WEbroot phish from Google Gmail
Posted by Dave Yadallee on
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Tue, 31 Mar 2026 06:43:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))
(envelope-from)
id 1w7YQq-00000000C36-3C5J
for dave@doctor.nl2k.ab.ca;
Tue, 31 Mar 2026 06:42:56 -0600
Resent-From: The Doctor
Resent-Date: Tue, 31 Mar 2026 06:42:56 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-ua1-f74.google.com ([209.85.222.74]:46157)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.98.2 (FreeBSD))
(envelope-from)
id 1w7YBU-00000000Hdh-1z2Z
for doctor@nl2k.ab.ca;
Tue, 31 Mar 2026 06:27:14 -0600
Received: by mail-ua1-f74.google.com with SMTP id a1e0cc1a2514c-953adc55a49so4911077241.0
for; Tue, 31 Mar 2026 05:26:16 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=google.com; s=20251104; t=1774959970; x=1775564770; darn=nl2k.ab.ca;
h=to:from:subject:date:message-id:sender:reply-to:mime-version:from
:to:cc:subject:date:message-id:reply-to;
bh=dxTZDYh+h/9xRNnyUSuJzxJg3cmMXGGVSd1m5YNSh5Y=;
b=Fn3VsJrEI8Q2M0mCqKiKyaDh9VhbK0aqhiqKzhRedB8ThbanDzbjVyfaE/xAUQgnoj
xZcsdeiH8MsSoR/2x+du8LZWAg9p/02U/cgNcUjSm/upINhd+mEHDtwDf6JraoQMsI+d
jsN7P778FM9mvjb7Fg/yiwJay2aoSs/DJzatdrAoKqbkBhMfn6/+8Z21hp20X9XqCza8
X+ruC+IibXwDU49TlFXM3nKibEaoTjTHJvADmpUvMowChZfhFrT1/+mucLH2DBJq2k83
ezrT5lqtYV/6fojiAlPwgYfF378inC24GO89tzCIXptwgWiK71H9A+a0giBoS3V0mu/A
Rs4w==
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=elderring-com.20230601.gappssmtp.com; s=20230601; t=1774959970; x=1775564770; darn=nl2k.ab.ca;
h=to:from:subject:date:message-id:sender:reply-to:mime-version:from
:to:cc:subject:date:message-id:reply-to;
bh=dxTZDYh+h/9xRNnyUSuJzxJg3cmMXGGVSd1m5YNSh5Y=;
b=g9Q+C6x4faLEvKY9dlnbo/ch2SakscpF04u5rtmR5LhAy4n4X27gobut0F49nvjTf8
TkXzcDYTaVyBTXrN4bGwUuJSvLSpUQlD//TpyxYQPec7PJyLz07fpfEWcpvGVdw/KxV3
gKneXEOEQE/84lce9ZKh3U+pQlF5MzWUDZKCWvgjNRRMB7hjj6z//N1S80muCk864u9J
Hoa/h/SAaEJQ0MD6iztNvveP1yDVXIVwG57/Ve97OnIRsvFmN7gim6jwPdY06oVWoUVR
aKj5jiiAHVIs4zi3SNVCw3TkAFFlYZ6sl7ORdgXEE9VwYCuvdkPSG4eejZGagZV6gSns
PIXA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20251104; t=1774959970; x=1775564770;
h=to:from:subject:date:message-id:sender:reply-to:mime-version
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
bh=dxTZDYh+h/9xRNnyUSuJzxJg3cmMXGGVSd1m5YNSh5Y=;
b=MbDSoSGl8YmNsg+SkJbctWsFxql5PDJMx1LzbBblB+X7p8G9OZ48V94hk2fjaKq1Te
DI1v/qMG7uSW40BaJkXsEnKeRhTrJnjf1hMhHfqzsRfE2jkHScZtzAxPn9shNeE2pvAJ
sUfHY6IkzGocCI/vQ40HuUNuViLvQNPa/C7KnOXDWqaqlGaFSUV/IOwIsr3immz1WHoF
iqPtG6vnq7t1ckq4AJ4Ucw51yoxde+c+qjbuxOSlaw8odqrmvqoN+p22/0x74s28f31Q
zkC3BvGIG/enKPBxdzZN+wtD98vxBCaxvvnpErXX70aSX+kzlDrXzLS219NfzypxywgZ
WJsQ==
X-Gm-Message-State: AOJu0YzbbXn35vtPtcWb5UVcjHJ9p53RgNgvcAjVGPh7VfWnRy9ZG4Hf
6/AGxqLl8nHUXf+AHvM70QHlGH/9OMKZbvlxjmz2o47cWMpy9mk0G0ACMKTP3g2RrwpEGiJlnbx
ixuCogUQ2kyFgqhUSQdr+L3iLY6Psstv3L4paPXt1BgdvtS9kL3raOuE=
MIME-Version: 1.0
X-Received: by 2002:a05:6122:786:b0:56a:fcbf:8aa4 with SMTP id
71dfb90a1353d-56d4a49e906mr7561649e0c.2.1774959969974; Tue, 31 Mar 2026
05:26:09 -0700 (PDT)
Reply-To: Abigael zvheir
Sender: Google Calendar
Message-ID:
Date: Tue, 31 Mar 2026 12:26:09 +0000
Subject: Invitation: Receipt shows latest records @ Tue Mar 31, 2026 9:26pm
(EDT) (doctor@nl2k.ab.ca)
From: Abigael zvheir
To: doctor@nl2k.ab.ca
Content-Type: multipart/mixed; boundary="000000000000804b89064e511243"
X-Spam_score: 8.4
X-Spam_score_int: 84
X-Spam_bar: ++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Receipt shows latest records Tuesday Mar 31, 2026 â‹… 9:26pm
Eastern Time - New York Webroot Billing details reflect update
Content analysis details: (8.4 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[209.85.222.74 listed in dnsbl.ahbl.org]
[209.85.222.74 listed in dnsbl.ahbl.org]
[209.85.222.74 listed in dnsbl.ahbl.org]
[209.85.222.74 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[209.85.222.74 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[209.85.222.74 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[209.85.222.74 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[209.85.222.74 listed in dnsbl.ahbl.org]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[209.85.222.74 listed in will-spam-for-food.eu.org]
[209.85.222.74 listed in will-spam-for-food.eu.org]
[209.85.222.74 listed in will-spam-for-food.eu.org]
[209.85.222.74 listed in will-spam-for-food.eu.org]
[209.85.222.74 listed in will-spam-for-food.eu.org]
[209.85.222.74 listed in will-spam-for-food.eu.org]
[209.85.222.74 listed in will-spam-for-food.eu.org]
[209.85.222.74 listed in will-spam-for-food.eu.org]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.222.74 listed in list.dnswl.org]
0.3 LONGWORD BODY: Uses overlong words
0.1 TW_ZV BODY: Odd Letter Triples with ZV
0.6 MEGALONGWORD BODY: Uses really overlong words
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.222.74 listed in wl.mailspike.net]
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars
0.6 LONG_INVISIBLE_TEXT Long block of hidden text - bayes poison?
Subject: {SPAM?} Invitation: Receipt shows latest records @ Tue Mar 31, 2026 9:26pm
(EDT) (doctor@nl2k.ab.ca)
Abigael zvheir has invited you to Receipt shows latest records
Title: Receipt shows latest records
When: Tuesday, March 31, 2026 at 19:26
Organizer:
Abigael zvheir
Description: Webroot
Billing details reflect update
Greetings,
We’re grateful for your continued use of System Defense Suite and your trust in Webroot.
Payment Records Hub
Invoice Id: JJJS-5251-HAO
Invoice: System Defense Suite
Support: Four Years
Amount: $355.63
Customer ID: EQ9JYA8FKVYM
Your plan is set to renew automatically on Tuesday, 31 March 2026, ensuring seamless service without any action required from your side.
For any concerns, please contact our billing team at Helpdesk Service 1(808) 420-9637.
Do not reply to this no, as it is not monitored. For support, call 1(808) 420-9637.
Gladly shared,
Kgbostondesigncom Hanan
Copyright ©2026 Company, All rights reserved.
Attendees:
doctor@nl2k.ab.ca
Webroot
Billing details reflect update
Greetings,
We’re grateful for your continued use of System Defense Suite and your trust in Webroot.
Payment Records Hub
Invoice Id: JJJS-5251-HAO
Invoice: System Defense Suite
Support: Four Years
Amount: $355.63
Customer ID: EQ9JYA8FKVYM
Your plan is set to renew automatically on Tuesday, 31 March 2026, ensuring seamless service without any action required from your side.
For any concerns, please contact our billing team at Helpdesk Service 1(808) 420-9637.
Do not reply to this no, as it is not monitored. For support, call 1(808) 420-9637.
Gladly shared,
Kgbostondesigncom Hanan
Copyright ©2026 Company, All rights reserved.
When
Tuesday Mar 31, 2026 ⋅ 9:26pm (Eastern Time - New York)
Organizer
Abigael zvheir
abigaelzvheir@elderring.com
Guests
(Guest list has been hidden at organizer's request)
Reply for doctor@nl2k.ab.ca
Yes
No
Maybe
More options
Invitation from Google Calendar
You are receiving this email because you are an attendee on the event.
Forwarding this invitation could allow any recipient to send a response to the organizer, be added to the guest list, invite others regardless of their own invitation status, or modify your RSVP. Learn more
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Tue, 31 Mar 2026 06:43:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))
(envelope-from
id 1w7YQq-00000000C36-3C5J
for dave@doctor.nl2k.ab.ca;
Tue, 31 Mar 2026 06:42:56 -0600
Resent-From: The Doctor
Resent-Date: Tue, 31 Mar 2026 06:42:56 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-ua1-f74.google.com ([209.85.222.74]:46157)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.98.2 (FreeBSD))
(envelope-from
id 1w7YBU-00000000Hdh-1z2Z
for doctor@nl2k.ab.ca;
Tue, 31 Mar 2026 06:27:14 -0600
Received: by mail-ua1-f74.google.com with SMTP id a1e0cc1a2514c-953adc55a49so4911077241.0
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=google.com; s=20251104; t=1774959970; x=1775564770; darn=nl2k.ab.ca;
h=to:from:subject:date:message-id:sender:reply-to:mime-version:from
:to:cc:subject:date:message-id:reply-to;
bh=dxTZDYh+h/9xRNnyUSuJzxJg3cmMXGGVSd1m5YNSh5Y=;
b=Fn3VsJrEI8Q2M0mCqKiKyaDh9VhbK0aqhiqKzhRedB8ThbanDzbjVyfaE/xAUQgnoj
xZcsdeiH8MsSoR/2x+du8LZWAg9p/02U/cgNcUjSm/upINhd+mEHDtwDf6JraoQMsI+d
jsN7P778FM9mvjb7Fg/yiwJay2aoSs/DJzatdrAoKqbkBhMfn6/+8Z21hp20X9XqCza8
X+ruC+IibXwDU49TlFXM3nKibEaoTjTHJvADmpUvMowChZfhFrT1/+mucLH2DBJq2k83
ezrT5lqtYV/6fojiAlPwgYfF378inC24GO89tzCIXptwgWiK71H9A+a0giBoS3V0mu/A
Rs4w==
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=elderring-com.20230601.gappssmtp.com; s=20230601; t=1774959970; x=1775564770; darn=nl2k.ab.ca;
h=to:from:subject:date:message-id:sender:reply-to:mime-version:from
:to:cc:subject:date:message-id:reply-to;
bh=dxTZDYh+h/9xRNnyUSuJzxJg3cmMXGGVSd1m5YNSh5Y=;
b=g9Q+C6x4faLEvKY9dlnbo/ch2SakscpF04u5rtmR5LhAy4n4X27gobut0F49nvjTf8
TkXzcDYTaVyBTXrN4bGwUuJSvLSpUQlD//TpyxYQPec7PJyLz07fpfEWcpvGVdw/KxV3
gKneXEOEQE/84lce9ZKh3U+pQlF5MzWUDZKCWvgjNRRMB7hjj6z//N1S80muCk864u9J
Hoa/h/SAaEJQ0MD6iztNvveP1yDVXIVwG57/Ve97OnIRsvFmN7gim6jwPdY06oVWoUVR
aKj5jiiAHVIs4zi3SNVCw3TkAFFlYZ6sl7ORdgXEE9VwYCuvdkPSG4eejZGagZV6gSns
PIXA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20251104; t=1774959970; x=1775564770;
h=to:from:subject:date:message-id:sender:reply-to:mime-version
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
bh=dxTZDYh+h/9xRNnyUSuJzxJg3cmMXGGVSd1m5YNSh5Y=;
b=MbDSoSGl8YmNsg+SkJbctWsFxql5PDJMx1LzbBblB+X7p8G9OZ48V94hk2fjaKq1Te
DI1v/qMG7uSW40BaJkXsEnKeRhTrJnjf1hMhHfqzsRfE2jkHScZtzAxPn9shNeE2pvAJ
sUfHY6IkzGocCI/vQ40HuUNuViLvQNPa/C7KnOXDWqaqlGaFSUV/IOwIsr3immz1WHoF
iqPtG6vnq7t1ckq4AJ4Ucw51yoxde+c+qjbuxOSlaw8odqrmvqoN+p22/0x74s28f31Q
zkC3BvGIG/enKPBxdzZN+wtD98vxBCaxvvnpErXX70aSX+kzlDrXzLS219NfzypxywgZ
WJsQ==
X-Gm-Message-State: AOJu0YzbbXn35vtPtcWb5UVcjHJ9p53RgNgvcAjVGPh7VfWnRy9ZG4Hf
6/AGxqLl8nHUXf+AHvM70QHlGH/9OMKZbvlxjmz2o47cWMpy9mk0G0ACMKTP3g2RrwpEGiJlnbx
ixuCogUQ2kyFgqhUSQdr+L3iLY6Psstv3L4paPXt1BgdvtS9kL3raOuE=
MIME-Version: 1.0
X-Received: by 2002:a05:6122:786:b0:56a:fcbf:8aa4 with SMTP id
71dfb90a1353d-56d4a49e906mr7561649e0c.2.1774959969974; Tue, 31 Mar 2026
05:26:09 -0700 (PDT)
Reply-To: Abigael zvheir
Sender: Google Calendar
Message-ID:
Date: Tue, 31 Mar 2026 12:26:09 +0000
Subject: Invitation: Receipt shows latest records @ Tue Mar 31, 2026 9:26pm
(EDT) (doctor@nl2k.ab.ca)
From: Abigael zvheir
To: doctor@nl2k.ab.ca
Content-Type: multipart/mixed; boundary="000000000000804b89064e511243"
X-Spam_score: 8.4
X-Spam_score_int: 84
X-Spam_bar: ++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Receipt shows latest records Tuesday Mar 31, 2026 â‹… 9:26pm
Eastern Time - New York Webroot Billing details reflect update
Content analysis details: (8.4 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[209.85.222.74 listed in dnsbl.ahbl.org]
[209.85.222.74 listed in dnsbl.ahbl.org]
[209.85.222.74 listed in dnsbl.ahbl.org]
[209.85.222.74 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[209.85.222.74 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[209.85.222.74 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[209.85.222.74 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[209.85.222.74 listed in dnsbl.ahbl.org]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[209.85.222.74 listed in will-spam-for-food.eu.org]
[209.85.222.74 listed in will-spam-for-food.eu.org]
[209.85.222.74 listed in will-spam-for-food.eu.org]
[209.85.222.74 listed in will-spam-for-food.eu.org]
[209.85.222.74 listed in will-spam-for-food.eu.org]
[209.85.222.74 listed in will-spam-for-food.eu.org]
[209.85.222.74 listed in will-spam-for-food.eu.org]
[209.85.222.74 listed in will-spam-for-food.eu.org]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.222.74 listed in list.dnswl.org]
0.3 LONGWORD BODY: Uses overlong words
0.1 TW_ZV BODY: Odd Letter Triples with ZV
0.6 MEGALONGWORD BODY: Uses really overlong words
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.222.74 listed in wl.mailspike.net]
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars
0.6 LONG_INVISIBLE_TEXT Long block of hidden text - bayes poison?
Subject: {SPAM?} Invitation: Receipt shows latest records @ Tue Mar 31, 2026 9:26pm
(EDT) (doctor@nl2k.ab.ca)
Abigael zvheir has invited you to Receipt shows latest records
Title: Receipt shows latest records
When: Tuesday, March 31, 2026 at 19:26
Organizer:
Abigael zvheir
Description: Webroot
Billing details reflect update
Greetings,
We’re grateful for your continued use of System Defense Suite and your trust in Webroot.
Payment Records Hub
Invoice Id: JJJS-5251-HAO
Invoice: System Defense Suite
Support: Four Years
Amount: $355.63
Customer ID: EQ9JYA8FKVYM
Your plan is set to renew automatically on Tuesday, 31 March 2026, ensuring seamless service without any action required from your side.
For any concerns, please contact our billing team at Helpdesk Service 1(808) 420-9637.
Do not reply to this no, as it is not monitored. For support, call 1(808) 420-9637.
Gladly shared,
Kgbostondesigncom Hanan
Copyright ©2026 Company, All rights reserved.
Attendees:
doctor@nl2k.ab.ca
Webroot
Billing details reflect update
Greetings,
We’re grateful for your continued use of System Defense Suite and your trust in Webroot.
Payment Records Hub
Invoice Id: JJJS-5251-HAO
Invoice: System Defense Suite
Support: Four Years
Amount: $355.63
Customer ID: EQ9JYA8FKVYM
Your plan is set to renew automatically on Tuesday, 31 March 2026, ensuring seamless service without any action required from your side.
For any concerns, please contact our billing team at Helpdesk Service 1(808) 420-9637.
Do not reply to this no, as it is not monitored. For support, call 1(808) 420-9637.
Gladly shared,
Kgbostondesigncom Hanan
Copyright ©2026 Company, All rights reserved.
When
Tuesday Mar 31, 2026 ⋅ 9:26pm (Eastern Time - New York)
Organizer
Abigael zvheir
abigaelzvheir@elderring.com
Guests
(Guest list has been hidden at organizer's request)
Reply for doctor@nl2k.ab.ca
Yes
No
Maybe
More options
Invitation from Google Calendar
You are receiving this email because you are an attendee on the event.
Forwarding this invitation could allow any recipient to send a response to the organizer, be added to the guest list, invite others regardless of their own invitation status, or modify your RSVP. Learn more