Norton 360 phish from Google Gmail
Posted by Dave Yadallee on
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Mon, 11 May 2026 12:44:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))
(envelope-from)
id 1wMVbS-00000000HHk-0nGl
for dave@doctor.nl2k.ab.ca;
Mon, 11 May 2026 12:43:42 -0600
Resent-From: The Doctor
Resent-Date: Mon, 11 May 2026 12:43:42 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-oo1-f74.google.com ([209.85.161.74]:51363)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.98.2 (FreeBSD))
(envelope-from)
id 1wMV1m-00000000EZN-3jDo
for root@nk.ca;
Mon, 11 May 2026 12:06:59 -0600
Received: by mail-oo1-f74.google.com with SMTP id 006d021491bc7-696906ddd6eso5165950eaf.2
for; Mon, 11 May 2026 11:06:04 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=google.com; s=20251104; t=1778522758; x=1779127558; darn=nk.ca;
h=from:subject:date:message-id:sender:reply-to:mime-version:from:to
:cc:subject:date:message-id:reply-to;
bh=ssYc05F2q0uo3r4JSOkCxFZkLG6RGcbhpNE5vm3trVQ=;
b=eM9KR9nvF2QZKC6YB2DnQ6HbV+Ybl5lhPPSSd314sfYlqE7w7490FhQ8G0bso3tK/V
G1TSeJMJXuqgYpzLu1S4C9GuvJDBj6d5XcSuJF+I6Ls++PlMZhp0GK624I5JRItPTEx0
nSDA7CjHhCM6NrRJigS1PCPV1K3EyW4ZEeGw+zzMeo6J09IrO061KUA0IQKGs2u4DEpZ
N72hl7SJPXUnwLQ8q/cf0WnJ99BC27gBxnAwbY0WAdOdylTOIfSe5Ad4OlJ0/2CLBcvZ
ZJfG6rWpAVJdBJUOSiqqQx8Jp7JBpyPXtm0lsJE/3tZVnhYkeyJ9oUT2e0rixepxxo2Y
0teg==
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=mailvora-org.20251104.gappssmtp.com; s=20251104; t=1778522758; x=1779127558; darn=nk.ca;
h=from:subject:date:message-id:sender:reply-to:mime-version:from:to
:cc:subject:date:message-id:reply-to;
bh=ssYc05F2q0uo3r4JSOkCxFZkLG6RGcbhpNE5vm3trVQ=;
b=MYP2LF74eHWZnsPdqHNMdVdUjUFlZB9BUGyt461j8NUUtFXNc49MwnAwdKbN1CgJVZ
aFge+d2ljIfwGHwIgXBUKs6GIdXoTJ0oYObMjeCPUqQINkd+7tc/Iv8DMUILsm2NTvHb
PWeb3rpUTJpHazG9P4V4zJkP1LFYXu8PjrbJSGFU5tIZntM1FY+GzADanVEP5337j8CB
hNB+KdG/v6fkA5fI7H1DIuyuG9L9bbsQxOPOCAUTXENk55ROu3ApDwIVZbaisJAw9xzV
x8Ko9qGtgHhqMRhQZkHF497tH4MiGYHRUlWewHXfbvDK2Uj6G4kyqf4vkoSjuhB6kS6d
/glw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20251104; t=1778522758; x=1779127558;
h=from:subject:date:message-id:sender:reply-to:mime-version
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
bh=ssYc05F2q0uo3r4JSOkCxFZkLG6RGcbhpNE5vm3trVQ=;
b=WduUUnr23wgAu7bEmDHfkcAmeb8ERZhmgmhKv7lZIqP759fTFaEH2pMCa1XPLnd99i
ALb3FftN0qXAvAA168/Ej/46OFlv41BxKAk9+h7dbJwy4rFvg5EZ1I/xST2LzaklCvKB
sDfBiSoMt/C6VQTWY6GpRLSCs1sFzWBKvlR9i9M2E37ymd4unCD7Eq5YBL223jIdWzSK
Sdj9HFi7Pnn5FZjI/hFIt9tm1Kr3L/lpPhyesv7utsRqovyljzNDDU0OsWnHCNSqiVAS
HbSzu8xfvIsseQp3yy+/XUpIdMOM5U1+8EXfC4mzQQ0XVX7YJinXQsrBeFRX68NQgzd4
LSAA==
X-Forwarded-Encrypted: i=1; AFNElJ+g7VSrWQM6WTjV3iwEKAhphJfr6xFgpTSwT4MsgWgipWo/gx3+fzIihy88nt2F5b+a0Jj2@nk.ca
X-Gm-Message-State: AOJu0Yz3bIrpL6Tlh6sx9JR2JpIzX6iiWid+Ld35LqVkSDVM6FIfyq9I
lDCAJ2TKFbLmrTmwFKvTYkQX3QXnq53hfEblEo/fTczjP/hiQavXUhhE0xJlPhQNLoKzu0aFsDo
xmLgJ9E7B03J1DVShO/zMf4ENtl52a/QFk2CD+SD8DBGrkg==
MIME-Version: 1.0
X-Received: by 2002:a05:6820:1b08:b0:695:3a00:853c with SMTP id
006d021491bc7-69998c9581cmt14337978eaf.12.1778522757439; Mon, 11 May 2026
11:05:57 -0700 (PDT)
Reply-To: no reply
Sender: Google Calendar
Message-ID:
Date: Mon, 11 May 2026 18:05:57 +0000
Subject: #ABC_123(6)
From: no reply
Content-Type: multipart/alternative; boundary="000000000000327c4606518e99d0"
X-Spam_score: 7.1
X-Spam_score_int: 71
X-Spam_bar: +++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: #ABC_123(6) #ABC_123(6) Tuesday May 12, 2026 â‹… 3:05am Eastern
Time - New York Your current subscription linked with Norton 360 is set to
renew on Tuesday, 12 May 2026.
Content analysis details: (7.1 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[209.85.161.74 listed in dnsbl.ahbl.org]
[209.85.161.74 listed in dnsbl.ahbl.org]
[209.85.161.74 listed in dnsbl.ahbl.org]
[209.85.161.74 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[209.85.161.74 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[209.85.161.74 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[209.85.161.74 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[209.85.161.74 listed in dnsbl.ahbl.org]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[209.85.161.74 listed in will-spam-for-food.eu.org]
[209.85.161.74 listed in will-spam-for-food.eu.org]
[209.85.161.74 listed in will-spam-for-food.eu.org]
[209.85.161.74 listed in will-spam-for-food.eu.org]
[209.85.161.74 listed in will-spam-for-food.eu.org]
[209.85.161.74 listed in will-spam-for-food.eu.org]
[209.85.161.74 listed in will-spam-for-food.eu.org]
[209.85.161.74 listed in will-spam-for-food.eu.org]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.161.74 listed in list.dnswl.org]
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |]
1.2 MISSING_HEADERS Missing To: header
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[209.85.161.74 listed in bl.score.senderscore.com]
-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)
[209.85.161.74 listed in wl.mailspike.net]
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam
2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars
1.9 REPLYTO_WITHOUT_TO_CC No description available.
-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders
0.6 LONG_INVISIBLE_TEXT Long block of hidden text - bayes poison?
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
Subject: {SPAM?} #ABC_123(6)
#ABC_123(6)
#ABC_123(6)
#ABC_123(6)
Tuesday May 12, 2026 ⋅ 3:05am (Eastern Time - New York)
Your current subscription linked with Norton 360 is set to renew on Tuesday, 12 May 2026.
An automatic charge of USD401.77 will be applied. For help, call 1 856 353-0411.
Receipt Overview
Plan: Full Membership
Devices: x2
Length: 60 Months Year(s)
Payment: Auto Pay
Amount Due: USD401.77
Reference: N88B3NQZXW
Auth Code: 39e2459a-32c5-4f1b-be1f-f4cbd532f74b
Ensure updates or cancellation 48 hours before renewal.
Support: 1 856 353-0852
Guests
(Guest list has been hidden at organizer's request)
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Mon, 11 May 2026 12:44:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))
(envelope-from
id 1wMVbS-00000000HHk-0nGl
for dave@doctor.nl2k.ab.ca;
Mon, 11 May 2026 12:43:42 -0600
Resent-From: The Doctor
Resent-Date: Mon, 11 May 2026 12:43:42 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-oo1-f74.google.com ([209.85.161.74]:51363)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.98.2 (FreeBSD))
(envelope-from
id 1wMV1m-00000000EZN-3jDo
for root@nk.ca;
Mon, 11 May 2026 12:06:59 -0600
Received: by mail-oo1-f74.google.com with SMTP id 006d021491bc7-696906ddd6eso5165950eaf.2
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=google.com; s=20251104; t=1778522758; x=1779127558; darn=nk.ca;
h=from:subject:date:message-id:sender:reply-to:mime-version:from:to
:cc:subject:date:message-id:reply-to;
bh=ssYc05F2q0uo3r4JSOkCxFZkLG6RGcbhpNE5vm3trVQ=;
b=eM9KR9nvF2QZKC6YB2DnQ6HbV+Ybl5lhPPSSd314sfYlqE7w7490FhQ8G0bso3tK/V
G1TSeJMJXuqgYpzLu1S4C9GuvJDBj6d5XcSuJF+I6Ls++PlMZhp0GK624I5JRItPTEx0
nSDA7CjHhCM6NrRJigS1PCPV1K3EyW4ZEeGw+zzMeo6J09IrO061KUA0IQKGs2u4DEpZ
N72hl7SJPXUnwLQ8q/cf0WnJ99BC27gBxnAwbY0WAdOdylTOIfSe5Ad4OlJ0/2CLBcvZ
ZJfG6rWpAVJdBJUOSiqqQx8Jp7JBpyPXtm0lsJE/3tZVnhYkeyJ9oUT2e0rixepxxo2Y
0teg==
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=mailvora-org.20251104.gappssmtp.com; s=20251104; t=1778522758; x=1779127558; darn=nk.ca;
h=from:subject:date:message-id:sender:reply-to:mime-version:from:to
:cc:subject:date:message-id:reply-to;
bh=ssYc05F2q0uo3r4JSOkCxFZkLG6RGcbhpNE5vm3trVQ=;
b=MYP2LF74eHWZnsPdqHNMdVdUjUFlZB9BUGyt461j8NUUtFXNc49MwnAwdKbN1CgJVZ
aFge+d2ljIfwGHwIgXBUKs6GIdXoTJ0oYObMjeCPUqQINkd+7tc/Iv8DMUILsm2NTvHb
PWeb3rpUTJpHazG9P4V4zJkP1LFYXu8PjrbJSGFU5tIZntM1FY+GzADanVEP5337j8CB
hNB+KdG/v6fkA5fI7H1DIuyuG9L9bbsQxOPOCAUTXENk55ROu3ApDwIVZbaisJAw9xzV
x8Ko9qGtgHhqMRhQZkHF497tH4MiGYHRUlWewHXfbvDK2Uj6G4kyqf4vkoSjuhB6kS6d
/glw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20251104; t=1778522758; x=1779127558;
h=from:subject:date:message-id:sender:reply-to:mime-version
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
bh=ssYc05F2q0uo3r4JSOkCxFZkLG6RGcbhpNE5vm3trVQ=;
b=WduUUnr23wgAu7bEmDHfkcAmeb8ERZhmgmhKv7lZIqP759fTFaEH2pMCa1XPLnd99i
ALb3FftN0qXAvAA168/Ej/46OFlv41BxKAk9+h7dbJwy4rFvg5EZ1I/xST2LzaklCvKB
sDfBiSoMt/C6VQTWY6GpRLSCs1sFzWBKvlR9i9M2E37ymd4unCD7Eq5YBL223jIdWzSK
Sdj9HFi7Pnn5FZjI/hFIt9tm1Kr3L/lpPhyesv7utsRqovyljzNDDU0OsWnHCNSqiVAS
HbSzu8xfvIsseQp3yy+/XUpIdMOM5U1+8EXfC4mzQQ0XVX7YJinXQsrBeFRX68NQgzd4
LSAA==
X-Forwarded-Encrypted: i=1; AFNElJ+g7VSrWQM6WTjV3iwEKAhphJfr6xFgpTSwT4MsgWgipWo/gx3+fzIihy88nt2F5b+a0Jj2@nk.ca
X-Gm-Message-State: AOJu0Yz3bIrpL6Tlh6sx9JR2JpIzX6iiWid+Ld35LqVkSDVM6FIfyq9I
lDCAJ2TKFbLmrTmwFKvTYkQX3QXnq53hfEblEo/fTczjP/hiQavXUhhE0xJlPhQNLoKzu0aFsDo
xmLgJ9E7B03J1DVShO/zMf4ENtl52a/QFk2CD+SD8DBGrkg==
MIME-Version: 1.0
X-Received: by 2002:a05:6820:1b08:b0:695:3a00:853c with SMTP id
006d021491bc7-69998c9581cmt14337978eaf.12.1778522757439; Mon, 11 May 2026
11:05:57 -0700 (PDT)
Reply-To: no reply
Sender: Google Calendar
Message-ID:
Date: Mon, 11 May 2026 18:05:57 +0000
Subject: #ABC_123(6)
From: no reply
Content-Type: multipart/alternative; boundary="000000000000327c4606518e99d0"
X-Spam_score: 7.1
X-Spam_score_int: 71
X-Spam_bar: +++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: #ABC_123(6) #ABC_123(6) Tuesday May 12, 2026 â‹… 3:05am Eastern
Time - New York Your current subscription linked with Norton 360 is set to
renew on Tuesday, 12 May 2026.
Content analysis details: (7.1 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[209.85.161.74 listed in dnsbl.ahbl.org]
[209.85.161.74 listed in dnsbl.ahbl.org]
[209.85.161.74 listed in dnsbl.ahbl.org]
[209.85.161.74 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[209.85.161.74 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[209.85.161.74 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[209.85.161.74 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[209.85.161.74 listed in dnsbl.ahbl.org]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[209.85.161.74 listed in will-spam-for-food.eu.org]
[209.85.161.74 listed in will-spam-for-food.eu.org]
[209.85.161.74 listed in will-spam-for-food.eu.org]
[209.85.161.74 listed in will-spam-for-food.eu.org]
[209.85.161.74 listed in will-spam-for-food.eu.org]
[209.85.161.74 listed in will-spam-for-food.eu.org]
[209.85.161.74 listed in will-spam-for-food.eu.org]
[209.85.161.74 listed in will-spam-for-food.eu.org]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.161.74 listed in list.dnswl.org]
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |
1.2 MISSING_HEADERS Missing To: header
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[209.85.161.74 listed in bl.score.senderscore.com]
-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)
[209.85.161.74 listed in wl.mailspike.net]
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam
2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars
1.9 REPLYTO_WITHOUT_TO_CC No description available.
-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders
0.6 LONG_INVISIBLE_TEXT Long block of hidden text - bayes poison?
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
Subject: {SPAM?} #ABC_123(6)
#ABC_123(6)
#ABC_123(6)
#ABC_123(6)
Tuesday May 12, 2026 ⋅ 3:05am (Eastern Time - New York)
Your current subscription linked with Norton 360 is set to renew on Tuesday, 12 May 2026.
An automatic charge of USD401.77 will be applied. For help, call 1 856 353-0411.
Receipt Overview
Plan: Full Membership
Devices: x2
Length: 60 Months Year(s)
Payment: Auto Pay
Amount Due: USD401.77
Reference: N88B3NQZXW
Auth Code: 39e2459a-32c5-4f1b-be1f-f4cbd532f74b
Ensure updates or cancellation 48 hours before renewal.
Support: 1 856 353-0852
Guests
(Guest list has been hidden at organizer's request)