Received: from mx.example.org (mx.example.org [192.0.2.11])
	by mail.example.org (Postfix) with ESMTP id CCC33
	for <you@example.org>; Tue, 8 Sep 2026 11:00:02 +0200 (CEST)
Received: from evil.example.invalid (evil.example.invalid [203.0.113.99])
	by mx.example.org (Postfix) with ESMTP id DDD44
	for <you@example.org>; Tue, 8 Sep 2026 11:00:01 +0200 (CEST)
Received: from innocent.example.invalid (innocent.example.invalid [198.51.100.7])
	by evil.example.invalid (Postfix) with ESMTP id EEE55; Tue, 8 Sep 2026 10:59:00 +0200 (CEST)
Received: from also-forged.example.invalid (also-forged.example.invalid [198.51.100.8])
	by innocent.example.invalid (Postfix) with ESMTP id FFF66; Tue, 8 Sep 2026 10:58:00 +0200 (CEST)
Return-Path: <bounce@evil.example.invalid>
From: "Support" <help@evil.example.invalid>
To: <you@example.org>
Subject: Action required
Message-ID: <bbb222@evil.example.invalid>
Date: Tue, 8 Sep 2026 10:58:00 +0200
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8

Visit http://evil.example.invalid/go?u=dGVzdEBleGFtcGxlLm9yZw to continue.