Cloud Phishing from Google Gmail Part 2

Posted by Dave Yadallee on Wednesday, March 11. 2026

.h1 {

font-size: 20px;

font-weight: 700;

color: #1e293b;

margin: 0 0 15px 0;

text-align: center;

}

.danger-box {

border: 1px solid #fecaca;

background: #fef2f2;

border-radius: 8px;

padding: 20px;

margin-bottom: 25px;

}

.danger-title {

color: #dc2626;

font-weight: 800;

font-size: 14px;

text-transform: uppercase;

letter-spacing: 0.5px;

margin-bottom: 10px;

}

.danger-text {

color: #7f1d1d;

font-size: 15px;

line-height: 1.5;

}

.files-box {

background: #f8fafc;

border-radius: 8px;

padding: 15px;

border: 1px solid #e2e8f0;

}

.file-row {

display: flex;

justify-content: space-between;

padding: 10px 0;

border-bottom: 1px solid #e2e8f0;

font-size: 14px;

color: #334155;

}

.file-row:last-child {

border-bottom: none;

}

.file-label {

display: flex;

align-items: center;

gap: 8px;

}

.file-stat {

font-weight: 600;

color: #0f172a;

}

.btn {

display: block;

width: 100%;

background: #2563eb;

color: #fff;

text-decoration: none;

padding: 16px;

text-align: center;

border-radius: 8px;

font-weight: 700;

font-size: 16px;

margin-top: 30px;

}

.footer {

text-align: center;

padding: 20px;

font-size: 11px;

color: #94a3b8;

}

Scheduled for Deletion

Your account has been inactive and over-limit. Per our retention policy, your files are scheduled to be

removed.

Permanent Data Loss

If you do not renew your storage plan by , your data

will be permanently deleted from our servers.

Photos & Videos

At Risk

Documents

At Risk

Cloud Backups

Stopped

Keep My Files

--0000000000007d256b064cb61704--

Cloud Phishing from Google Gmail Part 1

Posted by Dave Yadallee on Wednesday, March 11. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 10 Mar 2026 20:47:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1w09aP-00000000Htl-3mUT

for dave@doctor.nl2k.ab.ca;

Tue, 10 Mar 2026 20:46:13 -0600

Resent-From: The Doctor

Resent-Date: Tue, 10 Mar 2026 20:46:13 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-oi1-f198.google.com ([209.85.167.198]:54337)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1w08zM-00000000FlP-1hat

for root@nk.ca;

Tue, 10 Mar 2026 20:08:04 -0600

Received: by mail-oi1-f198.google.com with SMTP id 5614622812f47-466f705757bso12585436b6e.0

for ; Tue, 10 Mar 2026 19:07:08 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=firebaseapp.com; s=20230601; t=1773194822; x=1773799622; darn=nk.ca;

h=to:from:subject:date:message-id:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=SNrpzYCWyZa6/z6RGb4LFgP1/5b5y989iVf7pzQIH7Y=;

b=IjFNsz/b5UrrpW3OjlcKGaYBkaNuEk5TASsMnMMGiUdR15G327g65TmhhPGIGp0fFw

E4ZOVywJBqTVFsi+dji8Q66GubO6bsLL8o1V8WXO8C4jYmUTU3YE9E1USa6iPIt26gSg

T7Lk0GVaKskPt1QR+mDazboJy5aAyAe85QvheV+CAgZnOZoKg65E1NpTwXNPOEcgRXAm

ZBuGbzAO+my1OhiMjmBitDA+NF6DJXDpf0z3Sh7lEZBB7eOHsYKcKu81YeIBMV9tJAaA

8j12YXB/qywrSIdLPr/RBfHkPkZdvWv8YdAhCwyJsLTlVkBEcZM3vldEa6TWvuTVbcm/

rWCQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1773194822; x=1773799622;

h=to:from:subject:date:message-id:mime-version:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=SNrpzYCWyZa6/z6RGb4LFgP1/5b5y989iVf7pzQIH7Y=;

b=RcKaxj5ZsYaR7LfqEUVgoYhxWt81wqzLBLQPUSnbIaGU1tB4l3eTqY4oYdQWSe78zZ

Fm5fS+8CkIPX+yzgoCa3+mXlhzV9+wATG/FBtdkpMUhKn1XMPGcDjpolyG1tlolAmUds

XqOTU+cApmSdDLJ1U1vESJzpX4L52Njac8VadoeoTGneJuJ1ZwoH6AnKl+gNBB0ZWY1C

T9ayyd/36zNehVgmqHfYsGJDvcQNYuWgRSzO4hi7Y3LKIz67Y/60EhACBY/x9c3nqh89

jOPFnu4wO/0S/JZv+BuDz5F3lnTI93zreCTDsIGbbdyWfEmLDNfR+8iRwFA07jrU055d

Kk6g==

X-Gm-Message-State: AOJu0YxgMLs+CbVZOOpQsIS06/HShKNlLIR9GePwhYSG3ad5YATIMBsP

bVUYwduaCU3O/dpXs2XvfBdNG/WtcV9bDK6owbRAMEwgOlzeLpz4lB/uByLFAKSKQ1TpC+XwQZ6

YYg9Z/z6Wrw==

MIME-Version: 1.0

X-Received: by 2002:a05:6820:290a:b0:672:9d81:a765 with SMTP id

006d021491bc7-67bc8a6e27cmr859558eaf.65.1773194822099; Tue, 10 Mar 2026

19:07:02 -0700 (PDT)

Message-ID: <0000000000007d2575064cb61707@google.com>

Date: Wed, 11 Mar 2026 02:07:02 +0000

Subject: Service Termination Notice

From: Cloud Services

To: root@nk.ca

Content-Type: multipart/alternative; boundary="0000000000007d256b064cb61704"

--0000000000007d256b064cb61704

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes

Cloud

Scheduled for Deletion

Your account has been inactive and over-limit. Per our retention policy,

your files are scheduled to be removed.

Permanent Data Loss

If you do not renew your storage plan by , your data will be permanently

deleted from our servers.

Photos & Videos

At Risk

Documents

At Risk

Cloud Backups

Stopped

Keep My Files

Unsubscribe

--0000000000007d256b064cb61704

Content-Type: text/html; charset="UTF-8"

Data Deletion Warning

Scheduled for Deletion

Your account has been inactive and over-limit. Per our retention policy, your files are scheduled to be

removed.

Permanent Data Loss

If you do not renew your storage plan by , your data

will be permanently deleted from our servers.

Photos & Videos

At Risk

Documents

At Risk

Cloud Backups

Stopped

Keep My Files

--00000000000024f9a6064caf89aa--

Serivces termincation phish from Google Gmail Part 1

Posted by Dave Yadallee on Tuesday, March 10. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 10 Mar 2026 13:58:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1w03Cy-00000000D44-2iWa

for dave@doctor.nl2k.ab.ca;

Tue, 10 Mar 2026 13:57:36 -0600

Resent-From: The Doctor

Resent-Date: Tue, 10 Mar 2026 13:57:36 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-oo1-f72.google.com ([209.85.161.72]:61914)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1w01fC-000000006N6-3MOu

for sales@nk.ca;

Tue, 10 Mar 2026 12:18:47 -0600

Received: by mail-oo1-f72.google.com with SMTP id 006d021491bc7-67bb368c757so34162143eaf.3

for ; Tue, 10 Mar 2026 11:17:50 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=firebaseapp.com; s=20230601; t=1773166664; x=1773771464; darn=nk.ca;

h=to:from:subject:date:message-id:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=/QHwo6deAppmBRyaByEXCK5++/H0IKbxgBMx/r7kNnk=;

b=ac5H5Q8lg40mGNEmbGXoDZJjrEVpSTdrihIFYoosfTY3fMft3vDqdVTK0E2I3LSHj2

6HGwWhc5EKj/+Hsj+6e/YFYIwZ+J8c+dzoHWZ7dc9YhBxq60nCgpSfHUfUNrao10xZaV

U1CjU6zcZ6c78U8/pfBWnWq9ys5XlOapkx2oGpZbsQkIn8mt9GETVrrlCcpvTaiwGAVb

cubX+y0kw4gBCzmBYwF5W9OZWnbH+QRQC20t+0pU8TH1q988kqyptrLpt+bjLc65H0AR

YwpQfaRwEoB5PdmzhR4GTzgIxBP6eyshRADrnwXlDz0SMW0aJ7QbTr8MO0OhdGToYvKu

NfDg==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1773166664; x=1773771464;

h=to:from:subject:date:message-id:mime-version:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=/QHwo6deAppmBRyaByEXCK5++/H0IKbxgBMx/r7kNnk=;

b=BeQQiBNsH54Sz4m2dQA1YwcOxmILaWLV0fSzIC1BY1scuyb8G2vnkW8o9+wnxKYD6g

BO0+jABvaxBXbv0eBFA86AmudHDV2xVO2Df1ewsobG6Xyic02PQ7wYa0svsSSqWDU6br

0bii2rCxmzr7J9DhPpq6WCtPQK083U5sCaboSKFd+JoqnwjzcJI/gTEMh7ldCSuNhX3b

ezedC90TVxWGcebTLYQOUJ+UNst4RYBwlLz6H+v0FnhfUz/lOuv6/nYvaRkcDJfUEGvy

BITvlItT6W2TYpZ/QY4+7A7twY5lgt2iaSpoBgAaggpqD3Gqj6WRaIcGZfjVcO/xZ6DL

Uk5A==

X-Gm-Message-State: AOJu0YyvSRdQ3TGaKNss9OKgpe66fIbs7kYJ1wWbPqpiv6ubor+lKSLc

nuO+df9e6taxrNvaOALFmVT3sKbcSkg+fl3WzjgUwZvFAMacVCi8ZI3Kl/fBH6haxMcMcsBkFGU

12McpRULgmQ==

MIME-Version: 1.0

X-Received: by 2002:a05:6820:480f:b0:67b:bf52:9990 with SMTP id

006d021491bc7-67bbf529cb0mr1624042eaf.58.1773166664152; Tue, 10 Mar 2026

11:17:44 -0700 (PDT)

Message-ID: <00000000000024f9bb064caf89ad@google.com>

Date: Tue, 10 Mar 2026 18:17:44 +0000

Subject: Service Termination Notice

From: Cloud Services

To: sales@nk.ca

Content-Type: multipart/alternative; boundary="00000000000024f9a6064caf89aa"

X-Spam_score: 6.0

X-Spam_score_int: 60

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Cloud Scheduled for Deletion Your account has been inactive

and over-limit. Per our retention policy, your files are scheduled to be

removed.

Content analysis details: (6.0 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.161.72 listed in will-spam-for-food.eu.org]

[209.85.161.72 listed in will-spam-for-food.eu.org]

[209.85.161.72 listed in will-spam-for-food.eu.org]

[209.85.161.72 listed in will-spam-for-food.eu.org]

[209.85.161.72 listed in will-spam-for-food.eu.org]

[209.85.161.72 listed in will-spam-for-food.eu.org]

[209.85.161.72 listed in will-spam-for-food.eu.org]

[209.85.161.72 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.161.72 listed in dnsbl.ahbl.org]

[209.85.161.72 listed in dnsbl.ahbl.org]

[209.85.161.72 listed in dnsbl.ahbl.org]

[209.85.161.72 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.161.72 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.161.72 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.161.72 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.161.72 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.161.72 listed in wl.mailspike.net]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam

1.0 VOWEL_URI_5 URI hostname with 5 consecutive vowels

Subject: {SPAM?} Service Termination Notice

--00000000000024f9a6064caf89aa

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes

Cloud

Scheduled for Deletion

Your account has been inactive and over-limit. Per our retention policy,

your files are scheduled to be removed.

Permanent Data Loss

If you do not renew your storage plan by , your data will be permanently

deleted from our servers.

Photos & Videos

At Risk

Documents

At Risk

Cloud Backups

Stopped

Keep My Files

Unsubscribe

--00000000000024f9a6064caf89aa

Content-Type: text/html; charset="UTF-8"

Data Deletion Warning

link=3D"#0563C1" vlink=3D"#954F72">

class=3DMsoNormal style=3D'text-autospace:none'>
style=3D'color:black'>Hi,