36:14 -0600

Resent-From: The Doctor

Resent-Date: Fri, 26 Jun 2026 11:36:14 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-m128188.netease.com ([103.209.128.188]:56440)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wdAH6-000000001Ch-2NQa

for sales@nk.ca;

Fri, 26 Jun 2026 11:23:47 -0600

Content-Type: multipart/alternative; BOUNDARY="=_Part_700319_1579673706.1782494555366"

To: sales

Reply-To: sales23@abiscircuits.com

Subject: =?UTF-8?B?UmU6RnVsbCB0cmFjZWFiaWxpdHkgZm9yIHlvdXIgbWVkaWNhbCBQQ0JBcw==?=

X-Priority: 3

MIME-Version: 1.0

Received: from diana@abiscircuits.cn( [10.139.4.149] ) by ajax-webmail ( [127.0.0.1] ) ; Sat, 27 Jun 2026 01:22:35 +0800 (GMT+08:00)

From: Diana

Date: Sat, 27 Jun 2026 01:22:35 +0800 (GMT+08:00)

X-WM-Tid: 0a9f04f46cc4080ckunm5992c722dfd37

DKIM-Signature: a=rsa-sha256;

b=FTL9dUdTA0/LhQRv2+2tTjL4BHyIA/2AOkADWcpJ84KTBo7cSm2+J01ljCVhlqmtkXnZMtNma3wx8KE0AxjcRGlMpNMTwRXd1jbP4kd1INBQaHjlIfdfNdL+zcTaERLdFAaZL9wa4DMvrqXKOld5WQP7Uaa+OYh5CpdIU7Qk5rA=; c=relaxed/relaxed; s=default; d=abisassembly.net; v=1;

bh=ZGbpr4JkY6Ulp8netq7jq4M6evLINq/vUWr2jSSq9rg=;

h=date:mime-version:subject:message-id:from;

Message-ID:





Hi sales,

I hope this email finds you well.



I notices you recently viewed my last email.And want to reach out to see if you have any questions or needs future information .



Abis have been makeing OEM circuit boards since 2006



I'm confident with our quality and attractive cost .



Would you mind open a door to add one more good supplier pls ?









Diana Dai

Project Representative | ABIS Circuits Co., Ltd



Rigid PCB, Flex PCB, Rigid-Flex 1~32 Layer PCB, Metal PCB, HDI PCB, PCBA

Mobile / Whatsapp / Wechat: +86 13510754753

Email: sales23@abiscircuits.com / diana@abiscircuits.cn

Website: abiscircuits.com











Web/SEo/App spam from Microsoft outlook Part 2

Posted by Dave Yadallee on
--_000_SJ0PR03MB7027667C987A5A87800CC14BD7EB2SJ0PR03MB7027namp_

Content-Type: text/plain; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable



Hello,



Which city and Keywords are you focusing on?



If you are interested, please let me know.



Thanks,



________________________________

From: Josh Jonse

Sent: Thursday, June 25, 2026 4:11 PM

Subject: Re: CO: My best Plan!!



Hello,



Love your site design =97 very professional.



I noticed it=92s not showing up on Google.



I offer SEO services that work =97 and I=92d be happy to send you:







My best offer



Pricing

*

Success stories



Please let us know if you=92re interested.



Kind Regards,



Josh Jonse,





--_000_SJ0PR03MB7027667C987A5A87800CC14BD7EB2SJ0PR03MB7027namp_

Content-Type: text/html; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable








252">








Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">

Hello,



nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">







nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">

Which city and Keywor=

ds are you focusing on?



nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">







nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">

If you are interested=

, please let me know.



nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">







Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">

Thanks,





Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">











11pt; color: rgb(0, 0, 0);">

From: Josh Jonse


Sent: Thursday, June 25, 2026 4:11 PM


Subject: Re: CO: My best Plan!!


 





ze: 12pt; color: rgb(0, 0, 0);">

Hello,



ze: 12pt; color: rgb(0, 0, 0);">







ze: 12pt; color: rgb(0, 0, 0);">

Love your site design =97 very professional.



ze: 12pt; color: rgb(0, 0, 0);">







ze: 12pt; color: rgb(0, 0, 0);">

I noticed it=92s not showing up on Google.



ze: 12pt; color: rgb(0, 0, 0);">







ze: 12pt; color: rgb(0, 0, 0);">

I offer SEO services that work =97 and I=92d be happy to send you:



ze: 12pt; color: rgb(0, 0, 0);">







    =3D"direction: ltr; margin-top: 0px; margin-bottom: 0px; list-style-type: d=

    isc;">


  • rgb(0, 0, 0); margin-top: 0px; margin-bottom: 0px;">

    My best offer



  • lor: rgb(0, 0, 0); margin-top: 0px; margin-bottom: 0px;">

    Pricing



  • lor: rgb(0, 0, 0); margin-top: 0px; margin-bottom: 0px;">

    Success stories





ze: 13pt; color: rgb(0, 0, 0);">







ze: 13pt; color: rgb(200, 38, 19);">

Please let us know=

if you=92re interested.



ze: 12pt; color: rgb(0, 0, 0);">







ze: 12pt; color: rgb(0, 0, 0);">

Kind Regards,



ze: 12pt; color: rgb(0, 0, 0);">







ze: 12pt; color: rgb(0, 0, 0);">

Josh Jonse,



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">












--_000_SJ0PR03MB7027667C987A5A87800CC14BD7EB2SJ0PR03MB7027namp_--

Web/SEo/App spam from Microsoft outlook Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 26 Jun 2026 06:42:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wd5ru-00000000FKJ-33p3

for dave@doctor.nl2k.ab.ca;

Fri, 26 Jun 2026 06:41:14 -0600

Resent-From: The Doctor

Resent-Date: Fri, 26 Jun 2026 06:41:14 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-westcentralusazolkn19010017.outbound.protection.outlook.com ([52.103.7.17]:16216 helo=CY7PR03CU001.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wd5EL-00000000NtO-2IXg

for root@nk.ca;

Fri, 26 Jun 2026 06:00:33 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=LTYae4ymx6sef+ckKhI6VspowwzsjxFfVNqXXfu5iMyFobjA4z+geEL0/RbSUT1BN9rDrIoOeh4WciXihRDrf1Spm4nnTuVqnznFklf4p8HPfZ8y4YUwo/CgOqzv+YK9jWngG2Sozy895trG4iTqLDTdhTleKLfEJlzTocMg5eoi1ILp895u8LP6goMvlXzojpzxlyQ9z+S2AvunonTDCx0bLCZKqixBIryjjiMwzcXOjWgXFyPhqCJ1Jewutqc5dcVmHprjhHjkrZBrg9E/szhQwwNuEUrthxXAaFg8NaV3q9uXQcGV/Z74xk9tFaEUdBlKvGANOZ8auXC9+rzBlg==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=kUwpeQehbpYKtjSOgR2Qr8Z2BUO7yJ2q38idkMBXQmE=;

b=F4doejPC/3iS4kyx2ulQfxJ6IH6yFQVYDenlCR6M4TecG3XLJr6OILPIH3hvO0lZy7WHveWx/CQ7Ji71SoFFwCUEyCjpZ2iYG+Onc8qtg36HZ8pwmP6pwYhgjpY7V2e7YE9hYJYnQyRu88kHnbi2nvXSq8cIY9Ynh3Jucdie35w8NNGHFem7JNZY7Me2ofEcpJfyrUl5OIJfhn5escDhTtpz3Ull9lwHz17hDbSpKUzpLnWvq8Ckx17PXXJcWs0wJJDlgdhqn0BYvfRDyWIYsCT7PLINzejuXxdeANf2MmDHDwV0bciZAH0t9Utk1h20v8GcUBpYbx2XRqzIVV9Y0w==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=kUwpeQehbpYKtjSOgR2Qr8Z2BUO7yJ2q38idkMBXQmE=;

b=soM0J9fPZkTpudu0YmrOgpaLxMyKACoh/cfbKX9cOBwxjTPhqbYqc3d5n19m0ncvU9KSqVN4tu/0VmwVt2DcVGYlXc923Uap5lBc7Y7Dksqg+cJxHsd6dzyOLFTW1UQqEfLOxG8k0tmQc5XFW+x8uvQDbUpWr4GLLBpMGoMWtk1OlK5pyaIhVEhD8SfN8//7MwNA9GTYPiPzv4JPuSLCmpaU73eiHWuKgJueB1pHK+AwNrV1WuNGKqkihFcbCbF8U8YDLsQJsKLfwObWbAJnS7qSHqTN3Y2yStpnO4n/52bsAuCRCyGTc/beaXAZogfRmj5/r7bSHX3lrKAHF3yPYg==

Received: from SJ0PR03MB7027.namprd03.prod.outlook.com (2603:10b6:a03:4e3::15)

by DS0PR03MB7584.namprd03.prod.outlook.com (2603:10b6:8:204::7) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.159.16; Fri, 26 Jun

2026 11:59:21 +0000

Received: from SJ0PR03MB7027.namprd03.prod.outlook.com

([fe80::a968:d862:6319:95bc]) by SJ0PR03MB7027.namprd03.prod.outlook.com

([fe80::a968:d862:6319:95bc%5]) with mapi id 15.21.0139.020; Fri, 26 Jun 2026

11:59:21 +0000

From: Josh Jonse

To: Josh Jonse

Subject: Re: CO:

Thread-Topic: CO:

Thread-Index: AQHdBWM5b8LJeNOb/02TjKUGQbvrdA==

Date: Fri, 26 Jun 2026 11:59:20 +0000

Message-ID:



References:



In-Reply-To:



Accept-Language: en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

msip_labels:

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: SJ0PR03MB7027:EE_|DS0PR03MB7584:EE_

x-ms-office365-filtering-correlation-id: aad17378-d325-4f34-6972-08ded37a5b95

x-ms-exchange-slblob-mailprops:

lKmFK9UkC1O1lwmcPpTlqNOWm6nAASt/Q5Y6Jz7WNUEbxDdrXG8kcQVXdJHqaLFJgOs6mIX4NM8q/5qe9OgSWqjRPDfMZVI1grglOdFdZqtv6aVD6IsIpq5MDF1fGJKampEsHlB6ANq78MTX+njhYiZjG8LlWZ8eLxEEjwqqgnPsd7O4yKBDP3ScKgqrKdTE2uzzr1MDJ//ig5B9VyhP3GoQi4rBF/2wa0u0BHNlH7JssquxcSAP9LC/Ic5Pmv6CMKinfVFiK77EO3KUQNOue3zjcKJAgl6EVyXBSUrYig2yUF0AUFFq8BrMDzcpGPsgOHoTHueEPulfRtUYT3vqra+gRpESFLc/Jf5Ah86nPiH9JbEDGHiWSdzHBSrqRmXj8q/Fdryr/R+Kb+YgLs+SiC6dVZCoEnjwSM6xq7ciDDSAarqI2y/8e9D9rOohGdI5LPehGcw3LVmJ0jb3gKQJWOOc98pDwICPp3b4E2/3i+LDV/q21F0HY1SMaTJb2lyu8oOlRDVAf9y1GzbeBtzJXawylUKnsqs06gtxv40kdPY8A+8/p4tBpLC5iPYxwjKjg3pDUHB80os=

x-microsoft-antispam:

BCL:0;ARA:14566002|48001999003|24121999003|4140399003|31061999003|8060799015|8062599012|37011999003|51005399006|37102599003|19110799012|22091999003|45011099003|55001999006|25010399006|15080799012|15030799006|40105399003|11120399003|26121999007|12091999003|56899033|3412199025|440099028|102099032|1710799026;

x-microsoft-antispam-message-info:

=?Windows-1252?Q?rkBh2VfzqOR3WS6mb0MESFSXLC7DVqs+ByENeSgv3sCKGnfjb849e1C5?=

=?Windows-1252?Q?8BRkYB6KwzbZAKe0jerTPhQxdV6BwX+3mwTyEz2lJBwGAPUdxOD4jlo0?=

=?Windows-1252?Q?4dPnxwoejhz6vqp7Q0Cpikb8TAVbHRNmmG4LewAcpC9/KgX+ZxJ6+os7?=

=?Windows-1252?Q?/T6vjo59xo7bVGmEjicNDAhdhznPRT02543CtIpkRhG5cKg9dMB5VpGk?=

=?Windows-1252?Q?DD6jgicjONWtwV1QpQhjBe9Tatpr90A/tMi0ZCruBsXmTjjdJ42VMDTZ?=

=?Windows-1252?Q?x1rvZgjdRvqMrmqdCPMEtuDMtIn/L4sZU5sztuFNWhRfDOQ05cgvCjIC?=

=?Windows-1252?Q?OViUIJRfQu6Bo0ChCaXVUxqJBthIIQ/RO3m8cZKIPwZbGcImcUcDgZik?=

=?Windows-1252?Q?Op1ziqA308JmA00k/4ZnljiIYRpdLpCUBd81eXW/SSPYAecjQl5Itb34?=

=?Windows-1252?Q?6IW7gV8POiQVMIdI/Ml+uQUnzmeKJjjPetJQbuOvcuFBk5o0JpQYKNNy?=

=?Windows-1252?Q?OhLdq7sVLLyMmSxesB4vL4UhRrTKyAD/XRynaBmi5kyk/0Nw6gz07xeV?=

=?Windows-1252?Q?qOLVycWE6c8fVLEAHc0xwnIIWEjRbKzBFsaPpJiISoIoVKKofesn+eqF?=

=?Windows-1252?Q?2/I3PI2d/lFCRbCIYgyTt/CMXSNsK1ZhRpuFZanXdQQgKbLtVFBgkRNS?=

=?Windows-1252?Q?fzNEWErdHlutpjwgKA1blMV+d7a+P77YcwtZ7cyffX7xPyGvJVOKTlhm?=

=?Windows-1252?Q?I0CwrYkDcanlZ3oR2DB9qXtzzhwUePvEsu05XkgM4zaEYMu0yG4lrif3?=

=?Windows-1252?Q?rgggjDBahsy5J8W5IZeL6tHxlzsf+uJ4nF5SYlDDA+h4lggB0zLPKq06?=

=?Windows-1252?Q?vTbjvYtBGx/neg8Uncy5MnPx+kkA7FAo8SpPoF0ZesZPa3AkjLlWts/I?=

=?Windows-1252?Q?rtGEp+nDcPgolpuZaYIai2IPjFV9fBve+1xehtX9tFIrALjh0XQhqyef?=

=?Windows-1252?Q?sn7eQKZRoNhaGPTbWJnVVO76o9k/zfhr8tHG8kFqJ4FKXYvD5T7/1C86?=

=?Windows-1252?Q?5Kcy24KXkN/EgxEtagdckhRJ8QDkkJOPoJTHE7JCxUOtSzDtNmjG7uw/?=

=?Windows-1252?Q?S2ibM8/+FmiRkwd20nOLrBmY59WVzdlti+IOYLMbj3GnpzyK/CJ5dbPM?=

=?Windows-1252?Q?ZxmidHsDEkw3k03A+uv6tUoFPjV3+sL+OlCcz6nDupQfZoW2YOydZD79?=

=?Windows-1252?Q?Bvo9wm10E8/RdwCovPUld1ggovVdfi7wjGomyexiFtlN8HEtZlPjP0Xt?=

=?Windows-1252?Q?wXrXpfKQVX96w+VvQcMsFlAMnrg7Ye76tO3XQO6OytXmjGLo?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?Windows-1252?Q?QEx73/KVrfeIql6MFZHdqLGJidQ0WcoZJfu3wQO3XoaVw0HCG58nqiqa?=

=?Windows-1252?Q?VMikDM/mbyEHp6DEQ3h9Qf1oIeouhOuB04j7kanHaeth6d49URIuUniD?=

=?Windows-1252?Q?M1alTtLfgVYoaQpmfYQ/AbiuXIuCjdA8+cqcKusdfAQogbwEza9oQAPc?=

=?Windows-1252?Q?9mZCjbmwfDUKBVCUDc797owq9lY0NSqRjOBay6zwS5bvMD8s9T4DVsMc?=

=?Windows-1252?Q?9HFk/IbsuxuOuEDojFioH+K8Wwu5GwAYUdSpONyOJElFipv23u4zqNa0?=

=?Windows-1252?Q?effVLN/LOj17uiF7sYjzSuwrFX+rHiY/DiL99Tch93Z5Zm5fogrFms/s?=

=?Windows-1252?Q?gbO0ALkXCFPF45kXv+0f0yUONr36mOKTg5gNTVaEFef4wZtmSBOwgFP7?=

=?Windows-1252?Q?o/8EQY1gsZdL2yhmc8CepPV76T9C+LSAt8n6rj904OmS+OVTzj/eDIVs?=

=?Windows-1252?Q?Ap3ZsS+Wv1ywF1mo4NE5DaaOabN5bBansN3aKxdIhTqSNSvGjGaTigHZ?=

=?Windows-1252?Q?kiF6rAZ1xBSg+z3on1O5ZG6jey9fCVeh8EVLp2w9dnYv9K4FUgPrVKXj?=

=?Windows-1252?Q?+vvGde2a85+lRzmj8POrURQjXZtdEHpcZXaHsN5ez7iExWQ/4u7WOi1q?=

=?Windows-1252?Q?HeBMr/LEonFsfNklr9dBBK0mxzZ6FipF0KiP4+chqZDQBIr/WWVByRbA?=

=?Windows-1252?Q?ACbIG2t/IZn5XIFjF9f39+5jkQJ/uhAYhEfC2RMBtvJfOw2mRxYiBKsr?=

=?Windows-1252?Q?CLdL583Y34itAojFXIJttgn034B5uJTGKgqxeB2WFN8Z5OL2yP62LNyI?=

=?Windows-1252?Q?kuVtZRpOnGDfgfEoWDqBjk4WK2qQ1TPw5RsZH7KMAIy85so2wcHvtiRo?=

=?Windows-1252?Q?f+kWQ9Q/ooPwHzikWeXbl08CYr1L3FP08YNXbv21ReUdD8g+1lryxlFb?=

=?Windows-1252?Q?lx1ynSB/P6UuWby++8thUQ/4Gj7oZdDljtVIoRMjB7OCxdaG/au3MRAq?=

=?Windows-1252?Q?FnwnN7DnlaUN8wyMfP2xwWdDZ/CkU5/RIKFmVjaQC0SNvCvru2XVykuG?=

=?Windows-1252?Q?1T6B1jtn2nj4doiz9dAxrXNNbs/6nKOYpUA+QgW3EVXnz5MSs+Y0lsa6?=

=?Windows-1252?Q?gLFQTcX3oCWnLNvWHoNggQq+h9BgJnsE/pHFcuRjRqhAxguCD1E/GAcu?=

=?Windows-1252?Q?nwAtX/fjDD81+bbAHla2jWRdr8z3yRWnAd9Qwr6VzrfyuqjI25EJLe5n?=

=?Windows-1252?Q?kb9ANoqgoP5eEhRHNsktxKKrT7xKRnOFO86ems+NgSLzOg6mQTfSkZUV?=

=?Windows-1252?Q?fTirD5hTFzYIJx5hsyO8YGNbj2+fvbiBWMskCsOEuI9rPldES1f88R32?=

=?Windows-1252?Q?P/TZHzbEA7wCaubSRcttP6bQBqBEvKXV9HkPH1LLsSoYBP2kZ4YeLL4X?=

=?Windows-1252?Q?VT9prqfdVcl3GG21toiFTUTJnfc71D/jXLGQ9FzlGapZ+u/WKF/Nkgr+?=

=?Windows-1252?Q?qPacNbboYh3HDA1Cz9ZHqDDXs+IgfXPrar/mCI4HfRB5J49z7cSQnrNY?=

=?Windows-1252?Q?5MzrT7euTE5Fe5zp?=

Content-Type: multipart/alternative;

boundary="_000_SJ0PR03MB7027667C987A5A87800CC14BD7EB2SJ0PR03MB7027namp_"

MIME-Version: 1.0

X-OriginatorOrg: outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: SJ0PR03MB7027.namprd03.prod.outlook.com

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: aad17378-d325-4f34-6972-08ded37a5b95

X-MS-Exchange-CrossTenant-originalarrivaltime: 26 Jun 2026 11:59:20.8248

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: DS0PR03MB7584

Domain monetisation spam from Google Gmail Part 2

Posted by Dave Yadallee on
--00000000000013e2c00655254f58

Content-Type: text/plain; charset="UTF-8"



Hey, this is Nik from Roller. Could you please clarify whether you

currently monetize your domains?



--



Teams : nik@rollerads.com



Telegram : @nikrollerads

























--00000000000013e2c00655254f58

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Hey, this is Nik from Roller. Could you please clarif=

y whether you currently monetize your domains?


n class=3D"gmail_signature_prefix">--

gmail_signature" data-smartmail=3D"gmail_signature">


=3D"ltr" style=3D"color:rgb(34,34,34);line-height:1.8;margin-top:0pt;margin=

-bottom:0pt">
olor:rgb(0,0,0);background-color:transparent;vertical-align:baseline">Teams=

:=C2=A0
17,85,204)" target=3D"_blank">
eway,sans-serif;color:rgb(61,101,255);background-color:transparent;vertical=

-align:baseline">nik@rollerads.com


lor:rgb(34,34,34);line-height:1.8;margin-top:0pt;margin-bottom:0pt">
tyle=3D"font-size:10pt;font-family:Raleway,sans-serif;color:rgb(0,0,0);back=

ground-color:transparent;vertical-align:baseline">Telegram :=C2=A0
href=3D"https://wearerollerads-com.rmailroute.net/x/d?c=3D51984853&l=

=3D32492627-e514-479b-9c1a-7f23d37ddec8&r=3D44ed6dd5-5b51-4f06-8f4a-be3=

7dfe5098a" style=3D"color:rgb(17,85,204)" target=3D"_blank">
font-size:10pt;font-family:Raleway,sans-serif;color:rgb(61,101,255);backgro=

und-color:transparent;vertical-align:baseline">@nikrollerads

=


margin-bottom:0pt">
?c=3D51984853&l=3D79e14ed5-e0d0-48be-82d6-2046629a4f22&r=3D44ed6dd5=

-5b51-4f06-8f4a-be37dfe5098a" style=3D"color:rgb(17,85,204)" target=3D"_bla=

nk">
-color:transparent;vertical-align:baseline">
ium;border-style:none;border-color:currentcolor;display:inline-block;overfl=

ow:hidden;width:29px;height:29px">
.com/fTU2P6eNkI7ODZiH9uTXVdhaDO5LLgqxAo83zMEGnjTwjV84D46Vl9HH0JdvuhoLCCYQZh=

HcjICV2Vh96079A69V1hlkrggTLo1GW_ZdFdsc3L5s6eRaUnrcXsZCLQNUZffPbl83KzNDbiPoN=

biWUwQ" width=3D"29" height=3D"29" style=3D"margin-left:0px;margin-top:0px"=

>
erif;color:rgb(51,51,51);background-color:transparent;vertical-align:baseli=

ne">=C2=A0
=3D51984853&l=3D083d7851-4875-44e2-a705-fd2b7d4c519f&r=3D44ed6dd5-5=

b51-4f06-8f4a-be37dfe5098a" style=3D"color:rgb(17,85,204)" target=3D"_blank=

">
olor:transparent;vertical-align:baseline">
m;border-style:none;border-color:currentcolor;display:inline-block;overflow=

:hidden;width:29px;height:29px">
om/N_LdgS_iUjSIzAnbYXRSRfLQlCx-PWtEsL6Rt4rC1fVs-neJV3V-Zy2eejwAS3CZqH4KzKWm=

WxQvoAjpo9gTCg0zjwHOMT8hexaOJMPYRs77Ra5ioHCfc0ZUkbSmba5hZHBZjYyTd1YZt638RWc=

Pj14" width=3D"29" height=3D"29" style=3D"margin-left:0px;margin-top:0px"><=

/span>
if;color:rgb(51,51,51);background-color:transparent;vertical-align:baseline=

">=C2=A0
=3D51984853&l=3D8190a883-1ef5-4752-9b0a-b000ffc7bb1f&r=3D44ed6dd5-5=

b51-4f06-8f4a-be37dfe5098a" style=3D"color:rgb(17,85,204)" target=3D"_blank=

">
olor:transparent;vertical-align:baseline">
m;border-style:none;border-color:currentcolor;display:inline-block;overflow=

:hidden;width:29px;height:29px">
om/ISM_gt9kYDdaepq-KeOuz5w1ieXIZLGsvEwsjrrjd35ZqPfjywU6MjMv5A1ibZuVsMKb4_wz=

8G-63TkawvITv6fQ5h9cBMylj1QZgaG6_nzMo1Y0m6YOsCdJ1geNrB7ol6ES0FmqlbcKfO5EFWA=

rWIA" width=3D"29" height=3D"29" style=3D"margin-left:0px;margin-top:0px"><=

/span>
if;color:rgb(51,51,51);background-color:transparent;vertical-align:baseline=

">=C2=A0=C2=A0
/d?c=3D51984853&l=3De5884f1b-199d-4272-a0c7-ad873130ee8d&r=3D44ed6d=

d5-5b51-4f06-8f4a-be37dfe5098a" style=3D"color:rgb(17,85,204)" target=3D"_b=

lank">
nd-color:transparent;vertical-align:baseline">
edium;border-style:none;border-color:currentcolor;display:inline-block;over=

flow:hidden;width:29px;height:29px">
nt.com/zeF6Fm2lylM2nQM7NRYoFFRlVhZm_ShgaU7PCpBR67bLIj-mzeGy37hAo8FSSlJii63O=

jH06tfKxMxzKlqC9Fk4QUUarHs92cOMMEAyD_LtIH1p52ZboLPDh2V2tGPvhvE6ZCcF2qqpxw10=

QL8Bq-V4" width=3D"29" height=3D"29" style=3D"margin-left:0px;margin-top:0p=

x">
rgb(0,0,0);background-color:transparent;vertical-align:baseline">=C2=A0 =C2=

=A0 =C2=A0 =C2=A0=C2=A0
ute.net/x/d?c=3D51984853&l=3D32492627-e514-479b-9c1a-7f23d37ddec8&r=

=3D44ed6dd5-5b51-4f06-8f4a-be37dfe5098a" style=3D"color:rgb(17,85,204)" tar=

get=3D"_blank">
background-color:transparent;vertical-align:baseline">
-width:medium;border-style:none;border-color:currentcolor;display:inline-bl=

ock;overflow:hidden;width:108px;height:23px">
usercontent.com/vkTobz8uGezGseujZQGbTzFlavwAqhqnG7I-_JwLchoxxv9hdHnqYMR7rty=

JNK22HsONx6rP0_xDiXbJbH_p_Q2RS-lB4xbycRlDe7xe-ouu8soMibD6nkRtV_GVji3CvGtoFP=

1y9WInoA_fH53yJLc" width=3D"108" height=3D"23" style=3D"margin-left:0px;mar=

gin-top:0px">




-M-Fc68Xr3uGtKDlJcR0ByHNbRyuNtwC_WLzCTjEOCDAnibCsZKuo8bzPkdwOXHYmTNQ4oMxQeY=

AQ_84t4eDnAprg6t7YpqRf-ocLsxO6G2WYUy4iCWMdsRMTs5mQWJWewcIvXjdTrVsAWmwvMaEsM=

ajgmzq4-vcdraV93hYvuyXEi" alt=3D"">



--00000000000013e2c00655254f58--

Domain monetisation spam from Google Gmail Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 26 Jun 2026 06:41:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wd5rT-00000000Dp1-0LRW

for dave@doctor.nl2k.ab.ca;

Fri, 26 Jun 2026 06:40:47 -0600

Resent-From: The Doctor

Resent-Date: Fri, 26 Jun 2026 06:40:46 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-qk1-f194.google.com ([209.85.222.194]:53350)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wd3WG-00000000BJI-07sJ

for root@nl2k.ab.ca;

Fri, 26 Jun 2026 04:10:52 -0600

Received: by mail-qk1-f194.google.com with SMTP id af79cd13be357-915b5ce94c7so75484385a.2

for ; Fri, 26 Jun 2026 03:09:55 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1782468589; cv=none;

d=google.com; s=arc-20260327;

b=jXZYUy4aomYdGCd5/LHADd2jieKsrhi358Za0CkmZV9vTzPb0lQ/JaVIK5JbH3Ei/G

iwak66CLSH5ff92L+EPEl2hP/jkfqFwrdHpkgSEXk+sjP8PuXehJIUJ1I7Sl1qn6QNhx

QclXeuRGgm8McWC+ceVMe5rLyuSnevgCXDUBlZp76TD6RPzN1VknnIJ9Y7oAsDwINVhm

a9QPiQvqGDFqt/d4P2Z+fHilwM96sDVdVWn5lsqtAxvs4AzWQSFlbzZ8/Kg9jBuuZefD

7nVOiaJTWkOHZ8BeHvBCfNubqmOGMz5lv6pzFWFjGgO2BgPDr0qi3QhZ3QspUho+Bim8

sSRg==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;

h=to:subject:message-id:date:from:mime-version:dkim-signature;

bh=H9+9ZXpPOJGSINFd5gV+RPQB73Xki5oeraT6UKMkY54=;

fh=xlaqb4BBoLdJtBZev3L7vUQ7NrRWtYUi797wkNVG1OA=;

b=H232fqOCJoHqVvcXkk8ZZ+6UE/d6FnSX9CEqD7DOtbKdhgymOYbQNxW4drN0h4kyK5

p3miSdJ6g+w7oYFhzB+Plfb0cdgB8mieHLZcdBSQUBqgma1T1/baZ9itNBIOx6PH6gka

lfqeRSf1y6oPwhYOuHjOXmOjcA4ZJwlWWMPc1lRsmH/YuIocrb0Frp69Brv2XuSWlG+b

KgrxjP44BdCaDY0jrGgrW2Zq7NzvVZJ1g7poG8piOB1oVwLfhyOemZld+TnHvHscZXNN

VQ8PSddkdHuLsQ7xgnmHW1mBQAGXHRXgac6MRAH91uVcplfwPVrDewyShgBZUDrE/k7p

toLw==;

darn=nl2k.ab.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=wearerollerads.com; s=google; t=1782468589; x=1783073389; darn=nl2k.ab.ca;

h=to:subject:message-id:date:from:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=H9+9ZXpPOJGSINFd5gV+RPQB73Xki5oeraT6UKMkY54=;

b=dYnAqV6pyP3YK5IacTm/tpDpbIFwdYXRJxJ+zlZxeKdslxQS9G579XVkyzzMVjJivZ

4FhUzYVWF8tXJexX/Y832t7p2XccNcyODi3a9857JQO/cqIK6b+BIS07LSoORakV0uwS

dee12yfd/k86WXjXCBI4mSDspKQYgBk2ODl7A=

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1782468589; x=1783073389;

h=to:subject:message-id:date:from:mime-version:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=H9+9ZXpPOJGSINFd5gV+RPQB73Xki5oeraT6UKMkY54=;

b=Psq+NbKsjy6ptWazvp+u1xl+x9Ac+SUoGId39e+tx3DTwDFCaG35E477OFnIh4WQIZ

+FkjPhYAzY70+61jwptQLE3hJDHrDSCS4LDWAO98L/1FIf4y6jEOL5nLXDXBZ96riozo

zHUuBEL1pJzS8o9coA6Ddy2J7wFn4mXtj2Wgu34siBomqQG5xnlBz3NR0MF6L4jIWbXm

mOxSUGwUIHxtq9o27qLXE3XV537cyXLxpazChgIvMwfJqZApkqelTKUaMz1wFafeIwev

/g0PVjOeRM3oUjWHvAVekCR2ldMhGfIMD5+OoFvIaGaSH2WM1XE/rMNErmOXdXc0NRCW

jRpw==

X-Gm-Message-State: AOJu0YwcA0fcMVf6URWW1y4jSzBHzvlT2qK2/PEY9iRnp6ZZiYDgkGsf

Ymb1R6ExEpj8vJIgs83ciCdhLoR/5brA7pCWa8XTrKhdZmWvCVmj7fkPksFqEQUMPPSjbBf9kJO

Bc35MqPI0IHWb331y52dJc1gjf34WVo9PvJeSQ/iX5dT0QkmUn4It3w==

X-Gm-Gg: AfdE7cmncIcXOSLf/vI1pOOJ64k6+MQ6bU+PMDAHwR3K9Q8GDCWtqmUCWsgRV2SBVw4

kKS2+UGj+YqcBW018mmyJZUKJ3DJPfx/v1YhUndv74Dn8LYEOlvmFgbOC9ERpf+WjUkvIXPHXxY

Z+dMmT582nuLWPPupJGZKvqYviNFq0VEEruq4pF7zP4MS5PR6WB+AQ4HpqOcmfSF8C0QnCwXo5Y

l9a632IxsnInLDOaXXVM+emvh9AuNh2jctXF6Dfndj+2CzsW7PFp/aKXidQ72LzypqCCnZnIDZr

h4gNRaEnIKqKrQ2AUaiXtbfozw==

X-Received: by 2002:a05:620a:6412:b0:915:aa63:f34a with SMTP id

af79cd13be357-9293abad59bmr931719785a.22.1782468589114; Fri, 26 Jun 2026

03:09:49 -0700 (PDT)

Received: from 776393159873 named unknown by gmailapi.google.com with

HTTPREST; Fri, 26 Jun 2026 03:09:48 -0700

Received: from 776393159873 named unknown by gmailapi.google.com with

HTTPREST; Fri, 26 Jun 2026 03:09:48 -0700

MIME-Version: 1.0

From: Niko

Date: Fri, 26 Jun 2026 03:09:48 -0700

X-Gm-Features: AVVi8Cf4whc8IkGTtQEOmaJl4worBUlu6FspxiInwc2CafThRCj9bvd84jFebNs

Message-ID:

Subject: Parker Roller Party

To: root@nl2k.ab.ca

Content-Type: multipart/alternative; boundary="00000000000013e2c00655254f58"

X-Spam_score: 6.8

X-Spam_score_int: 68

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hey, this is Nik from Roller. Could you please clarify whether

you currently monetize your domains? -- Teams : nik@rollerads.com





Content analysis details: (6.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.222.194 listed in will-spam-for-food.eu.org]

[209.85.222.194 listed in will-spam-for-food.eu.org]

[209.85.222.194 listed in will-spam-for-food.eu.org]

[209.85.222.194 listed in will-spam-for-food.eu.org]

[209.85.222.194 listed in will-spam-for-food.eu.org]

[209.85.222.194 listed in will-spam-for-food.eu.org]

[209.85.222.194 listed in will-spam-for-food.eu.org]

[209.85.222.194 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.222.194 listed in dnsbl.ahbl.org]

[209.85.222.194 listed in dnsbl.ahbl.org]

[209.85.222.194 listed in dnsbl.ahbl.org]

[209.85.222.194 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.222.194 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.222.194 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.222.194 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.222.194 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.222.194 listed in list.dnswl.org]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: rmailroute.net]

1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist

[URI: hmailroute.net]

[URI: rmailroute.net]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.222.194 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.222.194 listed in wl.mailspike.net]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.5 IMPRONONCABLE_2 Too much mixed numbers and lower-case letters

Subject: {SPAM?} Parker Roller Party