Delivered-To: alice.employee@example.com Received: by 2002:a05:620a:10c8:0:0:0:0 with SMTP id z8csp2406822qkk; Fri, 13 Aug 2025 10:02:59 -0700 (PDT) X-Google-Smtp-Source: ABCs/1234567890abcdefghijklmno= X-Received: by 2002:a5d:43c4:0:b0:220:b922:a5a9 with SMTP id x4-20020a5d43c4000000b00220b922a5a9mr9988748wrp.89.1660399379017; Fri, 13 Aug 2025 10:02:59 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1660399379; cv=none; d=google.com; s=arc-20160816; b=somehashvalue ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=to:subject:message-id:from:date:mime-version:dkim-signature; bh=anotherhashvalue; b=yetanotherhashvalue ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@ceo-offices.com header.s=google header.b=AbCdEfG; spf=fail (google.com: domain of support@v-pshosting.net does not designate 198.54.117.211 as permitted sender) smtp.mailfrom=support@v-pshosting.net Return-Path: Received: from mail.v-pshosting.net (mail.v-pshosting.net. [198.54.117.211]) by mx.google.com with ESMTP id a6-20020a170902c30600b001a1d50c1157si910115plg.437.2025.08.13.10.02.58 for ; Fri, 13 Aug 2025 10:02:58 -0700 (PDT) Received-SPF: fail (google.com: domain of support@v-pshosting.net does not designate 198.54.117.211 as permitted sender) client-ip=198.54.117.211; Authentication-Results: mx.google.com; dkim=pass header.i=@ceo-offices.com header.s=google header.b=AbCdEfG; spf=fail (google.com: domain of support@v-pshosting.net does not designate 198.54.117.211 as permitted sender) smtp.mailfrom=support@v-pshosting.net DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ceo-offices.com; s=google; h=mime-version:date:from:message-id:subject:to; bh=anotherhashvalue; b=somehashvalue MIME-Version: 1.0 Date: Fri, 13 Aug 2025 17:02:55 +0000 From: "CEO John Doe" Message-ID: <123456789.abscd@ceo-offices.com> Subject: Urgent: Confidential Payment Request To: alice.employee@example.com Content-Type: text/html; charset=UTF-8

Alice, I need you to process an urgent wire transfer for $15,000 to vendor account 87654321. This is for the confidential Project X. Please process immediately and confirm once sent. Discretion is key.

Regards,
John Doe
CEO