Credential phish
Posted by Dave Yadallee on
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Thu, 12 Nov 2026 14:41:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))
(envelope-from)
id 1xRban-00000000FQL-3JHZ
for dave@doctor.nl2k.ab.ca;
Thu, 12 Nov 2026 14:40:21 -0600
Resent-From: The Doctor
Resent-Date: Thu, 12 Nov 2026 14:40:21 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from o235.p37.mailjet.com ([185.250.236.235]:37701)
by doctor.nl2k.ab.ca with utf8esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
(Exim 4.100.1 (FreeBSD))
(envelope-from)
id 1xRaLH-00000000LKM-1pQa
for doctor@doctor.nl2k.ab.ca;
Thu, 12 Nov 2026 13:20:18 -0600
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; q=dns/txt;
d=eosrv.net; i=mail@eosrv.net; s=mailjet; t=1794511148; x=1794518348;
h=Message-Id: MIME-Version: From: Reply-To: To: Subject: Date:
List-Unsubscribe-Post: List-Unsubscribe: Feedback-Id:
X-CSA-Complaints: X-MJ-Mid: X-REPORT-ABUSE-TO:
Content-Type: Content-Transfer-Encoding: To: From: Sender:
Subject: Date;
bh=P4R0/TKhaIPxe9d6S8i3x4SLqbwmCeSKw3+lKNaAu3k=;
b=J4dwcx661D0RWq8Kg7ngSST2HdV8dDTKLFaeJKS2mpBgRR2wvMVIVzslx
QuaMGPoOiZzAjVFDVNjiSI7Z1FxmKGXB62+M9ps9fQcxgORBTF4P3nAu5eAR
AJcXdZqEexUFA1j7/Hetkql28f448Ll41QhALWYqJh3RLeb6UWSLwk=
Message-Id:
MIME-Version: 1.0
From: XHelp
Reply-To: noreply@digitaleo.com
To: doctor@doctor.nl2k.ab.ca
Subject: We noticed a login to your account from a new device. Was this you?
Date: Thu, 12 Nov 2026 19:19:07 +0000
List-Unsubscribe-Post: List-Unsubscribe=One-Click
List-Unsubscribe:
,
Feedback-Id: 92027011:2731100.283537:MJ
X-CSA-Complaints: csa-complaints@eco.de
X-MJ-Mid:
EAAACciA9SUAAAAAAAAAAuoFzQwAAYCvB3QAAAAAACmsXABq9hEro8Buh5eBTG6v_Eh76ZgxxAAEU5E
X-REPORT-ABUSE-TO: Message sent by Mailjet please report to
abuse@mailjet.com with a copy of the message
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: quoted-printable
X-Spam_score: 52.9
X-Spam_score_int: 529
X-Spam_bar: ++++++++++++++++++++++++++++++++++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: We noticed a login to your account from a new device. Was
this you? New login
Content analysis details: (52.9 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[185.250.236.235 listed in will-spam-for-food.eu.org]
[185.250.236.235 listed in will-spam-for-food.eu.org]
[185.250.236.235 listed in will-spam-for-food.eu.org]
[185.250.236.235 listed in will-spam-for-food.eu.org]
[185.250.236.235 listed in will-spam-for-food.eu.org]
[185.250.236.235 listed in will-spam-for-food.eu.org]
[185.250.236.235 listed in will-spam-for-food.eu.org]
[185.250.236.235 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[185.250.236.235 listed in dnsbl.ahbl.org]
[185.250.236.235 listed in dnsbl.ahbl.org]
[185.250.236.235 listed in dnsbl.ahbl.org]
[185.250.236.235 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[185.250.236.235 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[185.250.236.235 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[185.250.236.235 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[185.250.236.235 listed in dnsbl.ahbl.org]
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[185.250.236.235 listed in list.dnswl.org]
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[185.250.236.235 listed in wl.mailspike.net]
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[185.250.236.235 listed in bl.score.senderscore.com]
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
-0.0 SPF_PASS SPF: sender matches SPF record
15 GR_DOMAIN_XECODE1 Spammer tool signature (xecode)
0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in
headers
15 GR_DOMAIN_MAILJE3 Message-ID contains spammer id (mailje)
15 GR_DOMAIN_MAILJE1 Received contains spammer id (mailje)
1.5 MR_STRANGE_QUESTION URI: No description available.
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
1.0 IMPRO_URI_2 No description available.
1.0 IMPRO_URI_3 No description available.
2.0 VOWEL_URI_6 URI hostname with 6 consecutive vowels
Subject: {SPAM?} We noticed a login to your account from a new device. Was this you?
w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
ft-com:vml" xmlns:o=3D"urn:schemas-microsoft-com:office:office">
http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dutf-8">
l-scale=3D1.0"><=
title>
media=3D"screen,print" rel=3D"stylesheet" type=3D"text/css">
"text/css"> table, td {
mso-table-lspace: 0pt;
mso-table-rspace: 0pt;
mso-table-tspace: 0pt;
mso-table-bspace: 0pt;
}
style=3D"Margin: 0; min-width: 100%; background-color: #FFFFFF; font-famil=
y: Verdana,Geneva,sans-serif;" class=3D"ng-scope ng-isolate-scope iframe-bo=
dy iframe-body--inline">
tion:relative;">
inline cc_cursor">
lapse;width:100%;margin:0 auto;max-width:600px;" align=3D"center">
r>
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Thu, 12 Nov 2026 14:41:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))
(envelope-from
id 1xRban-00000000FQL-3JHZ
for dave@doctor.nl2k.ab.ca;
Thu, 12 Nov 2026 14:40:21 -0600
Resent-From: The Doctor
Resent-Date: Thu, 12 Nov 2026 14:40:21 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from o235.p37.mailjet.com ([185.250.236.235]:37701)
by doctor.nl2k.ab.ca with utf8esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
(Exim 4.100.1 (FreeBSD))
(envelope-from
id 1xRaLH-00000000LKM-1pQa
for doctor@doctor.nl2k.ab.ca;
Thu, 12 Nov 2026 13:20:18 -0600
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; q=dns/txt;
d=eosrv.net; i=mail@eosrv.net; s=mailjet; t=1794511148; x=1794518348;
h=Message-Id: MIME-Version: From: Reply-To: To: Subject: Date:
List-Unsubscribe-Post: List-Unsubscribe: Feedback-Id:
X-CSA-Complaints: X-MJ-Mid: X-REPORT-ABUSE-TO:
Content-Type: Content-Transfer-Encoding: To: From: Sender:
Subject: Date;
bh=P4R0/TKhaIPxe9d6S8i3x4SLqbwmCeSKw3+lKNaAu3k=;
b=J4dwcx661D0RWq8Kg7ngSST2HdV8dDTKLFaeJKS2mpBgRR2wvMVIVzslx
QuaMGPoOiZzAjVFDVNjiSI7Z1FxmKGXB62+M9ps9fQcxgORBTF4P3nAu5eAR
AJcXdZqEexUFA1j7/Hetkql28f448Ll41QhALWYqJh3RLeb6UWSLwk=
Message-Id:
MIME-Version: 1.0
From: XHelp
Reply-To: noreply@digitaleo.com
To: doctor@doctor.nl2k.ab.ca
Subject: We noticed a login to your account from a new device. Was this you?
Date: Thu, 12 Nov 2026 19:19:07 +0000
List-Unsubscribe-Post: List-Unsubscribe=One-Click
List-Unsubscribe:
Feedback-Id: 92027011:2731100.283537:MJ
X-CSA-Complaints: csa-complaints@eco.de
X-MJ-Mid:
EAAACciA9SUAAAAAAAAAAuoFzQwAAYCvB3QAAAAAACmsXABq9hEro8Buh5eBTG6v_Eh76ZgxxAAEU5E
X-REPORT-ABUSE-TO: Message sent by Mailjet please report to
abuse@mailjet.com with a copy of the message
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: quoted-printable
X-Spam_score: 52.9
X-Spam_score_int: 529
X-Spam_bar: ++++++++++++++++++++++++++++++++++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: We noticed a login to your account from a new device. Was
this you? New login
Content analysis details: (52.9 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[185.250.236.235 listed in will-spam-for-food.eu.org]
[185.250.236.235 listed in will-spam-for-food.eu.org]
[185.250.236.235 listed in will-spam-for-food.eu.org]
[185.250.236.235 listed in will-spam-for-food.eu.org]
[185.250.236.235 listed in will-spam-for-food.eu.org]
[185.250.236.235 listed in will-spam-for-food.eu.org]
[185.250.236.235 listed in will-spam-for-food.eu.org]
[185.250.236.235 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[185.250.236.235 listed in dnsbl.ahbl.org]
[185.250.236.235 listed in dnsbl.ahbl.org]
[185.250.236.235 listed in dnsbl.ahbl.org]
[185.250.236.235 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[185.250.236.235 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[185.250.236.235 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[185.250.236.235 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[185.250.236.235 listed in dnsbl.ahbl.org]
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[185.250.236.235 listed in list.dnswl.org]
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[185.250.236.235 listed in wl.mailspike.net]
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[185.250.236.235 listed in bl.score.senderscore.com]
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
-0.0 SPF_PASS SPF: sender matches SPF record
15 GR_DOMAIN_XECODE1 Spammer tool signature (xecode)
0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in
headers
15 GR_DOMAIN_MAILJE3 Message-ID contains spammer id (mailje)
15 GR_DOMAIN_MAILJE1 Received contains spammer id (mailje)
1.5 MR_STRANGE_QUESTION URI: No description available.
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
1.0 IMPRO_URI_2 No description available.
1.0 IMPRO_URI_3 No description available.
2.0 VOWEL_URI_6 URI hostname with 6 consecutive vowels
Subject: {SPAM?} We noticed a login to your account from a new device. Was this you?
w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
ft-com:vml" xmlns:o=3D"urn:schemas-microsoft-com:office:office">
http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dutf-8">
l-scale=3D1.0"><=
title>
media=3D"screen,print" rel=3D"stylesheet" type=3D"text/css">
"text/css"> table, td {
mso-table-lspace: 0pt;
mso-table-rspace: 0pt;
mso-table-tspace: 0pt;
mso-table-bspace: 0pt;
}
style=3D"Margin: 0; min-width: 100%; background-color: #FFFFFF; font-famil=
y: Verdana,Geneva,sans-serif;" class=3D"ng-scope ng-isolate-scope iframe-bo=
dy iframe-body--inline">
tion:relative;">
inline cc_cursor">
lapse;width:100%;margin:0 auto;max-width:600px;" align=3D"center">
r>
ope editable-block--inline cc_cursor">
lapse;width:100%;margin:0 auto;max-width:600px;" align=3D"center">
r>
g:border-box;width:100%;max-width:580px;display:inline-block;padding:10px 1= 0px 10px 10px;vertical-align:top;"> t-family:sans-serif;color:#333333;border-collapse:collapse;width:100%;Margi= n:0 auto;max-width:600px;" align=3D"center"> |
mily:Arial,Verdana,Geneva,sans-serif;text-align:left;"> =C2=A0 |
ope editable-block--inline">
lapse;width:100%;margin:0 auto;max-width:600px;" align=3D"center">
r>
ox;width:100%;max-width:170px;display:inline-block;padding:0px 10px 10px 0p= x;vertical-align:top;"> der-spacing:0;ont-family:sans-serif;border-collapse:collapse;width:100%;mar= gin:0 auto;max-width:600px;"> |
ox;width:100%;max-width:430px;display:inline-block;padding:0px 10px 10px 10=
px;vertical-align:top;border-left:#848484 1px solid;">
er-spacing:0;font-family:sans-serif;border-collapse:collapse;width:100%;mar=
gin:0 auto;max-width:600px;font-size:13px;">
inner" style=3D"text-align:left;">
er-collapse:collapse;width:100%;">
style=3D"padding:0;word-wrap:break-word;word-break:break-word;">
editor=3D"" style=3D"position:relative;" class=3D"ng-isolate-scope">
e=3D"font-family:Arial,Verdana,Geneva,sans-serif;font-size:13px;line-height=
:1.5;margin-bottom:0px;margin-left:0px;margin-right:0px;margin-top:0px;marg=
in:0px;mso-line-height-rule:exactly;padding:0px;text-align:left;word-break:=
break-word;">PATOUX EQUIPAGRI
ng>
-height:1;margin-bottom:0px;margin-left:0px;margin-right:0px;margin-top:0px=
;margin:0px;mso-line-height-rule:exactly;padding-bottom:0px;padding-left:0p=
x;padding-right:0px;padding-top:0px;padding:0px;text-align:left;word-break:=
break-word;">=C2=A0
-height:1;margin-bottom:0px;margin-left:0px;margin-right:0px;margin-top:0px=
;margin:0px;mso-line-height-rule:exactly;padding-bottom:0px;padding-left:0p=
x;padding-right:0px;padding-top:0px;padding:0px;text-align:left;word-break:=
break-word;">
-height:1.5;margin-bottom:0px;margin-left:0px;margin-right:0px;margin-top:0=
px;margin:0px;mso-line-height-rule:exactly;padding:0px;text-align:left;word=
-break:break-word;">
-height:1.5;margin-bottom:0px;margin-left:0px;margin-right:0px;margin-top:0=
px;margin:0px;mso-line-height-rule:exactly;padding:0px;text-align:left;word=
-break:break-word;">
ope editable-block--inline">
lapse;width:100%;margin:0 auto;max-width:600px;" align=3D"center">
r>
box;width:100%;max-width:580px;display:inline-block;padding:10px 10px 10px = 10px;vertical-align:top;"> er-spacing:0;font-family:sans-serif;border-collapse:collapse;width:100%;mar= gin:0 auto;max-width:600px;font-size:13px;"> |
er-collapse:collapse;width:100%;"> |
6px;">
height=3D"1" width=3D"1" alt=3D"" border=3D"0" style=3D"height:1px;width:1=
px;border:0;" src=3D"https://clicks.messengeo.net?i=3D84d587e90a7729f1bec68=
f9816ae145c&c=3DYWMuYmEuazJsbi5yb3Rjb2RAcm90Y29kOjoyNDYwMjA3MDA0"/><=
/html>
=