nk.ca credential phishing from Google Gmail
Posted by Dave Yadallee onX-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Thu, 24 Sep 2026 14:29:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))
(envelope-from
id 1x9q3T-000000005wx-1yIy
for dave@doctor.nl2k.ab.ca;
Thu, 24 Sep 2026 14:28:31 -0600
Resent-From: The Doctor
Resent-Date: Thu, 24 Sep 2026 14:28:31 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-pj1-f101.google.com ([209.85.216.101]:56499)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.100.1 (FreeBSD))
(envelope-from <04736733@intime.cz>)
id 1x9iLA-000000006tj-3q97
for root@nl2k.ca;
Thu, 24 Sep 2026 06:14:25 -0600
Received: by mail-pj1-f101.google.com with SMTP id 98e67ed59e1d1-398e9698a70so687991a91.0
for
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20260707; t=1790252004; x=1790856804;
h=content-transfer-encoding:content-type:mime-version:message-id:date
:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date
:message-id:reply-to:content-type;
bh=LDXgeeCdvzRDqDywNoYj0E5ZGD7NsrDF8B5Tl5OWukI=;
b=xPW3NeAYVecm2ZTgVHPOdcPhG5jJ/zNFd+zscRT3X3YNDLHnGTQQUepuX1KBLVYdIf
4L7gUV9aln552Sefi6I6gfCJG785lY5mKsjvzqlTttUCZ/9Ig/wsEwcki2yqzxD51++s
Ct2dDR/iyM+T6aQa6kFBW8bVyGfdlck6ACUigUd+ucGunbI48cPoXaeKe3prMCB4tSG4
226XSlArMw8VNwJ5CCfvMOrRd4Ap16Z4TRD62myB8HitOGUNjcH6+L6SwFDgiOZtTA5H
p/Euf9cTck7RWiRPzzw6OGwKcpTGL4TQgSpism4sLLJK4TXDvkvXWJKCxLhPPidk4Te2
lJrw==
X-Gm-Message-State: AFuF++kQTp4G5L33DKtUjlxxHRf3I4mrHL+IRHPefDpgLe+RMATlXppc
CMOPYPFdg0f9JoVgxYLXCBChz+Npqc/d7Ogy+5Lcpz3hN7mPrbueddmrkxodx73hpYhUuhTO+R9
ADldlOPAGlRSq/RCkUNh3evFRteB3osKULdfC2vmHBHj57jY=
X-Gm-Gg: AYBFou2RGgBLw/wUE76ab2p8pM7ebkpNViG72cCmv349YRZWK3gk603AP/o7VNQ5duB
s4cGKqbUry+I4zx8oxY9T0c4a/Rgts4pPoTVHn+Gg70ZxloZnUicm8gjWdWU7m9HQcGVBVmZUB0
GFplMEZXWDzONEaer4+GxjyCzWm6wx5LrrBdijajY0PIcZik60JiQBIFCKIDMrF7FkMHrJCOe8L
amPIMU4zIb/K6Z/R6TGgjPGxYCVGuUhVUztmeLR7rh6RGAZ+PEc6ktA3yazXyvw/8/ZrvREmsDS
I/KLkTijnyYtWxxgg53TomdM5xgFKJm5+eU4xHgOj6ya6of7MeQX1ZdPNzw2aOJViBhfyHnnjQG
l7EAeiZ6YbGwQTt8=
X-Received: by 2002:a17:90b:1d52:b0:39d:f189:48d6 with SMTP id 98e67ed59e1d1-3a0986ed7aamr2026338a91.4.1790252004412;
Thu, 24 Sep 2026 05:13:24 -0700 (PDT)
Received: from [135.136.140.154] ([135.136.140.154])
by smtp-relay.gmail.com with ESMTP id 98e67ed59e1d1-3a09728dab1sm1553944a91.1.2026.09.24.05.13.24
for
Thu, 24 Sep 2026 05:13:24 -0700 (PDT)
X-Relaying-Domain: intime.cz
From: nl2k.ca Support <89479657@intime.cz>
To: root@nl2k.ca
Subject: (root) Your Password is About to Expire.
Date: 24 Sep 2026 21:13:23 +0900
Message-ID: <20260924211323.1C0545E0CF3BAC17@intime.cz>
MIME-Version: 1.0
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
X-Spam_score: 12.4
X-Spam_score_int: 124
X-Spam_bar: ++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: System Notification Password expiration notice The login
credentials for the account root@nl2k.ca are scheduled to expire within 48
hours. To maintain uninterrupted access to your website files, data [...]
Content analysis details: (12.4 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.216.101 listed in list.dnswl.org]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[135.136.140.154 listed in will-spam-for-food.eu.org]
[135.136.140.154 listed in will-spam-for-food.eu.org]
[135.136.140.154 listed in will-spam-for-food.eu.org]
[135.136.140.154 listed in will-spam-for-food.eu.org]
[135.136.140.154 listed in will-spam-for-food.eu.org]
[135.136.140.154 listed in will-spam-for-food.eu.org]
[135.136.140.154 listed in will-spam-for-food.eu.org]
[135.136.140.154 listed in will-spam-for-food.eu.org]
[209.85.216.101 listed in will-spam-for-food.eu.org]
[209.85.216.101 listed in will-spam-for-food.eu.org]
[209.85.216.101 listed in will-spam-for-food.eu.org]
[209.85.216.101 listed in will-spam-for-food.eu.org]
[209.85.216.101 listed in will-spam-for-food.eu.org]
[209.85.216.101 listed in will-spam-for-food.eu.org]
[209.85.216.101 listed in will-spam-for-food.eu.org]
[209.85.216.101 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[135.136.140.154 listed in dnsbl.ahbl.org]
[135.136.140.154 listed in dnsbl.ahbl.org]
[135.136.140.154 listed in dnsbl.ahbl.org]
[135.136.140.154 listed in dnsbl.ahbl.org]
[209.85.216.101 listed in dnsbl.ahbl.org]
[209.85.216.101 listed in dnsbl.ahbl.org]
[209.85.216.101 listed in dnsbl.ahbl.org]
[209.85.216.101 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[135.136.140.154 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[135.136.140.154 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[135.136.140.154 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[135.136.140.154 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL
[135.136.140.154 listed in sbl-xbl.spamhaus.org]
1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org
[Listed by XBL, see
2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist
[URI: sharemyhtml.com]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |
0.8 ZMIvirSobY_SUB63 SPAM from Sober-Y-Virus
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[209.85.216.101 listed in bl.score.senderscore.com]
-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)
[209.85.216.101 listed in wl.mailspike.net]
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.1 MXG_EMAIL_FRAG BODY: URI with email in fragment
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders
0.0 NO_RDNS2 Sending MTA has no reverse DNS
1.2 PDS_FROM_NAME_TO_DOMAIN From:name looks like To:domain
0.7 BODY_URI_ONLY Message body is only a URI in one line of text or for
an image
0.4 PDS_FRNOM_TODOM_NAKED_TO Naked to From name equals to Domain
Subject: {SPAM?} (root) Your Password is About to Expire.
X-Antivirus: AVG (VPS 260924-14, 9/24/2026), Inbound message
X-Antivirus-Status: Clean
=3D"0" cellpadding=3D"0">
able border=3D"0" cellspacing=3D"0" cellpadding=3D"0">
=3D"vertical-align: middle;">
12px; font-family: "Segoe UI Semibold", "Segoe UI", sans-serif; font-size:=
20px; font-weight: 600; vertical-align: middle;'>
>
I Semibold","Segoe UI Bold","Segoe UI","Helvetica Neue Medium",Arial,sans-s=
erif; font-size: 17px;'>System Notification
t-family: "Segoe UI Light","Segoe UI","Helvetica Neue Medium",Arial,sans-se=
rif; font-size: 41px;'>Password expiration notice
px; font-family: "Segoe UI",Tahoma,Verdana,Arial,sans-serif; font-size: 14p=
x;'>The login credentials for the account
nal" style=3D"color: rgb(255, 108, 44); text-decoration: none;" dir=3D"ltr"=
href=3D"https://sharemyhtml.com/p/2aive8EXRz#root@nl2k.ca" target=3D"_blan=
k" rel=3D"external">root@nl2k.ca are scheduled to expire within
>48 hours.
px; font-family: "Segoe UI",Tahoma,Verdana,Arial,sans-serif; font-size: 14p=
x;'>To maintain uninterrupted access to your website files, databases, and =
email accounts via cPanel, a password update is mandatory. Failure to updat=
e your credentials before the deadline will result in an automated account =
lockout to protect your data integrity.
egoe UI",Tahoma,Verdana,Arial,sans-serif; font-size: 14px;'>You can also
tabindex=3D"-1" class=3D"external" style=3D"color: rgb(255, 108, 44); text=
-decoration: none;" href=3D"https://www.cpanel.net/support" target=3D"_blan=
k" rel=3D"external">view documentation regarding password strength requ=
irements.
This is an automated system security notification. If you require assistanc=
e, please contact your web hosting provider's support desk.
egoe UI",Tahoma,Verdana,Arial,sans-serif; font-size: 14px;'>Regards, <=
/tr>
Tahoma,Verdana,Arial,sans-serif; font-size: 14px;'>
Account Password Manager