Outstanding invoice phish from dreamhostps.com part 6

Posted by Dave Yadallee on


















































































































































































{{ message_content }}

{{ unsubscribe_link }}





Outstanding invoice phish from dreamhostps.com part 5

Posted by Dave Yadallee on




















  • M­ak­e a o­n­e-t­i­me pay­m­e­n­t D­o­n’t h­a­v­e a My A­cc­o­unt y­e­t? M­a­k­e a sec­ure o­n­e-t­ime pay­m­en­t.


























































































  • C­o­ns­o­l­ida­t­e yo­u­r bill­ing a­c­c­o­u­n­t­s n­ow C­o­mb­ini­ng a­l­l y­ou­r ac­c­o­un­ts on o­ne si­mp­le bi­l­l m­ake­s it ea­sier t­ha­n e­v­e­r to s­ave tim­e.




 






































































Outstanding invoice phish from dreamhostps.com part 4

Posted by Dave Yadallee on




















  • P­a­y dire­ctl­y t­hr­oug­h y­o­ur b­a­n­k Make a payment through your financial institution. Select ‘407 ETR’ as the payee.


























































































  • P­a­y t­hro­ugh o­u­r m­o­b­i­l­e a­pp Ge­t r­e­a­l-ti­m­e n­ot­i­fic­a­ti­o­n­s, c­h­e­c­k y­ou­r b­a­la­n­c­e, p­ay y­o­u­r b­ill a­n­d mo­re.




 






























































































Outstanding invoice phish from dreamhostps.com part 3

Posted by Dave Yadallee on


















We are writing to inform you that there is an outstanding balance of $9.95 CAD on your 407 ETR account.
To avoid any late fees and ensure your account remains in good standing, we kindly request that this amount be paid

by January 13, 2026.



You can conveniently and securely make your payment by visiting our official website at https://www.407etr.com/en/pay-your-bill .



Should you have any questions or require assistance, our customer service team is here to help. Thank you for your prompt attention to this matter.

Kind regards,
Customer Service Team









































 


























More ways to pay






















C­hoo­s­e f­ro­m a v­a­r­i­ety of co­nve­ni­en­t o­p­t­i­o­n­s. Ha­v­e y­o­u­r a­c­co­u­n­t n­umber h­a­n­d­y—y­o­u c­a­n f­ind it at th­e t­o­p-r­i­gh­t co­rner of yo­ur b­il­l.





































































































Outstanding invoice phish from dreamhostps.com part 2

Posted by Dave Yadallee on




















































































































 


























Outstanding Balance on Your 407 ETR Account






















































Outstanding invoice phish from dreamhostps.com part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 12 Jan 2026 18:17:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vfT1e-000000002Uo-1DRW

for dave@doctor.nl2k.ab.ca;

Mon, 12 Jan 2026 18:16:50 -0700

Resent-From: The Doctor

Resent-Date: Mon, 12 Jan 2026 18:16:50 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from vps68088.dreamhostps.com ([66.33.215.181]:56806)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vfRE7-00000000JTI-4BVY

for doctor@doctor.nl2k.ab.ca;

Mon, 12 Jan 2026 16:21:39 -0700

Received: by vps68088.dreamhostps.com (Postfix, from userid 6897968)

id 4dqpGv6jD7zYZRMB9; Mon, 12 Jan 2026 15:19:03 -0800 (PST)

To: doctor@doctor.nl2k.ab.ca

Subject: Action Required: Outstanding Balance on Your 407 ETR Account

X-PHP-Originating-Script: 6897968:header.php

From: 407 ETR

Reply-To: dh_q7vg4m@vps68088.dreamhostps.com

MIME-Version: 1.0

Content-Type: text/html; charset=UTF-8

Message-Id: <4dqpGv6jD7zYZRMB9@vps68088.dreamhostps.com>

Date: Mon, 12 Jan 2026 15:19:03 -0800 (PST)

X-Spam_score: 20.9

X-Spam_score_int: 209

X-Spam_bar: ++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Outstanding Balance on Your 407 ETR Account We are writing

to inform you that there is an outstanding balance of $9.95 CAD on your 407

ETR account. To avoid any late fees and ensure your account remains in good

standing, we kindly request that [...]



Content analysis details: (20.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[66.33.215.181 listed in dnsbl.ahbl.org]

[66.33.215.181 listed in dnsbl.ahbl.org]

[66.33.215.181 listed in dnsbl.ahbl.org]

[66.33.215.181 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[66.33.215.181 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[66.33.215.181 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[66.33.215.181 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[66.33.215.181 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[66.33.215.181 listed in will-spam-for-food.eu.org]

[66.33.215.181 listed in will-spam-for-food.eu.org]

[66.33.215.181 listed in will-spam-for-food.eu.org]

[66.33.215.181 listed in will-spam-for-food.eu.org]

[66.33.215.181 listed in will-spam-for-food.eu.org]

[66.33.215.181 listed in will-spam-for-food.eu.org]

[66.33.215.181 listed in will-spam-for-food.eu.org]

[66.33.215.181 listed in will-spam-for-food.eu.org]

0.0 URIBL_PH_SURBL Contains an URL listed in the PH SURBL blocklist

[URI: webtrack-gslgrousp.com]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

2.3 MANGLED_ACCNT BODY: mangled account(s)

2.3 MANGLED_SAVELE BODY: mangled save sale

2.3 MANGLED_MEN BODY: mangled men

2.3 MANGLED_TIME BODY: mangled time

2.3 MANGLED_YOUR BODY: mangled your

2.3 MANGLED_FROM BODY: mangled from

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

1.0 VOWEL_URI_5 URI hostname with 5 consecutive vowels

Subject: {SPAM?} Action Required: Outstanding Balance on Your 407 ETR Account































NetKnow now in NetCraft's Top 13200 part 2

Posted by Dave Yadallee on

MCSnet





MCSNET ranks >2000000 from >2000000 and are hosted by Microsoft .



Nucleus Internet Services





After that we have

Nucleus Information Services which can be found at Netcraft Rank >2000000 from >2000000 .





4Web





4web ranks >2000000 from >2000000 .



Alentus / Wolfpaw





Alentus

rank by Netcraft >2000000 from >2000000 and I note they are hosted in the USA .

wolfpaw.net

which ranks at >2000000 from >2000000



Yellowpencil





Yellowpencil Ranks >2000000 from >2000000



WSI Corporation





Next is WSI - We Simply The Internet of Toronto

at Netcraft Position >2000000 from >2000000 and are being hosted on Amazon.



Uniserve / Interbaun





Next, Uniserve

ranks on Netcraft >2000000 from >2000000

One of their acquisitions

interbaun

ranks with Netcraft ?????? from ?????? due to merging of sites.

One customer just came over from this organization in Nov 2006.



Clearwave Broadband





Clearwave Broadband ranks

at >2000000 from >2000000



Platinum Communications





Platinum Communications Corp.

bought out by Xplornet .



Wild Rose Internet





Wild Rose Internet

ranks >2000000 from >2000000 and I wonder if this is another wireless branch of Tera-Byte and bought out by Xplornet





TIC Internet





TIC Internet

ranks >2000000 from >2000000 ( I do remember you).



Nisa Custom Internet Solutions





Nisa Custom Internet Solutions

ranks >2000000 from >2000000 by Netcraft



MediaShaker





Media Shakers of Edmonton

ranks >2000000 from >2000000





Koi Media





Koi Media

rank >2000000 from >2000000



WebFire





Webfire.ca

ranks >2000000 from >2000000 and seems to be connected with Shaw.



Core Network Solutions Inc.





Core Network Solutions Inc.

ranks at >2000000 from >2000000 .



The Network Centre





The Network Centre

ranks >2000000 from >2000000 and are linked with Telus high Speed.





Open Concept Internet, Inc.





Open Concept Internet, Inc.

rank > 2000000 from > 2000000





Techalta





Interspots of Edmonton

acquired by Techalta ;



Yegtel





Yegtel rank > 2000000 .



Internet Crossroads





Internet Crossroads Ltd of North Edmonton

rank nothing from nothing by Netcraft and seems to merged with Tera-Byte/ecn.ab.ca .



If I remember anymore, I will add to this entry, before Netcraft changes our ranking. Please watch this space and please feel free to peruse

our services.

NetKnow now in NetCraft's Top 13200 part 1

Posted by Dave Yadallee on
All data is from Netcraft Toolbar .

Looks as if there are major changes to the Netcraft algorithm after some years! Why did Avast clasify the extension as URL:Phishing?

This is not the Alexa Tool Bar!



NetKnow







Netknow now at 13177 from 13866 at Netcraft and pfs compliant



A significant increase! We must do
  1. security audits regularly
  2. check on illegitimate traffic hitting the web server
    3. and
  3. keep design current!




How do we compare with other providers in

Edmonton, Alberta, Canada?



Rogers





Rogers Business Solutions

which rank 3913 from 3976 and are hosted in Europe.



Telus and reviews



Next we have Telus.com

ranked by Netcraft at 6238 from 6279 .

Sometimes their Web Hosting is done by
title="Internet Names for Business">Internet Names for Business

is ranked by Netcraft at >2000000 from >2000000 .



Is Telus's ADSL network susceptible to Code Red Attacks and Attackers?

Reviews of Telus are available :





Netknow again





We at Netknow are at 13177 from 18857 since the start of 2026.



Government of Alberta



The Government of Alberta Website

ranks 15043 from 15149 by Netcraft and seems to hosted on Cloudfare.



City of Edmonton







The City of Edmonton ranks 30884 from 30718 by Netcraft and hosted by Google.



University of Alberta







The University of Alberta ranks 52305 from 53409 hosted by Amazon Techonologies.



Juno and NetZero





We have Juno Internet ranked on top

at 306818 from 307348 who are the owners of

US Based Netzero at Netcraft Rank 60939 from 59505 .



Grant MacEwen University





MacEwan ranks 117489 from 131344 .



NAIT / Northern Alberta Institute of Technology





NAIT ranks 128531 from 132129 hosted by Microsoft .



TekSavvy



TekSavvy ranks 178509 from 183898 and are hosted by Microsoft



Shaw Cable





Next,

members.shaw.ca

ranks >2000000 from >2000000 and retired and

Shaw Cable

is next at Netcraft rank 1196274 from 1199545 . Hosted now by Akamei .

Their Network Hosting Arm,

Big Pipe is at

Netcraft rank 301472 from 287743 and hosted by Akamai in Europe .



Reviews of Shaw are available :





Xplornet



xplornet

ranks >2000000 from >2000000 and are listed with

Cirrus9 and are joining up with Shaw.

Their new domain xplore.ca ranks 351333 from 351960 .

According to an article in the Sherwood Park Independent, they are also getting an Alberta Government subsidy.



Internet Centre / CCINet



Internet Centre

rank 671688 from 673184 . Their partner Rack Nine ranks > 2000000.



Distributel / 3Web / CIA



Cybersurf

is ranked 849575 from 676041 and seems to be hosted in USA by DigitalOcean.



Primus



Primus

ranks >2000000 from >2000000 and now points to BLACKIRON_DataCentres ranked >2000000 from >2000000.



Northern lights Fiber







Northern lights Fiber are ranked by Netcraft >2000000 and uses AWS.



OkayVPN





OkayVPN

are ranked by Netcraft >2000000 and uses Cloudfare.



Radiant Communications / goco.ca





Radiant Communications

are ranked by Netcraft >2000000 and part of goco.ca

which ranks >2000000 .



Tera Byte Edmonton and reviews





Next is Tera-Byte

at Netcraft Rank >2000000 with

Tera-Byte.ca

ranking >2000000 from >2000000 and their wireless arm Tera-Byte Wireless

sold to Xplornet.

One of Tera-Byte's acquisitions

Edmonton Community Networks

ranks at >2000000 from >2000000 and

Go Edmonton ranks >2000000 from >2000000.

Alberta political blogger Daveberta ranks >2000000 from >2000000; interesting!!!

Reviews of Tera-byte is available at

here

and another here

and check Google for more reviews; just search tera byte.

NetKnow now in NetCraft's Top 13200 part 1

Posted by Dave Yadallee on
All data is from Netcraft Toolbar .

Looks as if there are major changes to the Netcraft algorithm after some years! Why did Avast clasify the extension as URL:Phishing?

This is not the Alexa Tool Bar!



NetKnow







Netknow now at 13177 from 13866 at Netcraft and pfs compliant



A significant increase! We must do
  1. security audits regularly
  2. check on illegitimate traffic hitting the web server
    3. and
  3. keep design current!




How do we compare with other providers in

Edmonton, Alberta, Canada?



Rogers





Rogers Business Solutions

which rank 3913 from 3976 and are hosted in Europe.



Telus and reviews



Next we have Telus.com

ranked by Netcraft at 6238 from 6279 .

Sometimes their Web Hosting is done by
title="Internet Names for Business">Internet Names for Business

is ranked by Netcraft at >2000000 from >2000000 .



Is Telus's ADSL network susceptible to Code Red Attacks and Attackers?

Reviews of Telus are available :





Netknow again





We at Netknow are at 13177 from 18857 since the start of 2026.



Government of Alberta



The Government of Alberta Website

ranks 15043 from 15149 by Netcraft and seems to hosted on Cloudfare.



City of Edmonton







The City of Edmonton ranks 30884 from 30718 by Netcraft and hosted by Google.



University of Alberta







The University of Alberta ranks 52305 from 53409 hosted by Amazon Techonologies.



Juno and NetZero





We have Juno Internet ranked on top

at 306818 from 307348 who are the owners of

US Based Netzero at Netcraft Rank 60939 from 59505 .



Grant MacEwen University





MacEwan ranks 117489 from 131344 .



NAIT / Northern Alberta Institute of Technology





NAIT ranks 128531 from 132129 hosted by Microsoft .



TekSavvy



TekSavvy ranks 178509 from 183898 and are hosted by Microsoft



Shaw Cable





Next,

members.shaw.ca

ranks >2000000 from >2000000 and retired and

Shaw Cable

is next at Netcraft rank 1196274 from 1199545 . Hosted now by Akamei .

Their Network Hosting Arm,

Big Pipe is at

Netcraft rank 301472 from 287743 and hosted by Akamai in Europe .



Reviews of Shaw are available :





Xplornet



xplornet

ranks >2000000 from >2000000 and are listed with

Cirrus9 and are joining up with Shaw.

Their new domain xplore.ca ranks 351333 from 351960 .

According to an article in the Sherwood Park Independent, they are also getting an Alberta Government subsidy.



Internet Centre / CCINet



Internet Centre

rank 671688 from 673184 . Their partner Rack Nine ranks > 2000000.



Distributel / 3Web / CIA



Cybersurf

is ranked 849575 from 676041 and seems to be hosted in USA by DigitalOcean.



Primus



Primus

ranks >2000000 from >2000000 and now points to BLACKIRON_DataCentres ranked >2000000 from >2000000.



Northern lights Fiber







Northern lights Fiber are ranked by Netcraft >2000000 and uses AWS.



OkayVPN





OkayVPN

are ranked by Netcraft >2000000 and uses Cloudfare.



Radiant Communications / goco.ca





Radiant Communications

are ranked by Netcraft >2000000 and part of goco.ca

which ranks >2000000 .



Tera Byte Edmonton and reviews





Next is Tera-Byte

at Netcraft Rank >2000000 with

Tera-Byte.ca

ranking >2000000 from >2000000 and their wireless arm Tera-Byte Wireless

sold to Xplornet.

One of Tera-Byte's acquisitions

Edmonton Community Networks

ranks at >2000000 from >2000000 and

Go Edmonton ranks >2000000 from >2000000.

Alberta political blogger Daveberta ranks >2000000 from >2000000; interesting!!!

Reviews of Tera-byte is available at

here

and another here

and check Google for more reviews; just search tera byte.

Web/SEO/App Spam from Microsoft Outlook Part 2

Posted by Dave Yadallee on


--_000_SJ0PR04MB85160FAFCACCD15837DD4F05A581ASJ0PR04MB8516namp_

Content-Type: text/html; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable








252">








ns-serif; font-size: 12pt; color: rgb(0, 0, 0);" class=3D"elementToProof">

Hello,          



ns-serif; font-size: 12pt; color: rgb(0, 0, 0);" class=3D"elementToProof">

           



ns-serif; font-size: 12pt; color: rgb(0, 0, 0);" class=3D"elementToProof">

Hope you have a great day!!        =

  



ns-serif; font-size: 12pt; color: rgb(0, 0, 0);" class=3D"elementToProof">

           



ns-serif; font-size: 12pt; color: rgb(0, 0, 0);" class=3D"elementToProof">

We are a professional website development company, based in =

India with a strength of 150+ employees and a great portfolio to boast abou=

t. We are different because we provide the resources you need on a short-te=

rm, long-term and hourly basis.       &n=

bsp;  



ns-serif; font-size: 12pt; color: rgb(0, 0, 0);" class=3D"elementToProof">

           



ns-serif; font-size: 12pt; color: rgb(0, 0, 0);" class=3D"elementToProof">

If you're really looking to build a pixel perfect decent website =

or want to re-develop your previous website, then please share the det=

ails with us. We can assure you for a great design.   &=

nbsp;      



ns-serif; font-size: 12pt; color: rgb(0, 0, 0);" class=3D"elementToProof">

           



ns-serif; font-size: 12pt; color: rgb(0, 0, 0);" class=3D"elementToProof">

Our Development Services/Resources include: -   &n=

bsp;      



ns-serif; font-size: 12pt; color: rgb(0, 0, 0);" class=3D"elementToProof">

           



ns-serif; font-size: 12pt; color: rgb(0, 0, 0);" class=3D"elementToProof">

=95     Website Design/Revamp/Upgrade &n=

bsp;        



ns-serif; font-size: 12pt; color: rgb(0, 0, 0);" class=3D"elementToProof">

     



ns-serif; font-size: 12pt; color: rgb(0, 0, 0);" class=3D"elementToProof">

=95     Custom Web Based Software   =

;       



ns-serif; font-size: 12pt; color: rgb(0, 0, 0);" class=3D"elementToProof">

     



ns-serif; font-size: 12pt; color: rgb(0, 0, 0);" class=3D"elementToProof">

=95     Portal/Marketplace    =

      



ns-serif; font-size: 12pt; color: rgb(0, 0, 0);" class=3D"elementToProof">

     



ns-serif; font-size: 12pt; color: rgb(0, 0, 0);" class=3D"elementToProof">

=95     E-commerce development  &nb=

sp;       



ns-serif; font-size: 12pt; color: rgb(0, 0, 0);" class=3D"elementToProof">

           



ns-serif; font-size: 12pt; color: rgb(0, 0, 0);" class=3D"elementToProof">

Just keep an open mind and If any of this sounds something of your interest=

, then feel share your requirements and I would be happy to send you detail=

s about our company, pricing along with an estimated timeline for your proj=

ect/s.          



ns-serif; font-size: 12pt; color: rgb(0, 0, 0);" class=3D"elementToProof">

           



ns-serif; font-size: 12pt; color: rgb(0, 0, 0);" class=3D"elementToProof">

Looking forward to hearing from you.      &nb=

sp;   



ns-serif; font-size: 12pt; color: rgb(0, 0, 0);" class=3D"elementToProof">

           



ns-serif; font-size: 12pt; color: rgb(0, 0, 0);" class=3D"elementToProof">

Warm Regards,          
div>


ns-serif; font-size: 12pt; color: rgb(0, 0, 0);" class=3D"elementToProof">

Riya Singh



ns-serif; font-size: 12pt; color: rgb(0, 0, 0);" class=3D"elementToProof">

Business Development manager



color: rgb(0, 0, 0);" class=3D"elementToProof">












--_000_SJ0PR04MB85160FAFCACCD15837DD4F05A581ASJ0PR04MB8516namp_--

Web/SEO/App Spam from Microsoft Outlook Part 2

Posted by Dave Yadallee on


--_000_SJ0PR04MB85160FAFCACCD15837DD4F05A581ASJ0PR04MB8516namp_

Content-Type: text/html; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable








252">








ns-serif; font-size: 12pt; color: rgb(0, 0, 0);" class=3D"elementToProof">

Hello,          



ns-serif; font-size: 12pt; color: rgb(0, 0, 0);" class=3D"elementToProof">

           



ns-serif; font-size: 12pt; color: rgb(0, 0, 0);" class=3D"elementToProof">

Hope you have a great day!!        =

  



ns-serif; font-size: 12pt; color: rgb(0, 0, 0);" class=3D"elementToProof">

           



ns-serif; font-size: 12pt; color: rgb(0, 0, 0);" class=3D"elementToProof">

We are a professional website development company, based in =

India with a strength of 150+ employees and a great portfolio to boast abou=

t. We are different because we provide the resources you need on a short-te=

rm, long-term and hourly basis.       &n=

bsp;  



ns-serif; font-size: 12pt; color: rgb(0, 0, 0);" class=3D"elementToProof">

           



ns-serif; font-size: 12pt; color: rgb(0, 0, 0);" class=3D"elementToProof">

If you're really looking to build a pixel perfect decent website =

or want to re-develop your previous website, then please share the det=

ails with us. We can assure you for a great design.   &=

nbsp;      



ns-serif; font-size: 12pt; color: rgb(0, 0, 0);" class=3D"elementToProof">

           



ns-serif; font-size: 12pt; color: rgb(0, 0, 0);" class=3D"elementToProof">

Our Development Services/Resources include: -   &n=

bsp;      



ns-serif; font-size: 12pt; color: rgb(0, 0, 0);" class=3D"elementToProof">

           



ns-serif; font-size: 12pt; color: rgb(0, 0, 0);" class=3D"elementToProof">

=95     Website Design/Revamp/Upgrade &n=

bsp;        



ns-serif; font-size: 12pt; color: rgb(0, 0, 0);" class=3D"elementToProof">

     



ns-serif; font-size: 12pt; color: rgb(0, 0, 0);" class=3D"elementToProof">

=95     Custom Web Based Software   =

;       



ns-serif; font-size: 12pt; color: rgb(0, 0, 0);" class=3D"elementToProof">

     



ns-serif; font-size: 12pt; color: rgb(0, 0, 0);" class=3D"elementToProof">

=95     Portal/Marketplace    =

      



ns-serif; font-size: 12pt; color: rgb(0, 0, 0);" class=3D"elementToProof">

     



ns-serif; font-size: 12pt; color: rgb(0, 0, 0);" class=3D"elementToProof">

=95     E-commerce development  &nb=

sp;       



ns-serif; font-size: 12pt; color: rgb(0, 0, 0);" class=3D"elementToProof">

           



ns-serif; font-size: 12pt; color: rgb(0, 0, 0);" class=3D"elementToProof">

Just keep an open mind and If any of this sounds something of your interest=

, then feel share your requirements and I would be happy to send you detail=

s about our company, pricing along with an estimated timeline for your proj=

ect/s.          



ns-serif; font-size: 12pt; color: rgb(0, 0, 0);" class=3D"elementToProof">

           



ns-serif; font-size: 12pt; color: rgb(0, 0, 0);" class=3D"elementToProof">

Looking forward to hearing from you.      &nb=

sp;   



ns-serif; font-size: 12pt; color: rgb(0, 0, 0);" class=3D"elementToProof">

           



ns-serif; font-size: 12pt; color: rgb(0, 0, 0);" class=3D"elementToProof">

Warm Regards,          
div>


ns-serif; font-size: 12pt; color: rgb(0, 0, 0);" class=3D"elementToProof">

Riya Singh



ns-serif; font-size: 12pt; color: rgb(0, 0, 0);" class=3D"elementToProof">

Business Development manager



color: rgb(0, 0, 0);" class=3D"elementToProof">












--_000_SJ0PR04MB85160FAFCACCD15837DD4F05A581ASJ0PR04MB8516namp_--

Web/SEO/App Spam from Microsoft Outlook Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 12 Jan 2026 08:58:00 -0700

Received: from mail-southcentralusazolkn19011025.outbound.protection.outlook.com ([52.103.14.25]:12607 helo=SN4PR0501CU005.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vfKHy-00000000JPP-05zT

for dave@doctor.nl2k.ab.ca;

Mon, 12 Jan 2026 08:57:16 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=ayfGxrmW0owWhMyhWL5oavy3tNBcVoUR+L9OicHOk/lTyk2UKozdvZyEizBBv0mDm6l69ABwrf7Xwm4UXS9C/GXkrFMt+xeWCCESAaXo+5oDViEzZDnfPTTflNZ71versFTbs8mqL4jyMmKBbTWI67dPOzI4g0o+XWAOcm7DI5hWlqa0AL83N+llSiyE7z9Zwk8Tu2fTtBFgMVZYa8EG3obOh0tETk/Bhgz/1r8sff3lUd5UY99VVmGvSNYPF8UdxQ//UY5M7qJSeW+Z0uIOV4gb29WLeOVa1Ylx5OYlSmnh0W0X+zJ0bM4hgcifvLmpj9wrCtoAkvmWMoWL2K5QLg==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=h0ZA5zh3gHQKup+6fM8DqQ4Y89Ju9U7VScJfYvUWk6Y=;

b=WKilk56CzKavlP1lyyfZZqtEBjKN5IwtQXJPVEoYfwXZ0dLE4qz8i5U3aVLnKjSek1tmotX9Pe0lujfId1IKDJBapffENZPZNLCGYlyFibFCQOr1JXcTJAa7MmcRc4+2oOwW6TWdarBOuYBiRWRms+7MFN10ugFlfGIISUrjOOogumAxkL5SrOhITORzbGxUYKhtUaEPEgObrxaNDrYByWac24+POakdMp6dWzwtMKsIUmmZ1hHd9upqIo144Cx/Tc8GboTZTrdA/skyA7KQDc1LymCdrxWz/9zbL7NMMDNmiMTinq2B7zRKs9dfeVMlI9TcMQ4TTPAbirBiiytLEA==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hotmail.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=h0ZA5zh3gHQKup+6fM8DqQ4Y89Ju9U7VScJfYvUWk6Y=;

b=Z9WHeLeAO45lflvvgIHyF+fRF/2GkVY5OvyarjNFt0ygIU01nQ0TGmHxijZzGWe0LH2TCS8MKSu0qh6MXklOr4hRrwqzp4jZMVSmC9kro1wpDkIviTdBlh8gANZSRFknN6wYykzyz6dtf/O77hsOAM6z3YWFnKVPH7ET70eImEPv5zwtPDuiEafTH5VaR2ophAw09gOKRf/GspvIikPbsOGnDrQK+KGhXcaWAlg/76YNvgbPFeh36Gyxy/gIg7KmYdq354OCScCwi3vPL1LT4Dlz/fj3KwUsG8Qql18HuciaYP4hUUzn28btVoWkLf5w0YSwAhx1/cdf/Qk4VPyfgQ==

Received: from SJ0PR04MB8516.namprd04.prod.outlook.com (2603:10b6:a03:4e5::6)

by MW4PR04MB7331.namprd04.prod.outlook.com (2603:10b6:303:79::23) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9499.7; Mon, 12 Jan

2026 15:55:56 +0000

Received: from SJ0PR04MB8516.namprd04.prod.outlook.com

([fe80::f0f2:6788:c417:e490]) by SJ0PR04MB8516.namprd04.prod.outlook.com

([fe80::f0f2:6788:c417:e490%5]) with mapi id 15.20.9499.005; Mon, 12 Jan 2026

15:55:56 +0000

From: Anu Singh

Subject: Website Design & Development Proposal at low Cost

Thread-Topic: Website Design & Development Proposal at low Cost

Thread-Index: AQHcg9vvWiOIiPRRyk6F1N7+S8zk9w==

Date: Mon, 12 Jan 2026 15:55:55 +0000

Message-ID:



Accept-Language: en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

msip_labels:

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: SJ0PR04MB8516:EE_|MW4PR04MB7331:EE_

x-ms-office365-filtering-correlation-id: 6989dbac-1a1c-47b5-bb99-08de51f3124a

x-microsoft-antispam:

BCL:0;ARA:14566002|12121999013|19110799012|39105399006|15080799012|15030799006|8060799015|20031999003|31061999003|461199028|8062599012|29125399003|440099028|3412199025|41105399003|39145399003|40105399003|102099032;

x-microsoft-antispam-message-info:

=?Windows-1252?Q?ht6FYmjf7ZsFNovmW/OfsHZyOEzGHsvof57Qghj/3XgnfCVi9MwrXMOC?=

=?Windows-1252?Q?KBuRCu9iZBErz2H0AwxcehYPeEpq9GmuHdBav+ldKjqsvClvKDfzU0t2?=

=?Windows-1252?Q?HgfY9FOM1BOm6H/jzn+lJqUWEw2h4xSpwsYyeNvRJZaYE3scLbfTMji+?=

=?Windows-1252?Q?nt7SMnRe3WBDHyeBEcRzXw2R31jH1OI6IqzE8bLus7S1XEJ0LhWR3mM4?=

=?Windows-1252?Q?Q53LlGZQbhcgKrCeyz4SDqpt27ZzfcnS4H0cTLVISlYs6TQp1/1duL5Z?=

=?Windows-1252?Q?dFr+UkFe+Eo//BIcdpi/2xD/rd4SRQNxk3HBNEEMREcZMjVXc8h9eENj?=

=?Windows-1252?Q?zdPW4Gc/Dp8JrqI7ExM/gLQ8zGkdywNHfuX30tMojN9vcvkrveshnjyX?=

=?Windows-1252?Q?fw9pd+MnNTVeTGkbUXNplwp+yCZUmmZsyd+O9IKwPB8RSLK7K/rtf0Xc?=

=?Windows-1252?Q?ODBWpA9FjAVGBIFSjS3+5KStP30IylMoNGoNijM1VqbN1TXIdC7TPkyM?=

=?Windows-1252?Q?CPM3N0XuJPXuWGz5kceJBefWC1pw5BkJvpzYqFQnQMX7Z3243kZxXJc6?=

=?Windows-1252?Q?KE1RnnD/Z2beMHw7etNxepXRGZ+t/FbY0sJ0k7OlI/H78ogX+xbjQ1BI?=

=?Windows-1252?Q?2gZATzbILN9bSA7ZrIocnYRZmqce5oo66N881yi5DBccN/N2kKsZoZcX?=

=?Windows-1252?Q?DjpJspHJX1//2b49J0bfRSZsnSQBs7+4FgFvvyAqDuhHQS5VYp6uUfsE?=

=?Windows-1252?Q?3P09/b9/LFitYKwyvhvAel7OUTcQ9hEFocrZpzxWEdZiQz6sNkWuluCB?=

=?Windows-1252?Q?mI07VE4x/QrNvzhR0vrX0TAQ345jfT9jbe4En2/qJjidv7CPjz8ptI5Z?=

=?Windows-1252?Q?6Km+99IPmBewCgOk7IA7Jc1lS83kWK3F96xHVZm2WE6Zs6gz4MqCx2sv?=

=?Windows-1252?Q?KXupJOCnhvyI+5TkPEeSlzSngEQ69lbVvFvg20go7eZg+F/RbWIM/VC0?=

=?Windows-1252?Q?oFsDARckL/4uUTtBTNv9ujPrTwACmMtMtgEbJ+dUiylvGyhFdhoHXUtK?=

=?Windows-1252?Q?n3SLptjKYMtlPwCheIMU3vV2iJILw5MwAxy4esXCDXyio6TZeiBcNQG6?=

=?Windows-1252?Q?Tgv6Qk64WmuKYLZoqp77Dm2e9wzarjO6+zr0UsngfqRVidyR+wlApaLg?=

=?Windows-1252?Q?ZAjwDP6gWpL7fcGL6ii1Or/SaFwjZrcgXNTikqosDLlbD3xcK4u3dzJF?=

=?Windows-1252?Q?zsJnaQE/vRMV4QFggoegRb2sZ/0FXyfADXwKLmsc84k+OAgZ1p9oTtUr?=

=?Windows-1252?Q?jn+Aq/oW9+GG93lizK1UQwC4MA0vJhJyzrpqIzP1iYOeDr5r6g79TkkG?=

=?Windows-1252?Q?hLq1Eldrxt+ngK5HHTzcwWaK60nj+UtQUHnYrPj0Wn2ITV9jITkDjw8Q?=

=?Windows-1252?Q?edafJvu1aa1n1Y6a83zW89psjlHgAluK3/tbpv4IoJdJI0aDQ9AmUYHh?=

=?Windows-1252?Q?O6iDqerZ?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?Windows-1252?Q?0kryzTsIhTZ+97nl3UhIu+Q7cc3SSfTiNpctz3NEq0G8fexT6JMshF6S?=

=?Windows-1252?Q?KplvRgqGay/DdxcxGcQ5+KrYUbdmw1Au2d5ViMPyHvU0+Vp3dt1/F6lo?=

=?Windows-1252?Q?Zu9wHMQOc6PUAmHnU0FhiozNnADJq4YwMCSQQBDuzKlBLpTqWNTM2ebZ?=

=?Windows-1252?Q?gbiXCfd+KeOu4z0tCaUBKFrEceT9caXfNCymZVwB6M7UZWJZSkoaCBgC?=

=?Windows-1252?Q?8uYOjZJJdRlSHXiEHuMCvJetq9jp3bAlGQ22QMg/VRBod0b4c2m8E4df?=

=?Windows-1252?Q?m9aLx4WJTAT/QvZ0pC71I1He05QE834IivAVXpnret/VkxAwuTic2zFu?=

=?Windows-1252?Q?h8T0huKQxk/L4PHZSsWb/pGuP9RFoufAyxbRHhMVmQWRzo6m0P++W9lY?=

=?Windows-1252?Q?dYK7bxqaD5UFW2NgcVHv7mZwXOHi6u5bImvNGXkyeGgXqCFIdRsYgjB6?=

=?Windows-1252?Q?8OEX4fCMdcHWJANYs+Mys0kGEyWCdhTREyNcYhCg/6ay3cOiM8VsnFTc?=

=?Windows-1252?Q?dUUq6TCFbWixqNLCyZAYeQkZz9SkLt8+2tBedC8G07Sl7+O5lnk+02mT?=

=?Windows-1252?Q?APmwbbtex6vDqR1Oa/S0M0F+fp2cv7lY9Xt8Xh4wHHToghSy395kE1Mp?=

=?Windows-1252?Q?u2BF3L/U18YpNORjxLSWuqbuQaCp501v4TlyDyMaLVBcZ9TmEIog0X2e?=

=?Windows-1252?Q?EUXrpVA+iPENzFQUXreWpdVbBEPK8NafXJEs8I4jTOPzKpiybuS+i5KS?=

=?Windows-1252?Q?yggTqVZKVuYSumGghowoa31e4deeAh00BcYztKQnrtD4jx2GceagMmad?=

=?Windows-1252?Q?CTqw+nc28+Ew7/2J59LMMQbteDtVYRbmnzFJHjB4ZSwkw61LHSFX7qDk?=

=?Windows-1252?Q?v7Q7GO4T/2ZT5c9Fcu3g+pVse6lntjf4I9Xdf9N6pcfLgItXVnsCmBCB?=

=?Windows-1252?Q?d0+oz8EZwqXXjpBn5fuVsTUfOKvGZj27l/unapPKNQMP4lP7dXH6bpwU?=

=?Windows-1252?Q?bwyUbjdFi6FZvM5nIeAMyWeVll46soGHvk3BvDkdGxrBzUX+q8YkcItu?=

=?Windows-1252?Q?uyemc7sZibW1N5/JVyC4V19JpQgIIw4f6t18cirdaXrFo+d3VPGING3v?=

=?Windows-1252?Q?bvdg3yWae23OzmXWKI7Dveaz2c8q8xLgv06y2RtRCRusfaqVVfNwvzLw?=

=?Windows-1252?Q?QWclP30juuanb1U2YmHL3daQT4GbQ32H1L5rRC+veAxNV813j2LfMNcX?=

=?Windows-1252?Q?09C69tjm6SKZA5vCSdi4//Uzk51zaIDxg+f0W/qReT+e7cLPXsOD8r4p?=

=?Windows-1252?Q?h4u4daqNw5ND8e4KkMNsYzeV0DW39bCyDaezL7fzdDz+xyZmUCurDU7E?=

=?Windows-1252?Q?BOz+mT/31szVshwIAQFMTD/NX9NrrP6g3OsZ/JTxNEba4wNXLZGZMdO0?=

=?Windows-1252?Q?X1w4GYQjus/yGBK5VQbsXPe3VI/+XlVpq3BUzbkEn9/sp1CR5c21VMkB?=

=?Windows-1252?Q?4S1TAj9m04LPyZl4maPT64rIxp6gPPDpGGHgwMxREnNEtz30jlx9jzos?=

=?Windows-1252?Q?TzT5XO8ZrjRX2o6jclwuAOn3ivssC2ErmfS7pw=3D=3D?=

Content-Type: multipart/alternative;

boundary="_000_SJ0PR04MB85160FAFCACCD15837DD4F05A581ASJ0PR04MB8516namp_"

MIME-Version: 1.0

X-OriginatorOrg: sct-15-20-9412-4-msonline-outlook-33ac7.templateTenant

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: SJ0PR04MB8516.namprd04.prod.outlook.com

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: 6989dbac-1a1c-47b5-bb99-08de51f3124a

X-MS-Exchange-CrossTenant-originalarrivaltime: 12 Jan 2026 15:55:55.8488

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: MW4PR04MB7331



--_000_SJ0PR04MB85160FAFCACCD15837DD4F05A581ASJ0PR04MB8516namp_

Content-Type: text/plain; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable



Hello,



Hope you have a great day!!



We are a professional website development company, based in India with a st=

rength of 150+ employees and a great portfolio to boast about. We are diffe=

rent because we provide the resources you need on a short-term, long-term a=

nd hourly basis.



If you're really looking to build a pixel perfect decent website or want to=

re-develop your previous website, then please share the details with us. W=

e can assure you for a great design.



Our Development Services/Resources include: -



=95 Website Design/Revamp/Upgrade



=95 Custom Web Based Software



=95 Portal/Marketplace



=95 E-commerce development



Just keep an open mind and If any of this sounds something of your interest=

, then feel share your requirements and I would be happy to send you detail=

s about our company, pricing along with an estimated timeline for your proj=

ect/s.



Looking forward to hearing from you.



Warm Regards,

Riya Singh

Business Development manager



CAA Phish from Google

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 12 Jan 2026 06:59:00 -0700

Received: from 179.150.77.34.bc.googleusercontent.com ([34.77.150.179]:60592 helo=freenet-mobilfunk.de)

by doctor.nl2k.ab.ca with esmtp (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vfIQq-00000000OuM-0uIg

for dave@doctor.nl2k.ab.ca;

Mon, 12 Jan 2026 06:58:13 -0700

Received: by freenet-mobilfunk.de (Postfix, from userid 1000)

id 05328369B1C; Mon, 12 Jan 2026 13:57:15 +0000 (UTC)

To: dave@doctor.nl2k.ab.ca

From: "=?UTF-8?B?Q0FBIE1lbWJlciBTZXJ2aWNlcw==?="

Subject: =?UTF-8?B?WW914oCZdmUgQmVlbiBTZWxlY3RlZCBmb3IgYSBDQUEgVGhhbmstWW91IPCfjoE=?=

MIME-Version: 1.0

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: base64

List-Unsubscribe-Post: List-Unsubscribe=One-Click

Message-Id: <20260112135715.05328369B1C@freenet-mobilfunk.de>

Date: Mon, 12 Jan 2026 13:57:15 +0000 (UTC)

X-Spam_score: 14.4

X-Spam_score_int: 144

X-Spam_bar: ++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: CarEmergencyKit HURRY UP: THE NUMBER OF PRIZES TO BE WON

IS LIMITED! CONFIRM NOW! Answer few questions & Win A Brand New



Content analysis details: (14.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[34.77.150.179 listed in dnsbl.ahbl.org]

[34.77.150.179 listed in dnsbl.ahbl.org]

[34.77.150.179 listed in dnsbl.ahbl.org]

[34.77.150.179 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[34.77.150.179 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[34.77.150.179 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[34.77.150.179 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[34.77.150.179 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[34.77.150.179 listed in will-spam-for-food.eu.org]

[34.77.150.179 listed in will-spam-for-food.eu.org]

[34.77.150.179 listed in will-spam-for-food.eu.org]

[34.77.150.179 listed in will-spam-for-food.eu.org]

[34.77.150.179 listed in will-spam-for-food.eu.org]

[34.77.150.179 listed in will-spam-for-food.eu.org]

[34.77.150.179 listed in will-spam-for-food.eu.org]

[34.77.150.179 listed in will-spam-for-food.eu.org]

1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)

0.9 SPF_HELO_SOFTFAIL SPF: HELO does not match SPF record (softfail)

0.0 TVD_RCVD_IP Message was received from an IP address

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam

0.4 RDNS_DYNAMIC Delivered to internal network by host with

dynamic-looking rDNS

0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily

2.3 HOSTED_IMG_MULTI_PUB_01 Multiple hosted images at public site

3.0 GOOG_STO_NOIMG_HTML Apparently using google content hosting to avoid

URIBL

0.4 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS

0.0 DYNAMIC_IMGUR dynamic IP + hosted image

Subject: {SPAM?} =?UTF-8?B?WW914oCZdmUgQmVlbiBTZWxlY3RlZCBmb3IgYSBDQUEgVGhhbmstWW91IPCfjoE=?=



PCFET0NUWVBFIGh0bWw+CjxodG1sIGxhbmc9ImVuIj4KPGhlYWQ+CjxtZXRhIGNoYXJzZXQ9IlVU

Ri04Ij4KPG1ldGEgbmFtZT0idmlld3BvcnQiIGNvbnRlbnQ9IndpZHRoPWRldmljZS13aWR0aCwg

aW5pdGlhbC1zY2FsZT0xLjAiPgo8dGl0bGU+Q2FyRW1lcmdlbmN5S2l0PC90aXRsZT4KPC9oZWFk

PgoKPGJvZHkgc3R5bGU9Im1hcmdpbjowO3BhZGRpbmc6MDtiYWNrZ3JvdW5kLWNvbG9yOiNmZmZm

ZmY7Ij4KPHRhYmxlIHdpZHRoPSIxMDAlIiBjZWxscGFkZGluZz0iMCIgY2VsbHNwYWNpbmc9IjAi

IGJvcmRlcj0iMCIgYWxpZ249ImNlbnRlciI+CiAgPHRyPgogICAgPHRkIGFsaWduPSJjZW50ZXIi

PgoKICAgICAgPCEtLSBNQUlOIENPTlRBSU5FUiAtLT4KICAgICAgPHRhYmxlIHdpZHRoPSI2MDAi

IGNlbGxwYWRkaW5nPSIwIiBjZWxsc3BhY2luZz0iMCIgYm9yZGVyPSIwIiBhbGlnbj0iY2VudGVy

IiBzdHlsZT0ibWF4LXdpZHRoOjYwMHB4O2JhY2tncm91bmQtY29sb3I6I2ZmZmZmZjsiPgoKICAg

ICAgICA8IS0tIExPR08gLS0+CiAgICAgICAgPHRyPgogICAgICAgICAgPHRkIGFsaWduPSJjZW50

ZXIiIHN0eWxlPSJwYWRkaW5nOjIwcHggMTBweDsiPgogICAgICAgICAgICA8aW1nIHNyYz0iaHR0

cHM6Ly9pLmltZ3VyLmNvbS9ydGsxRGhpLnBuZyIgd2lkdGg9IjYwMCIgYWx0PSJDQUEiIHN0eWxl

PSJkaXNwbGF5OmJsb2NrO2JvcmRlcjowOyI+CiAgICAgICAgICA8L3RkPgogICAgICAgIDwvdHI+

CgogICAgICAgIDwhLS0gQUxFUlQgQkFSIC0tPgogICAgICAgIDx0cj4KICAgICAgICAgIDx0ZCBh

bGlnbj0iY2VudGVyIiBzdHlsZT0iYmFja2dyb3VuZC1jb2xvcjojZTYxYzIzO3BhZGRpbmc6MTBw

eDsiPgogICAgICAgICAgICA8c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6QXJpYWwsSGVsdmV0aWNh

LHNhbnMtc2VyaWY7Zm9udC1zaXplOjEzcHg7Y29sb3I6I2ZmZmZmZjtmb250LXdlaWdodDpib2xk

OyI+CiAgICAgICAgICAgICAgSFVSUlkgVVA6IFRIRSBOVU1CRVIgT0YgUFJJWkVTIFRPIEJFIFdP

TiBJUyBMSU1JVEVEISBDT05GSVJNIE5PVyEKICAgICAgICAgICAgPC9zcGFuPgogICAgICAgICAg

PC90ZD4KICAgICAgICA8L3RyPgoKICAgICAgICA8IS0tIEhFUk8gU0VDVElPTiAtLT4KICAgICAg

ICA8dHI+CiAgICAgICAgICA8dGQgYWxpZ249ImNlbnRlciIgc3R5bGU9InBhZGRpbmc6MjVweCAy

MHB4O2JhY2tncm91bmQtY29sb3I6IzAwMDAwMDsiPgogICAgICAgICAgICA8c3BhbiBzdHlsZT0i

Zm9udC1mYW1pbHk6QXJpYWwsSGVsdmV0aWNhLHNhbnMtc2VyaWY7Zm9udC1zaXplOjE2cHg7Y29s

b3I6I2ZmZmZmZjsiPgogICAgICAgICAgICAgIEFuc3dlciBmZXcgcXVlc3Rpb25zICZhbXA7IFdp

biBBIEJyYW5kIE5ldwogICAgICAgICAgICA8L3NwYW4+CiAgICAgICAgICAgIDxicj48YnI+CiAg

ICAgICAgICAgIDxzcGFuIHN0eWxlPSJmb250LWZhbWlseTpBcmlhbCxIZWx2ZXRpY2Esc2Fucy1z

ZXJpZjtmb250LXNpemU6MzZweDtjb2xvcjojZmZmZmZmO2ZvbnQtd2VpZ2h0OmJvbGQ7Ij4KICAg

ICAgICAgICAgICBDQVIgRU1FUkdFTkNZPGJyPktJVCEKICAgICAgICAgICAgPC9zcGFuPgogICAg

ICAgICAgICA8YnI+PGJyPgogICAgICAgICAgICA8c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6QXJp

YWwsSGVsdmV0aWNhLHNhbnMtc2VyaWY7Zm9udC1zaXplOjE0cHg7Y29sb3I6I2ZmZmZmZjtsaW5l

LWhlaWdodDoyMHB4OyI+CiAgICAgICAgICAgICAgQ3VzdG9tZXIgZmVlZGJhY2sgaGFzIGFsd2F5

cyBoZWxwZWQgdXMgaW1wcm92ZSBTdGF0ZSBGYXJtIGV4cGVyaWVuY2UuCiAgICAgICAgICAgICAg

Q2xpY2sgdGhyb3VnaCB0byB0YWtlIGEgcXVpY2sgNCBtaW51dGUgc3VydmV5IGFuZCByZWNlaXZl

IGEgZmFudGFzdGljIHByaXplLgogICAgICAgICAgICAgIFlvdSBjYW4gdGVsbCB1cyBob3cgeW91

IHJlYWxseSBmZWVsLgogICAgICAgICAgICA8L3NwYW4+CiAgICAgICAgICA8L3RkPgogICAgICAg

IDwvdHI+CgogICAgICAgIDwhLS0gQ1RBIEJVVFRPTiAtLT4KICAgICAgICA8dHI+CiAgICAgICAg

ICA8dGQgYWxpZ249ImNlbnRlciIgc3R5bGU9InBhZGRpbmc6MjBweDtiYWNrZ3JvdW5kLWNvbG9y

OiMwMDAwMDA7Ij4KICAgICAgICAgICAgPHRhYmxlIGNlbGxwYWRkaW5nPSIwIiBjZWxsc3BhY2lu

Zz0iMCIgYm9yZGVyPSIwIj4KICAgICAgICAgICAgICA8dHI+CiAgICAgICAgICAgICAgICA8dGQg

YWxpZ249ImNlbnRlciIgc3R5bGU9ImJhY2tncm91bmQtY29sb3I6I2U2MWMyMztib3JkZXItcmFk

aXVzOjMwcHg7Ij4KICAgICAgICAgICAgICAgICAgPGEgaHJlZj0iaHR0cHM6Ly9zdG9yYWdlLmdv

b2dsZWFwaXMuY29tL2VkMmFjeC1nYmZ1NnYyLWpuZmd2Y2UtbG5neXJ6YS1qbmRmcnN4L2NhYWNo

a3RnbGlzYm1pdGxzb2tvbHo3ZGk1NGRzY3hrbTdnYmYuaHRtbCIgc3R5bGU9ImRpc3BsYXk6aW5s

aW5lLWJsb2NrO3BhZGRpbmc6MTRweCAzMnB4O2ZvbnQtZmFtaWx5OkFyaWFsLEhlbHZldGljYSxz

YW5zLXNlcmlmO2ZvbnQtc2l6ZToxNnB4O2NvbG9yOiNmZmZmZmY7dGV4dC1kZWNvcmF0aW9uOm5v

bmU7Zm9udC13ZWlnaHQ6Ym9sZDsiPgogICAgICAgICAgICAgICAgICAgIEdFVCBTVEFSVEVEIE5P

VwogICAgICAgICAgICAgICAgICA8L2E+CiAgICAgICAgICAgICAgICA8L3RkPgogICAgICAgICAg

ICAgIDwvdHI+CiAgICAgICAgICAgIDwvdGFibGU+CiAgICAgICAgICA8L3RkPgogICAgICAgIDwv

dHI+CgogICAgICAgIDwhLS0gUFJPRFVDVCBJTUFHRSAtLT4KICAgICAgICA8dHI+CiAgICAgICAg

ICA8dGQgYWxpZ249ImNlbnRlciIgc3R5bGU9InBhZGRpbmc6MzBweCAxMHB4OyI+CiAgICAgICAg

ICAgIDxpbWcgc3JjPSJodHRwczovL2kuaW1ndXIuY29tL0l3OGpBUkUucG5nIiB3aWR0aD0iNzAw

IiBhbHQ9IkVtZXJnZW5jeSBLaXQiIHN0eWxlPSJkaXNwbGF5OmJsb2NrO2JvcmRlcjowO21heC13

aWR0aDoxMDAlOyI+CiAgICAgICAgICA8L3RkPgogICAgICAgIDwvdHI+CgogICAgICAgIDwhLS0g

TE9ZQUxUWSBTRUNUSU9OIC0tPgogICAgICAgIDx0cj4KICAgICAgICAgIDx0ZCBhbGlnbj0iY2Vu

dGVyIiBzdHlsZT0icGFkZGluZzoxMHB4IDMwcHg7Ij4KICAgICAgICAgICAgPHNwYW4gc3R5bGU9

ImZvbnQtZmFtaWx5OkFyaWFsLEhlbHZldGljYSxzYW5zLXNlcmlmO2ZvbnQtc2l6ZToyNHB4O2Nv

bG9yOiNlNjFjMjM7Zm9udC13ZWlnaHQ6Ym9sZDsiPgogICAgICAgICAgICAgIExveWFsdHkgcGF5

cyBvZmYhCiAgICAgICAgICAgIDwvc3Bhbj4KICAgICAgICAgICAgPGJyPjxicj4KICAgICAgICAg

ICAgPHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OkFyaWFsLEhlbHZldGljYSxzYW5zLXNlcmlmO2Zv

bnQtc2l6ZToxNHB4O2NvbG9yOiMwMDAwMDA7bGluZS1oZWlnaHQ6MjBweDsiPgogICAgICAgICAg

ICAgIFlvdSBoYXZlIGJlZW4gY2hvc2VuIHRvIHBhcnRpY2lwYXRlIGluIG91ciBMb3lhbHR5IFBy

b2dyYW0gZm9yIEZSRUUhCiAgICAgICAgICAgICAgSXQgd2lsbCB0YWtlIHlvdSBvbmx5IGEgbWlu

dXRlIHRvIHJlY2VpdmUgdGhpcyBmYW50YXN0aWMgcHJpemUuCiAgICAgICAgICAgICAgPGJyPjxi

cj4KICAgICAgICAgICAgICBXaGVyZSBZb3VyIG9waW5pb24gY291bnRzISBTdGF0ZSBGYXJtLCBU

aGlzIGlzIHRoZSBQbGFjZS4KICAgICAgICAgICAgPC9zcGFuPgogICAgICAgICAgPC90ZD4KICAg

ICAgICA8L3RyPgoKICAgICAgICA8IS0tIEZJTkFMIENUQSAtLT4KICAgICAgICA8dHI+CiAgICAg

ICAgICA8dGQgYWxpZ249ImNlbnRlciIgc3R5bGU9InBhZGRpbmc6MjVweDsiPgogICAgICAgICAg

ICA8dGFibGUgY2VsbHBhZGRpbmc9IjAiIGNlbGxzcGFjaW5nPSIwIiBib3JkZXI9IjAiPgogICAg

ICAgICAgICAgIDx0cj4KICAgICAgICAgICAgICAgIDx0ZCBhbGlnbj0iY2VudGVyIiBzdHlsZT0i

YmFja2dyb3VuZC1jb2xvcjojZTYxYzIzO2JvcmRlci1yYWRpdXM6MzBweDsiPgogICAgICAgICAg

ICAgICAgICA8YSBocmVmPSJodHRwczovL3N0b3JhZ2UuZ29vZ2xlYXBpcy5jb20vZWQyYWN4LWdi

ZnU2djItam5mZ3ZjZS1sbmd5cnphLWpuZGZyc3gvY2FhY2hrdGdsaXNibWl0bHNva29sejdkaTU0

ZHNjeGttN2diZi5odG1sIiBzdHlsZT0iZGlzcGxheTppbmxpbmUtYmxvY2s7cGFkZGluZzoxNHB4

IDMycHg7Zm9udC1mYW1pbHk6QXJpYWwsSGVsdmV0aWNhLHNhbnMtc2VyaWY7Zm9udC1zaXplOjE2

cHg7Y29sb3I6I2ZmZmZmZjt0ZXh0LWRlY29yYXRpb246bm9uZTtmb250LXdlaWdodDpib2xkOyI+

CiAgICAgICAgICAgICAgICAgICAgVW5sb2NrIFlvdXIgUmV3YXJkIE5vdyEKICAgICAgICAgICAg

ICAgICAgPC9hPgogICAgICAgICAgICAgICAgPC90ZD4KICAgICAgICAgICAgICA8L3RyPgogICAg

ICAgICAgICA8L3RhYmxlPgogICAgICAgICAgPC90ZD4KICAgICAgICA8L3RyPgoKICAgICAgPC90

YWJsZT4KICAgICAgPCEtLSBFTkQgQ09OVEFJTkVSIC0tPgoKICAgIDwvdGQ+CiAgPC90cj4KPC90

YWJsZT4KPC9ib2R5Pgo8L2h0bWw+



CAA phish from Google Part 2

Posted by Dave Yadallee on
PCFET0NUWVBFIGh0bWw+CjxodG1sIGxhbmc9ImVuIj4KPGhlYWQ+CjxtZXRhIGNoYXJzZXQ9IlVU

Ri04Ij4KPG1ldGEgbmFtZT0idmlld3BvcnQiIGNvbnRlbnQ9IndpZHRoPWRldmljZS13aWR0aCwg

aW5pdGlhbC1zY2FsZT0xLjAiPgo8dGl0bGU+Q0FBV2ludGVyU2FmZXR5S2l0PC90aXRsZT4KCjxz

dHlsZSB0eXBlPSJ0ZXh0L2NzcyI+CiAgYm9keSB7CiAgICBtYXJnaW46IDA7CiAgICBwYWRkaW5n

OiAwOwogICAgYmFja2dyb3VuZC1jb2xvcjogI2YyZjJmMjsKICAgIGZvbnQtZmFtaWx5OiBBcmlh

bCwgSGVsdmV0aWNhLCBzYW5zLXNlcmlmOwogIH0KICB0YWJsZSB7CiAgICBib3JkZXItY29sbGFw

c2U6IGNvbGxhcHNlOwogIH0KICBpbWcgewogICAgZGlzcGxheTogYmxvY2s7CiAgICBib3JkZXI6

IDA7CiAgICBvdXRsaW5lOiBub25lOwogICAgdGV4dC1kZWNvcmF0aW9uOiBub25lOwogIH0KICAu

Y29udGFpbmVyIHsKICAgIG1heC13aWR0aDogNjAwcHg7CiAgICB3aWR0aDogMTAwJTsKICAgIGJh

Y2tncm91bmQtY29sb3I6ICNmZmZmZmY7CiAgfQogIC5ibHVlLWJhbm5lciB7CiAgICBiYWNrZ3Jv

dW5kLWNvbG9yOiAjMDA3MmJjOwogICAgY29sb3I6ICNmZmZmZmY7CiAgICBmb250LXNpemU6IDEy

cHg7CiAgICB0ZXh0LWFsaWduOiBjZW50ZXI7CiAgICBwYWRkaW5nOiAxMHB4OwogICAgZm9udC13

ZWlnaHQ6IGJvbGQ7CiAgfQogIC5oZXJvIHsKICAgIGJhY2tncm91bmQ6IGxpbmVhci1ncmFkaWVu

dCgjMGI0ZjhhLCAjMDUyYzRhKTsKICAgIGNvbG9yOiAjZmZmZmZmOwogICAgdGV4dC1hbGlnbjog

Y2VudGVyOwogICAgcGFkZGluZzogMzBweCAyMHB4OwogIH0KICAuaGVybyBoMSB7CiAgICBmb250

LXNpemU6IDI4cHg7CiAgICBtYXJnaW46IDE1cHggMDsKICAgIGxpbmUtaGVpZ2h0OiAxLjI7CiAg

fQogIC5oZXJvIHAgewogICAgZm9udC1zaXplOiAxNHB4OwogICAgbGluZS1oZWlnaHQ6IDEuNTsK

ICAgIG1hcmdpbjogMTBweCAwOwogIH0KICAuYnRuIHsKICAgIGJhY2tncm91bmQtY29sb3I6ICNm

ZmZmZmY7CiAgICBjb2xvcjogIzAwNzJiYzsKICAgIHRleHQtZGVjb3JhdGlvbjogbm9uZTsKICAg

IHBhZGRpbmc6IDE0cHggMjhweDsKICAgIGJvcmRlci1yYWRpdXM6IDI1cHg7CiAgICBkaXNwbGF5

OiBpbmxpbmUtYmxvY2s7CiAgICBmb250LXdlaWdodDogYm9sZDsKICAgIGZvbnQtc2l6ZTogMTRw

eDsKICAgIG1hcmdpbi10b3A6IDIwcHg7CiAgfQogIC5jb250ZW50IHsKICAgIHBhZGRpbmc6IDI1

cHg7CiAgfQogIC5jb250ZW50IGgyIHsKICAgIGNvbG9yOiAjMDA3MmJjOwogICAgZm9udC1zaXpl

OiAyMHB4OwogICAgbWFyZ2luLWJvdHRvbTogMTBweDsKICB9CiAgLmNvbnRlbnQgcCB7CiAgICBm

b250LXNpemU6IDE0cHg7CiAgICBjb2xvcjogIzMzMzMzMzsKICAgIGxpbmUtaGVpZ2h0OiAxLjU7

CiAgfQogIC5idG4tYmx1ZSB7CiAgICBiYWNrZ3JvdW5kLWNvbG9yOiAjMDA3MmJjOwogICAgY29s

b3I6ICNmZmZmZmY7CiAgICB0ZXh0LWRlY29yYXRpb246IG5vbmU7CiAgICBwYWRkaW5nOiAxMnB4

IDIycHg7CiAgICBib3JkZXItcmFkaXVzOiAyMHB4OwogICAgZGlzcGxheTogaW5saW5lLWJsb2Nr

OwogICAgZm9udC1zaXplOiAxNHB4OwogICAgZm9udC13ZWlnaHQ6IGJvbGQ7CiAgICBtYXJnaW4t

dG9wOiAxNXB4OwogIH0KPC9zdHlsZT4KPC9oZWFkPgoKPGJvZHk+Cjx0YWJsZSB3aWR0aD0iMTAw

JSIgY2VsbHBhZGRpbmc9IjAiIGNlbGxzcGFjaW5nPSIwIiByb2xlPSJwcmVzZW50YXRpb24iPgog

IDx0cj4KICAgIDx0ZCBhbGlnbj0iY2VudGVyIj4KCiAgICAgIDwhLS0gQ29udGFpbmVyIC0tPgog

ICAgICA8dGFibGUgY2xhc3M9ImNvbnRhaW5lciIgd2lkdGg9IjYwMCIgY2VsbHBhZGRpbmc9IjAi

IGNlbGxzcGFjaW5nPSIwIiByb2xlPSJwcmVzZW50YXRpb24iPgoKICAgICAgICA8IS0tIExvZ28g

LS0+CiAgICAgICAgPHRyPgogICAgICAgICAgPHRkIGFsaWduPSJjZW50ZXIiIHN0eWxlPSJwYWRk

aW5nOjIwcHg7Ij4KICAgICAgICAgICAgPGltZyBzcmM9Imh0dHBzOi8vaS5pbWd1ci5jb20vM3ZM

dzdvVC5wbmciIGFsdD0iQ0FBIExvZ28iIHdpZHRoPSI1MDAiPgogICAgICAgICAgPC90ZD4KICAg

ICAgICA8L3RyPgoKICAgICAgICA8IS0tIFRvcCBiYW5uZXIgLS0+CiAgICAgICAgPHRyPgogICAg

ICAgICAgPHRkIGNsYXNzPSJibHVlLWJhbm5lciI+CiAgICAgICAgICAgIEhVUlJZIFVQLiBUSEUg

TlVNQkVSIE9GIFBSSVpFUyBUTyBCRSBXT04gSVMgTElNSVRFRCEgQ09ORklSTSBOT1chCiAgICAg

ICAgICA8L3RkPgogICAgICAgIDwvdHI+CgogICAgICAgIDwhLS0gSGVybyBzZWN0aW9uIC0tPgog

ICAgICAgIDx0cj4KICAgICAgICAgIDx0ZCBjbGFzcz0iaGVybyI+CiAgICAgICAgICAgIDxwPgog

ICAgICAgICAgICAgIEN1c3RvbWVyIGZlZWRiYWNrIGhhcyBhbHdheXMgYmVlbiBrZXkgdG8gaW1w

cm92aW5nIHlvdXIgc2hvcHBpbmcgZXhwZXJpZW5jZSB3aXRoIHVzLgogICAgICAgICAgICAgIFRh

a2UgYSBxdWljayBzdXJ2ZXkgZm9yIGEgY2hhbmNlIHRvIHdpbiBhIGZhbnRhc3RpYyBwcml6ZSwg

YW5kIGxldCB1cyBrbm93IGhvdyB5b3UgcmVhbGx5IGZlZWwuCiAgICAgICAgICAgIDwvcD4KCiAg

ICAgICAgICAgIDxoMT4KICAgICAgICAgICAgICBDQUEgV0lOVEVSIFNBRkVUWTxicj5LSVQhCiAg

ICAgICAgICAgIDwvaDE+CgogICAgICAgICAgICA8YSBocmVmPSJodHRwczovL3N0b3JhZ2UuZ29v

Z2xlYXBpcy5jb20vZmZxc3l1Y2dmcXN1Y2doanFzZ2NqaHFzZ2NqaHFzZ2NqaHFjZnVxY2Z1cXNn

Y2Z1eXFzZmMvY2FhY2hrdGdsaXNibWl0bHNva29sejdkaTU0ZHNjeGttN2diZi5odG1sIiBjbGFz

cz0iYnRuIj5HRVQgU1RBUlRFRCBOT1c8L2E+CiAgICAgICAgICA8L3RkPgogICAgICAgIDwvdHI+

CgogICAgICAgIDwhLS0gQ29udGVudCBzZWN0aW9uIC0tPgogICAgICAgIDx0cj4KICAgICAgICAg

IDx0ZCBjbGFzcz0iY29udGVudCI+CiAgICAgICAgICAgIDx0YWJsZSB3aWR0aD0iMTAwJSIgY2Vs

bHBhZGRpbmc9IjAiIGNlbGxzcGFjaW5nPSIwIiByb2xlPSJwcmVzZW50YXRpb24iPgogICAgICAg

ICAgICAgIDx0cj4KICAgICAgICAgICAgICAgIDx0ZCB3aWR0aD0iNTAlIiBhbGlnbj0iY2VudGVy

IiB2YWxpZ249InRvcCI+CiAgICAgICAgICAgICAgICAgIDxpbWcgc3JjPSJodHRwczovL2kuaW1n

dXIuY29tL2hVNjZabGcucG5nIiBhbHQ9IldpbnRlciBTYWZldHkgS2l0IiB3aWR0aD0iMjQwIj4K

ICAgICAgICAgICAgICAgIDwvdGQ+CiAgICAgICAgICAgICAgICA8dGQgd2lkdGg9IjUwJSIgdmFs

aWduPSJ0b3AiIHN0eWxlPSJwYWRkaW5nLWxlZnQ6MTVweDsiPgogICAgICAgICAgICAgICAgICA8

aDI+TG95YWx0eSBwYXlzIG9mZiE8L2gyPgogICAgICAgICAgICAgICAgICA8cD4KICAgICAgICAg

ICAgICAgICAgICBZb3UgaGF2ZSBiZWVuIGNob3NlbiB0byBwYXJ0aWNpcGF0ZSBpbiBvdXIgTG95

YWx0eSBQcm9ncmFtIGZvciBGUkVFIQogICAgICAgICAgICAgICAgICAgIEl0IHdpbGwgdGFrZSB5

b3Ugb25seSBhIG1pbnV0ZSB0byByZWNlaXZlIHRoaXMgZmFudGFzdGljIHByaXplLgogICAgICAg

ICAgICAgICAgICA8L3A+CiAgICAgICAgICAgICAgICAgIDxhIGhyZWY9Imh0dHBzOi8vc3RvcmFn

ZS5nb29nbGVhcGlzLmNvbS9mZnFzeXVjZ2Zxc3VjZ2hqcXNnY2pocXNnY2pocXNnY2pocWNmdXFj

ZnVxc2djZnV5cXNmYy9jYWFjaGt0Z2xpc2JtaXRsc29rb2x6N2RpNTRkc2N4a203Z2JmLmh0bWwi

IGNsYXNzPSJidG4tYmx1ZSI+Q2xpY2sgdG8gZ2V0IHN0YXJ0ZWQhPC9hPgogICAgICAgICAgICAg

ICAgPC90ZD4KICAgICAgICAgICAgICA8L3RyPgogICAgICAgICAgICA8L3RhYmxlPgogICAgICAg

ICAgPC90ZD4KICAgICAgICA8L3RyPgoKICAgICAgICA8IS0tIEZvb3RlciBzcGFjZXIgLS0+CiAg

ICAgICAgPHRyPgogICAgICAgICAgPHRkIHN0eWxlPSJoZWlnaHQ6MjBweDsiPjwvdGQ+CiAgICAg

ICAgPC90cj4KCiAgICAgIDwvdGFibGU+CiAgICAgIDwhLS0gRW5kIGNvbnRhaW5lciAtLT4KCiAg

ICA8L3RkPgogIDwvdHI+CjwvdGFibGU+CjwvYm9keT4KPC9odG1sPg==



CAA phish from Google Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 12 Jan 2026 06:56:00 -0700

Received: from 221.199.189.35.bc.googleusercontent.com ([35.189.199.221]:59158 helo=freenet-mobilfunk.de)

by doctor.nl2k.ab.ca with esmtp (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vfIOO-00000000Oki-1MHy

for dave@doctor.nl2k.ab.ca;

Mon, 12 Jan 2026 06:55:45 -0700

Received: by freenet-mobilfunk.de (Postfix, from userid 1000)

id BB1F1369B25; Mon, 12 Jan 2026 13:54:42 +0000 (UTC)

To: dave@doctor.nl2k.ab.ca

From: "=?UTF-8?B?Q0FBIFJld2FyZHMgVGVhbQ==?="

Subject: =?UTF-8?B?8J+OgSBZb3VyIENBQSBXaW50ZXIgU2FmZXR5IEtpdCBJcyBXYWl0aW5n?=

MIME-Version: 1.0

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: base64

List-Unsubscribe-Post: List-Unsubscribe=One-Click

Message-Id: <20260112135442.BB1F1369B25@freenet-mobilfunk.de>

Date: Mon, 12 Jan 2026 13:54:42 +0000 (UTC)

X-Spam_score: 11.2

X-Spam_score_int: 112

X-Spam_bar: +++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: CAAWinterSafetyKit HURRY UP. THE NUMBER OF PRIZES TO BE WON

IS LIMITED! CONFIRM NOW!



Content analysis details: (11.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[35.189.199.221 listed in dnsbl.ahbl.org]

[35.189.199.221 listed in dnsbl.ahbl.org]

[35.189.199.221 listed in dnsbl.ahbl.org]

[35.189.199.221 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[35.189.199.221 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[35.189.199.221 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[35.189.199.221 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[35.189.199.221 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[35.189.199.221 listed in will-spam-for-food.eu.org]

[35.189.199.221 listed in will-spam-for-food.eu.org]

[35.189.199.221 listed in will-spam-for-food.eu.org]

[35.189.199.221 listed in will-spam-for-food.eu.org]

[35.189.199.221 listed in will-spam-for-food.eu.org]

[35.189.199.221 listed in will-spam-for-food.eu.org]

[35.189.199.221 listed in will-spam-for-food.eu.org]

[35.189.199.221 listed in will-spam-for-food.eu.org]

0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[35.189.199.221 listed in sa-accredit.habeas.com]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The

query to Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[35.189.199.221 listed in sa-trusted.bondedsender.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)

0.9 SPF_HELO_SOFTFAIL SPF: HELO does not match SPF record (softfail)

0.0 TVD_RCVD_IP Message was received from an IP address

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[35.189.199.221 listed in bl.score.senderscore.com]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[35.189.199.221 listed in bl.score.senderscore.com]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam

0.4 RDNS_DYNAMIC Delivered to internal network by host with

dynamic-looking rDNS

0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily

2.3 HOSTED_IMG_MULTI_PUB_01 Multiple hosted images at public site

0.4 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS

3.0 GOOG_STO_NOIMG_HTML Apparently using google content hosting to avoid

URIBL

0.0 DYNAMIC_IMGUR dynamic IP + hosted image

Subject: {SPAM?} =?UTF-8?B?8J+OgSBZb3VyIENBQSBXaW50ZXIgU2FmZXR5IEtpdCBJcyBXYWl0aW5n?=