Geek squad phish from Google Gmail
Posted by Dave Yadallee on
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Fri, 13 Feb 2026 13:31:00 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))
(envelope-from)
id 1vqzo4-000000001qL-0mur
for dave@doctor.nl2k.ab.ca;
Fri, 13 Feb 2026 13:30:28 -0700
Resent-From: The Doctor
Resent-Date: Fri, 13 Feb 2026 13:30:28 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-oi1-f202.google.com ([209.85.167.202]:45163)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.98.2 (FreeBSD))
(envelope-from)
id 1vqyck-00000000Od6-2rZu
for doctor@nl2k.ab.ca;
Fri, 13 Feb 2026 12:14:51 -0700
Received: by mail-oi1-f202.google.com with SMTP id 5614622812f47-463984b79e7so8045253b6e.2
for; Fri, 13 Feb 2026 11:13:56 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=google.com; s=20230601; t=1771010030; x=1771614830; darn=nl2k.ab.ca;
h=from:subject:date:message-id:sender:reply-to:mime-version:from:to
:cc:subject:date:message-id:reply-to;
bh=11gFVuirxLSHfFIF7iFVqNVX96Fa+oScDNozbFXc/BQ=;
b=ISKVHHkGQ/i7o8lnren4odBu0IQV/TWN6PQ8ef7Md9d5Muwd5xqx1eFhndUtkBtg/K
S2HZ5LMM5WyzlryIGYYQh4dFUhML8gIHd7Lc8hf6/A46SZx0SIfXkYwgQvaDUmTJuoPL
6ev2rysjFWWSUshs49tbyNGbhJS4bj0+E1aAkU9v+zKdzYLCCa9BbWERj5zNETh8Sm4n
bncpYdZaRJLjzriNZ245luM4jzEq69ymKAMQ9bGi6I3cht2fUUEaK/oZBxxtmWi+xwX9
QHk2/++D8AIsBIH2NNIIh9T8mEeEBoq7b/R2CoepC5Rci3So85KIgn5jDQdrsodzxShS
8sJg==
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=tekdilim-org.20230601.gappssmtp.com; s=20230601; t=1771010030; x=1771614830; darn=nl2k.ab.ca;
h=from:subject:date:message-id:sender:reply-to:mime-version:from:to
:cc:subject:date:message-id:reply-to;
bh=11gFVuirxLSHfFIF7iFVqNVX96Fa+oScDNozbFXc/BQ=;
b=WYg7gfxEUeUqh9iqZdQ2y0qnmi5RVJYtakaR5NA023ISrZNtIhuB5hHfACcHMYlbth
2GUuYTVir8U33cFwcLSZvaBcTwapqgkvRvyc1lr6Qt+qMmTub0ESGQCchUC35M9MbF3E
pwGIWrWTnH6GJAQtG16A/j+S9R1QY3rrXWYwFdWoYnCEIdZNFe0pHMgB4ROrrPnlLIUP
oNT0Qj8+WIPg/+dLiq3vAJjRG5rn5hcIwBQmIZX2ufwfGsXhwetshDGoYqjqL9KiCrBQ
ks1qUAt8hGno7GiHXuHn+G1dIPrqSR31hQgl7If/dyCuGb02FYLPud7djN+c4Qr1NJM4
46XQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20230601; t=1771010030; x=1771614830;
h=from:subject:date:message-id:sender:reply-to:mime-version
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
bh=11gFVuirxLSHfFIF7iFVqNVX96Fa+oScDNozbFXc/BQ=;
b=k+9dI16dkfi8sSp5n+EQwmywN7GeGnFqQZoADHNs0CBDkUxMLmEi2vGYe1cZgak8VE
smk55HuPGQ4i4q89oTsFyX+f2iAts/DjWlGd9C3TdAllvrN1WRCt1FvfrIg68ZL8joHb
LxJ2Pnha8Hm7sw3NJzbk9tRKwICQwUSAblOT79zDmB4rVM9FvYFWXaULasqDK7u8aABd
XVK1oiTmRjmGC1icHkS87Ycophy6pBeWiaOIBZfOgkaKrIffIFdaEF4WMZBTSAi09Uxn
DSLA4UidhpC/PZLcNGhF/1RYEYRpTxTGsAedkASY04hxL64k8WqzIs/o6VTIHY/TOtjP
J5Zw==
X-Forwarded-Encrypted: i=1; AJvYcCXFm7bKbijmzyToLm4vTP2KyLWazpMcnseNkWUbSCmlrj3qAGbVFZCBhV1eR1AfEnSnPTtHhzY=@nl2k.ab.ca
X-Gm-Message-State: AOJu0YyZsOepO1MzkmA8KkGRfcRf8/yeSqOFgCJnshX1p3Etz/Lnmy82
ccATiu37EFy/KpNpEoyI05VToP+z2vBNdutriXpSN1dAkG5GKARLaVa+SV179dVY7AVwYHthb8Q
+Ljz+beALQNw6YpMkNErj+5v+pck1x1ylz118NCSwb8acbQ==
MIME-Version: 1.0
X-Received: by 2002:a05:6808:220f:b0:45c:75ec:b9d0 with SMTP id
5614622812f47-4639f19162bmt1842242b6e.34.1771010029677; Fri, 13 Feb 2026
11:13:49 -0800 (PST)
Reply-To: Derick Ojeda
Sender: Google Calendar
Message-ID:
Date: Fri, 13 Feb 2026 19:13:49 +0000
Subject: Review details saved for Account Update Receipt
From: Derick Ojeda
Content-Type: multipart/alternative; boundary="000000000000bb03a6064ab967ad"
X-Spam_score: 13.6
X-Spam_score_int: 136
X-Spam_bar: +++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Review details saved for Account Update Receipt Review details
saved for Account Update Receipt Saturday Feb 14, 2026 â‹… 3:13am Eastern
Time - New York Account Update,We appreciate your business with GeekSquad.
This email confirms your recent Receipt.Thank you for completing your 1 Year.
Our support team attempted to reach you for assistance.Product [...]
Content analysis details: (13.6 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[209.85.167.202 listed in dnsbl.ahbl.org]
[209.85.167.202 listed in dnsbl.ahbl.org]
[209.85.167.202 listed in dnsbl.ahbl.org]
[209.85.167.202 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[209.85.167.202 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[209.85.167.202 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[209.85.167.202 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[209.85.167.202 listed in dnsbl.ahbl.org]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[209.85.167.202 listed in will-spam-for-food.eu.org]
[209.85.167.202 listed in will-spam-for-food.eu.org]
[209.85.167.202 listed in will-spam-for-food.eu.org]
[209.85.167.202 listed in will-spam-for-food.eu.org]
[209.85.167.202 listed in will-spam-for-food.eu.org]
[209.85.167.202 listed in will-spam-for-food.eu.org]
[209.85.167.202 listed in will-spam-for-food.eu.org]
[209.85.167.202 listed in will-spam-for-food.eu.org]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.167.202 listed in list.dnswl.org]
1.2 MISSING_HEADERS Missing To: header
0.6 J_CHICKENPOX_62 BODY: 6alpha-pock-2alpha
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.167.202 listed in wl.mailspike.net]
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars
1.9 REPLYTO_WITHOUT_TO_CC No description available.
3.0 LONG_INVISIBLE_TEXT Long block of hidden text - bayes poison?
Subject: {SPAM?} Review details saved for Account Update Receipt
Review details saved for Account Update Receipt
Review details saved for Account Update Receipt
Saturday Feb 14, 2026 ⋅ 3:13am (Eastern Time - New York)
Account Update,
We appreciate your business with GeekSquad. This email confirms your recent Receipt.
Thank you for completing your 1 Year. Our support team attempted to reach you for assistance.
Product Metrics View
Receipt id- 1042-771-GPT
Purchased Service- Comprehensive Care
Validity Term- 1 Year
Amount Paid- USD589.99
For questions regarding this Receipt, call 1-806- 577-5489 (Toll Free).
Refund requests may be submitted within 24 hours of purchase.
Best wishes to you,,
Bryan Wylie
Billing Team
1-(803) 477-0921 (Toll Free)
© 2026 GeekSquad LLC All rights reserved.
821 Broad St Longmont Co 80504-5203 United States
Guests
(Guest list has been hidden at organizer's request)
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Fri, 13 Feb 2026 13:31:00 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))
(envelope-from
id 1vqzo4-000000001qL-0mur
for dave@doctor.nl2k.ab.ca;
Fri, 13 Feb 2026 13:30:28 -0700
Resent-From: The Doctor
Resent-Date: Fri, 13 Feb 2026 13:30:28 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-oi1-f202.google.com ([209.85.167.202]:45163)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.98.2 (FreeBSD))
(envelope-from
id 1vqyck-00000000Od6-2rZu
for doctor@nl2k.ab.ca;
Fri, 13 Feb 2026 12:14:51 -0700
Received: by mail-oi1-f202.google.com with SMTP id 5614622812f47-463984b79e7so8045253b6e.2
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=google.com; s=20230601; t=1771010030; x=1771614830; darn=nl2k.ab.ca;
h=from:subject:date:message-id:sender:reply-to:mime-version:from:to
:cc:subject:date:message-id:reply-to;
bh=11gFVuirxLSHfFIF7iFVqNVX96Fa+oScDNozbFXc/BQ=;
b=ISKVHHkGQ/i7o8lnren4odBu0IQV/TWN6PQ8ef7Md9d5Muwd5xqx1eFhndUtkBtg/K
S2HZ5LMM5WyzlryIGYYQh4dFUhML8gIHd7Lc8hf6/A46SZx0SIfXkYwgQvaDUmTJuoPL
6ev2rysjFWWSUshs49tbyNGbhJS4bj0+E1aAkU9v+zKdzYLCCa9BbWERj5zNETh8Sm4n
bncpYdZaRJLjzriNZ245luM4jzEq69ymKAMQ9bGi6I3cht2fUUEaK/oZBxxtmWi+xwX9
QHk2/++D8AIsBIH2NNIIh9T8mEeEBoq7b/R2CoepC5Rci3So85KIgn5jDQdrsodzxShS
8sJg==
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=tekdilim-org.20230601.gappssmtp.com; s=20230601; t=1771010030; x=1771614830; darn=nl2k.ab.ca;
h=from:subject:date:message-id:sender:reply-to:mime-version:from:to
:cc:subject:date:message-id:reply-to;
bh=11gFVuirxLSHfFIF7iFVqNVX96Fa+oScDNozbFXc/BQ=;
b=WYg7gfxEUeUqh9iqZdQ2y0qnmi5RVJYtakaR5NA023ISrZNtIhuB5hHfACcHMYlbth
2GUuYTVir8U33cFwcLSZvaBcTwapqgkvRvyc1lr6Qt+qMmTub0ESGQCchUC35M9MbF3E
pwGIWrWTnH6GJAQtG16A/j+S9R1QY3rrXWYwFdWoYnCEIdZNFe0pHMgB4ROrrPnlLIUP
oNT0Qj8+WIPg/+dLiq3vAJjRG5rn5hcIwBQmIZX2ufwfGsXhwetshDGoYqjqL9KiCrBQ
ks1qUAt8hGno7GiHXuHn+G1dIPrqSR31hQgl7If/dyCuGb02FYLPud7djN+c4Qr1NJM4
46XQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20230601; t=1771010030; x=1771614830;
h=from:subject:date:message-id:sender:reply-to:mime-version
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
bh=11gFVuirxLSHfFIF7iFVqNVX96Fa+oScDNozbFXc/BQ=;
b=k+9dI16dkfi8sSp5n+EQwmywN7GeGnFqQZoADHNs0CBDkUxMLmEi2vGYe1cZgak8VE
smk55HuPGQ4i4q89oTsFyX+f2iAts/DjWlGd9C3TdAllvrN1WRCt1FvfrIg68ZL8joHb
LxJ2Pnha8Hm7sw3NJzbk9tRKwICQwUSAblOT79zDmB4rVM9FvYFWXaULasqDK7u8aABd
XVK1oiTmRjmGC1icHkS87Ycophy6pBeWiaOIBZfOgkaKrIffIFdaEF4WMZBTSAi09Uxn
DSLA4UidhpC/PZLcNGhF/1RYEYRpTxTGsAedkASY04hxL64k8WqzIs/o6VTIHY/TOtjP
J5Zw==
X-Forwarded-Encrypted: i=1; AJvYcCXFm7bKbijmzyToLm4vTP2KyLWazpMcnseNkWUbSCmlrj3qAGbVFZCBhV1eR1AfEnSnPTtHhzY=@nl2k.ab.ca
X-Gm-Message-State: AOJu0YyZsOepO1MzkmA8KkGRfcRf8/yeSqOFgCJnshX1p3Etz/Lnmy82
ccATiu37EFy/KpNpEoyI05VToP+z2vBNdutriXpSN1dAkG5GKARLaVa+SV179dVY7AVwYHthb8Q
+Ljz+beALQNw6YpMkNErj+5v+pck1x1ylz118NCSwb8acbQ==
MIME-Version: 1.0
X-Received: by 2002:a05:6808:220f:b0:45c:75ec:b9d0 with SMTP id
5614622812f47-4639f19162bmt1842242b6e.34.1771010029677; Fri, 13 Feb 2026
11:13:49 -0800 (PST)
Reply-To: Derick Ojeda
Sender: Google Calendar
Message-ID:
Date: Fri, 13 Feb 2026 19:13:49 +0000
Subject: Review details saved for Account Update Receipt
From: Derick Ojeda
Content-Type: multipart/alternative; boundary="000000000000bb03a6064ab967ad"
X-Spam_score: 13.6
X-Spam_score_int: 136
X-Spam_bar: +++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Review details saved for Account Update Receipt Review details
saved for Account Update Receipt Saturday Feb 14, 2026 â‹… 3:13am Eastern
Time - New York Account Update,We appreciate your business with GeekSquad.
This email confirms your recent Receipt.Thank you for completing your 1 Year.
Our support team attempted to reach you for assistance.Product [...]
Content analysis details: (13.6 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[209.85.167.202 listed in dnsbl.ahbl.org]
[209.85.167.202 listed in dnsbl.ahbl.org]
[209.85.167.202 listed in dnsbl.ahbl.org]
[209.85.167.202 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[209.85.167.202 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[209.85.167.202 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[209.85.167.202 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[209.85.167.202 listed in dnsbl.ahbl.org]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[209.85.167.202 listed in will-spam-for-food.eu.org]
[209.85.167.202 listed in will-spam-for-food.eu.org]
[209.85.167.202 listed in will-spam-for-food.eu.org]
[209.85.167.202 listed in will-spam-for-food.eu.org]
[209.85.167.202 listed in will-spam-for-food.eu.org]
[209.85.167.202 listed in will-spam-for-food.eu.org]
[209.85.167.202 listed in will-spam-for-food.eu.org]
[209.85.167.202 listed in will-spam-for-food.eu.org]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.167.202 listed in list.dnswl.org]
1.2 MISSING_HEADERS Missing To: header
0.6 J_CHICKENPOX_62 BODY: 6alpha-pock-2alpha
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.167.202 listed in wl.mailspike.net]
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars
1.9 REPLYTO_WITHOUT_TO_CC No description available.
3.0 LONG_INVISIBLE_TEXT Long block of hidden text - bayes poison?
Subject: {SPAM?} Review details saved for Account Update Receipt
Review details saved for Account Update Receipt
Review details saved for Account Update Receipt
Saturday Feb 14, 2026 ⋅ 3:13am (Eastern Time - New York)
Account Update,
We appreciate your business with GeekSquad. This email confirms your recent Receipt.
Thank you for completing your 1 Year. Our support team attempted to reach you for assistance.
Product Metrics View
Receipt id- 1042-771-GPT
Purchased Service- Comprehensive Care
Validity Term- 1 Year
Amount Paid- USD589.99
For questions regarding this Receipt, call 1-806- 577-5489 (Toll Free).
Refund requests may be submitted within 24 hours of purchase.
Best wishes to you,,
Bryan Wylie
Billing Team
1-(803) 477-0921 (Toll Free)
© 2026 GeekSquad LLC All rights reserved.
821 Broad St Longmont Co 80504-5203 United States
Guests
(Guest list has been hidden at organizer's request)