Cloud credentialis phishing from Google gmail PArt 1
Posted by Dave Yadallee on
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Mon, 16 Mar 2026 23:25:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))
(envelope-from)
id 1w2MuP-000000009g6-192N
for dave@doctor.nl2k.ab.ca;
Mon, 16 Mar 2026 23:24:01 -0600
Resent-From: The Doctor
Resent-Date: Mon, 16 Mar 2026 23:24:01 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-oo1-f70.google.com ([209.85.161.70]:52672)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.98.2 (FreeBSD))
(envelope-from)
id 1w2MPE-000000004xM-4C4I
for doctor@netknow.ca;
Mon, 16 Mar 2026 22:51:56 -0600
Received: by mail-oo1-f70.google.com with SMTP id 006d021491bc7-67bd1b317dfso96215976eaf.1
for; Mon, 16 Mar 2026 21:50:42 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=oosakaya.info; s=firebase1; t=1773723036; x=1774327836; darn=netknow.ca;
h=to:from:subject:date:message-id:reply-to:mime-version:from:to:cc
:subject:date:message-id:reply-to;
bh=dxFSfWZrOxGkdgBaR6oJT0fLJ+Nyhn+gSa/r0pof7aM=;
b=PF8IqPjXcmH8ehRANLTtw7Wdcg81h8AldTAsZ62fjyYeOQwOTw/efA6i6Eusy8CS9d
RJYJC9948rAMwH4rawFoPmCGGAIjfQJXl4avPgQ93xht+zLc27Tw6zWYAcII3nsoeC8K
AxB7l+sU7SwB2lvKpCa+ms0zG9Z7LuFanijYX/tlyNyIuUYeg2bTxPxiZE2pkF1rep1h
kTTlw7wzuKPtEqJ8A671G3rjCQk8F6i3iBwdbYflLIPxg3/Silk5HLCLusMbyxV6f0ef
tsMj8Umla2woyEzJbV43zyhG1JPirq1TGjFqZ94ApbdciaFD5DbwL8/5YznxGzwexKNs
lcKQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20251104; t=1773723036; x=1774327836;
h=to:from:subject:date:message-id:reply-to:mime-version
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
bh=dxFSfWZrOxGkdgBaR6oJT0fLJ+Nyhn+gSa/r0pof7aM=;
b=dD72q1TQgH/YjVRPoLfRBGSHuzfBswE3MLus6A1Swv/NZFsQgjNGp9fKP7WrC/w987
GBse77ti6SycaQl4C6UQO9NHC+WIHOXLzYwMRnVsCNeGx56wCR10+E/piuOViID8pSdo
j99coyKCB8pFcgmOZZ4leQWuCiQg6dBPpFzN7KquuVGMTRDI6xY4NQIlcJs6rQtScNdZ
L1cickDFcG9CVcKsPic1s+GFlTPg/Dn2UA2hHQrCijK3v6NaoIfVRhXPqGw4Knb2V5Sc
uRMSyd55x9mS+z/LlJkVxhk3pOgmhxHrkQy5zN+E2n+QOEZWzrcaxC+bEg1yuKoi21CW
rnXQ==
X-Gm-Message-State: AOJu0Yxjz8v3n/QGgxJuHJIRsj56SQwDQjJXi/sCJ6OFg7WmxHP9Wy8H
2QR1g3Why8wuSnwrkEcjm7c4NnBzE6/3TGFB1JOfd7UGWxREoVZI8NTnRReBElcCaRd1dmfbPql
7EE2VrRw2BfsHDg==
MIME-Version: 1.0
X-Received: by 2002:a05:6820:4d05:b0:67b:b4f4:2731 with SMTP id
006d021491bc7-67bdaa38726mr9724744eaf.44.1773723036495; Mon, 16 Mar 2026
21:50:36 -0700 (PDT)
Reply-To: cloudsystemalert@yopmail.com
Message-ID: <0000000000008533ba064d31132a@google.com>
Date: Tue, 17 Mar 2026 04:50:36 +0000
Subject: =?UTF-8?Q?=E2=9A=A0=EF=B8=8F_Uploads_Paused=3A_Storage_Full_=26_Capacity_excee?=
=?UTF-8?Q?ded?=
From: Cloud System Alert
To: doctor@netknow.ca
Content-Type: multipart/alternative; boundary="0000000000008533ad064d311327"
X-Spam_score: 9.6
X-Spam_score_int: 96
X-Spam_bar: +++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Your mailbox has reached 96% of its storage capacity. Manage
storage or confirm your account. Brand Logo Your Cloud Storage Is 96% Full
Content analysis details: (9.6 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[209.85.161.70 listed in will-spam-for-food.eu.org]
[209.85.161.70 listed in will-spam-for-food.eu.org]
[209.85.161.70 listed in will-spam-for-food.eu.org]
[209.85.161.70 listed in will-spam-for-food.eu.org]
[209.85.161.70 listed in will-spam-for-food.eu.org]
[209.85.161.70 listed in will-spam-for-food.eu.org]
[209.85.161.70 listed in will-spam-for-food.eu.org]
[209.85.161.70 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[209.85.161.70 listed in dnsbl.ahbl.org]
[209.85.161.70 listed in dnsbl.ahbl.org]
[209.85.161.70 listed in dnsbl.ahbl.org]
[209.85.161.70 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[209.85.161.70 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[209.85.161.70 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[209.85.161.70 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[209.85.161.70 listed in dnsbl.ahbl.org]
0.0 T_SPF_PERMERROR SPF: test of record failed (permerror)
1.1 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The
query to Validity was blocked. See
https://knowledge.validity.com/hc/en-us/articles/20961730681243
for more information.
[209.85.161.70 listed in sa-trusted.bondedsender.org]
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |]
0.7 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to
Validity was blocked. See
https://knowledge.validity.com/hc/en-us/articles/20961730681243
for more information.
[209.85.161.70 listed in sa-accredit.habeas.com]
-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)
[209.85.161.70 listed in wl.mailspike.net]
1.0 OFFER_URI URI: Offer in link address
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam
0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders
2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
1.0 ACCT_PHISHING Possible phishing for account information
0.9 URI_PHISH Phishing using web form
0.4 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to
Validity was blocked. See
https://knowledge.validity.com/hc/en-us/articles/20961730681243
for more information.
[209.85.161.70 listed in bl.score.senderscore.com]
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[209.85.161.70 listed in bl.score.senderscore.com]
Subject: {SPAM?} =?UTF-8?Q?=E2=9A=A0=EF=B8=8F_Uploads_Paused=3A_Storage_Full_=26_Capacity_excee?=
=?UTF-8?Q?ded?=
--0000000000008533ad064d311327
Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes
Your mailbox has reached 96% of its storage capacity. Manage storage or
confirm your account.
Brand Logo
Your Cloud Storage Is 96% Full
Hello,
Your mailbox has reached 96% of its total storage capacity. This may affect
your ability to send or receive new messages and could result in important
communications being delayed or lost.
To avoid interruption of service, please take immediate action to free up
space or upgrade your storage plan.
Click below to confirm your account status and manage your account
prefernces.
96% Used
Get More Storage
Thank You,
Cloud Storage Support Team
To unsubscribe, click here.
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Mon, 16 Mar 2026 23:25:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))
(envelope-from
id 1w2MuP-000000009g6-192N
for dave@doctor.nl2k.ab.ca;
Mon, 16 Mar 2026 23:24:01 -0600
Resent-From: The Doctor
Resent-Date: Mon, 16 Mar 2026 23:24:01 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-oo1-f70.google.com ([209.85.161.70]:52672)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.98.2 (FreeBSD))
(envelope-from
id 1w2MPE-000000004xM-4C4I
for doctor@netknow.ca;
Mon, 16 Mar 2026 22:51:56 -0600
Received: by mail-oo1-f70.google.com with SMTP id 006d021491bc7-67bd1b317dfso96215976eaf.1
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=oosakaya.info; s=firebase1; t=1773723036; x=1774327836; darn=netknow.ca;
h=to:from:subject:date:message-id:reply-to:mime-version:from:to:cc
:subject:date:message-id:reply-to;
bh=dxFSfWZrOxGkdgBaR6oJT0fLJ+Nyhn+gSa/r0pof7aM=;
b=PF8IqPjXcmH8ehRANLTtw7Wdcg81h8AldTAsZ62fjyYeOQwOTw/efA6i6Eusy8CS9d
RJYJC9948rAMwH4rawFoPmCGGAIjfQJXl4avPgQ93xht+zLc27Tw6zWYAcII3nsoeC8K
AxB7l+sU7SwB2lvKpCa+ms0zG9Z7LuFanijYX/tlyNyIuUYeg2bTxPxiZE2pkF1rep1h
kTTlw7wzuKPtEqJ8A671G3rjCQk8F6i3iBwdbYflLIPxg3/Silk5HLCLusMbyxV6f0ef
tsMj8Umla2woyEzJbV43zyhG1JPirq1TGjFqZ94ApbdciaFD5DbwL8/5YznxGzwexKNs
lcKQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20251104; t=1773723036; x=1774327836;
h=to:from:subject:date:message-id:reply-to:mime-version
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
bh=dxFSfWZrOxGkdgBaR6oJT0fLJ+Nyhn+gSa/r0pof7aM=;
b=dD72q1TQgH/YjVRPoLfRBGSHuzfBswE3MLus6A1Swv/NZFsQgjNGp9fKP7WrC/w987
GBse77ti6SycaQl4C6UQO9NHC+WIHOXLzYwMRnVsCNeGx56wCR10+E/piuOViID8pSdo
j99coyKCB8pFcgmOZZ4leQWuCiQg6dBPpFzN7KquuVGMTRDI6xY4NQIlcJs6rQtScNdZ
L1cickDFcG9CVcKsPic1s+GFlTPg/Dn2UA2hHQrCijK3v6NaoIfVRhXPqGw4Knb2V5Sc
uRMSyd55x9mS+z/LlJkVxhk3pOgmhxHrkQy5zN+E2n+QOEZWzrcaxC+bEg1yuKoi21CW
rnXQ==
X-Gm-Message-State: AOJu0Yxjz8v3n/QGgxJuHJIRsj56SQwDQjJXi/sCJ6OFg7WmxHP9Wy8H
2QR1g3Why8wuSnwrkEcjm7c4NnBzE6/3TGFB1JOfd7UGWxREoVZI8NTnRReBElcCaRd1dmfbPql
7EE2VrRw2BfsHDg==
MIME-Version: 1.0
X-Received: by 2002:a05:6820:4d05:b0:67b:b4f4:2731 with SMTP id
006d021491bc7-67bdaa38726mr9724744eaf.44.1773723036495; Mon, 16 Mar 2026
21:50:36 -0700 (PDT)
Reply-To: cloudsystemalert@yopmail.com
Message-ID: <0000000000008533ba064d31132a@google.com>
Date: Tue, 17 Mar 2026 04:50:36 +0000
Subject: =?UTF-8?Q?=E2=9A=A0=EF=B8=8F_Uploads_Paused=3A_Storage_Full_=26_Capacity_excee?=
=?UTF-8?Q?ded?=
From: Cloud System Alert
To: doctor@netknow.ca
Content-Type: multipart/alternative; boundary="0000000000008533ad064d311327"
X-Spam_score: 9.6
X-Spam_score_int: 96
X-Spam_bar: +++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Your mailbox has reached 96% of its storage capacity. Manage
storage or confirm your account. Brand Logo Your Cloud Storage Is 96% Full
Content analysis details: (9.6 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[209.85.161.70 listed in will-spam-for-food.eu.org]
[209.85.161.70 listed in will-spam-for-food.eu.org]
[209.85.161.70 listed in will-spam-for-food.eu.org]
[209.85.161.70 listed in will-spam-for-food.eu.org]
[209.85.161.70 listed in will-spam-for-food.eu.org]
[209.85.161.70 listed in will-spam-for-food.eu.org]
[209.85.161.70 listed in will-spam-for-food.eu.org]
[209.85.161.70 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[209.85.161.70 listed in dnsbl.ahbl.org]
[209.85.161.70 listed in dnsbl.ahbl.org]
[209.85.161.70 listed in dnsbl.ahbl.org]
[209.85.161.70 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[209.85.161.70 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[209.85.161.70 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[209.85.161.70 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[209.85.161.70 listed in dnsbl.ahbl.org]
0.0 T_SPF_PERMERROR SPF: test of record failed (permerror)
1.1 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The
query to Validity was blocked. See
https://knowledge.validity.com/hc/en-us/articles/20961730681243
for more information.
[209.85.161.70 listed in sa-trusted.bondedsender.org]
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |
0.7 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to
Validity was blocked. See
https://knowledge.validity.com/hc/en-us/articles/20961730681243
for more information.
[209.85.161.70 listed in sa-accredit.habeas.com]
-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)
[209.85.161.70 listed in wl.mailspike.net]
1.0 OFFER_URI URI: Offer in link address
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam
0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders
2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
1.0 ACCT_PHISHING Possible phishing for account information
0.9 URI_PHISH Phishing using web form
0.4 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to
Validity was blocked. See
https://knowledge.validity.com/hc/en-us/articles/20961730681243
for more information.
[209.85.161.70 listed in bl.score.senderscore.com]
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[209.85.161.70 listed in bl.score.senderscore.com]
Subject: {SPAM?} =?UTF-8?Q?=E2=9A=A0=EF=B8=8F_Uploads_Paused=3A_Storage_Full_=26_Capacity_excee?=
=?UTF-8?Q?ded?=
--0000000000008533ad064d311327
Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes
Your mailbox has reached 96% of its storage capacity. Manage storage or
confirm your account.
Brand Logo
Your Cloud Storage Is 96% Full
Hello,
Your mailbox has reached 96% of its total storage capacity. This may affect
your ability to send or receive new messages and could result in important
communications being delayed or lost.
To avoid interruption of service, please take immediate action to free up
space or upgrade your storage plan.
Click below to confirm your account status and manage your account
prefernces.
96% Used
Get More Storage
Thank You,
Cloud Storage Support Team
To unsubscribe, click here.