Home Hardware phish from Google Gmail
Posted by Dave Yadallee onEnvelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Mon, 17 Nov 2025 07:19:00 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))
(envelope-from
id 1vL041-00000000Hly-0j7a
for dave@doctor.nl2k.ab.ca;
Mon, 17 Nov 2025 07:18:41 -0700
Resent-From: The Doctor
Resent-Date: Mon, 17 Nov 2025 07:18:41 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-oa1-f72.google.com ([209.85.160.72]:38838)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.98.2 (FreeBSD))
(envelope-from
id 1vKzBB-000000009W9-36J1
for doctor@nk.ca;
Mon, 17 Nov 2025 06:22:08 -0700
Received: by mail-oa1-f72.google.com with SMTP id 586e51a60fabf-3e8986cb2f0so230211fac.3
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=firebaseapp.com; s=20230601; t=1763385669; x=1763990469; darn=nk.ca;
h=to:from:subject:date:message-id:mime-version:from:to:cc:subject
:date:message-id:reply-to;
bh=LShkcY+XyWJgF5uEkhfQUoHzk3hNJeCrDgrWzBH/oK0=;
b=YOV94kPkdQDu9ZCk8JckgYxUe9xuqhUIei8lr/sWR124AYy71mWEzYiHGlLrgER6Yn
qh6lwG4Al17VVHGcykJehUyQKOXY+xAjRfV/7lyR2MTwWU3EjOrNiDElZctaxcwbLotM
whLvVylPJP0cKbjCkc1EwDO64q+VWFkAdz8zmdOxQKWX9xsb9Ekiv1PVsLsfdhwI6MK+
V9gOfE9+nNR/KdB9SRN9DR+YLhKvOJ0FB3Ze7mYRZHLpd2qEu+/ac+eoRb4SzUB7+zIH
xZ+7sPWln/b0EQEc5Hwf26fonn5DYKKSGXk3Q8nGejdX74lDOQy36l7hZKMRxjuW9Hlc
xNFA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20230601; t=1763385669; x=1763990469;
h=to:from:subject:date:message-id:mime-version:x-gm-message-state
:from:to:cc:subject:date:message-id:reply-to;
bh=LShkcY+XyWJgF5uEkhfQUoHzk3hNJeCrDgrWzBH/oK0=;
b=i7d/pM898QHed1m/IJRYVPKagiCnSP5f4sv49W7Bo1ZQegzqe4q4cfG875HfSeN7ow
qWiAhdiM80cy/c0ygjjjeBizo6EoF17+fc7f7J1TUefkMqSmWzlBaX0Q4E4U+YeGuzCb
3FEKjFIntAxF0daZcURmZ/0lzYAhbkJsaQJKAJJ5MJTI2+n8clw160JAylg9Gq1g0zd3
whEzcLmUSG/uBz9sm9oGnYDz0weesH8HA8lUua8e0Lkf1OdsGaOI6/eq2LmtSI24Y0a/
/xydSWbClesYJa+CXXzZ1Ngqwz4sKdnlOTtusJvVj+c4mFnNRWex8f1Jq88M4kTPZRGv
lHUg==
X-Gm-Message-State: AOJu0YzFtOBEt+PPNomhuXHlzIGu9qyt2eqf4pAdqT5VkfA8/kznP7Bt
2Xudrk3/BZtuG7dPC+MogL8T/2u22BMq93SfJeQYnm7LqgkK4od4fKpK1Gs9/eTwc/hMMHkD44v
V3r2rtskhUw==
X-Google-Smtp-Source: AGHT+IH6WZdIiVyCGYPF/FACuBzTm5/RvKLa7gt4zSTRqjtJNPt++qFnPUPlql6evIHRHcWCEqHkPxTw3H7nO8s=
MIME-Version: 1.0
X-Received: by 2002:a05:6870:2312:b0:341:33fb:81fd with SMTP id
586e51a60fabf-3e868e4be62mr3759556fac.2.1763385669220; Mon, 17 Nov 2025
05:21:09 -0800 (PST)
Message-ID: <0000000000006a7b810643ca3836@google.com>
Date: Mon, 17 Nov 2025 13:21:09 +0000
Subject: =?UTF-8?Q?Your_Milwaukee_M18_Cordless_Combo_Kit_Awaits_=2D_Claim?=
=?UTF-8?Q?_Before_It=E2=80=99s_Gone_=F0=9F=8E=81?=
From: =?UTF-8?Q?Home_Hardware_Rewards_Club_=E2=9C=A8?=
To: doctor@nk.ca
Content-Type: multipart/alternative; boundary="0000000000006a7b6e0643ca3833"
X-Spam_score: 10.3
X-Spam_score_int: 103
X-Spam_bar: ++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: 🎠Congratulations, You have been chosen to receive your
Milwaukee M18 Combo Kit - Claim it now Struggle to see the content, click
here Don't want to get emails like this? unsubscribe from our emails
Content analysis details: (10.3 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[209.85.160.72 listed in will-spam-for-food.eu.org]
[209.85.160.72 listed in will-spam-for-food.eu.org]
[209.85.160.72 listed in will-spam-for-food.eu.org]
[209.85.160.72 listed in will-spam-for-food.eu.org]
[209.85.160.72 listed in will-spam-for-food.eu.org]
[209.85.160.72 listed in will-spam-for-food.eu.org]
[209.85.160.72 listed in will-spam-for-food.eu.org]
[209.85.160.72 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[209.85.160.72 listed in dnsbl.ahbl.org]
[209.85.160.72 listed in dnsbl.ahbl.org]
[209.85.160.72 listed in dnsbl.ahbl.org]
[209.85.160.72 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[209.85.160.72 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[209.85.160.72 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[209.85.160.72 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[209.85.160.72 listed in dnsbl.ahbl.org]
2.0 URIBL_CT_SURBL Contains an URL listed in the CT SURBL blocklist
[URI: flixyinsiderforeverytvoffer14.eblink6.com]
2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist
[URI: eblink6.com]
1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist
[URI: eblinks.cc]
0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to
Validity was blocked. See
https://knowledge.validity.com/hc/en-us/articles/20961730681243
for more information.
[209.85.160.72 listed in sa-accredit.habeas.com]
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |
0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The
query to Validity was blocked. See
https://knowledge.validity.com/hc/en-us/articles/20961730681243
for more information.
[209.85.160.72 listed in sa-trusted.bondedsender.org]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |
-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)
[209.85.160.72 listed in wl.mailspike.net]
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[209.85.160.72 listed in bl.score.senderscore.com]
0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to
Validity was blocked. See
https://knowledge.validity.com/hc/en-us/articles/20961730681243
for more information.
[209.85.160.72 listed in bl.score.senderscore.com]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders
1.3 URI_HEX URI: URI hostname has long hexadecimal sequence
0.8 HTML_IMAGE_RATIO_02 BODY: HTML has a low ratio of text to image area
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!
Subject: {SPAM?} =?UTF-8?Q?Your_Milwaukee_M18_Cordless_Combo_Kit_Awaits_=2D_Claim?=
=?UTF-8?Q?_Before_It=E2=80=99s_Gone_=F0=9F=8E=81?=
--0000000000006a7b6e0643ca3833
Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes
Content-Transfer-Encoding: base64
8J+OgSBDb25ncmF0dWxhdGlvbnMsIFlvdSBoYXZlIGJlZW4gY2hvc2VuIHRvIHJlY2VpdmUgeW91
ciBNaWx3YXVrZWUgTTE4ICANCkNvbWJvIEtpdCAtIENsYWltIGl0IG5vdw0KDQoNCg0KU3RydWdn
bGUgdG8gc2VlIHRoZSBjb250ZW50LCBjbGljayBoZXJlDQoNCg0KDQoNCkRvbid0IHdhbnQgdG8g
Z2V0IGVtYWlscyBsaWtlIHRoaXM/IHVuc3Vic2NyaWJlIGZyb20gb3VyIGVtYWlscw0KDQoNCg0K
DQo=
--0000000000006a7b6e0643ca3833
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
ft-com:vml" xmlns:o=3D"urn:schemas-microsoft-com:office:office">
=20
=20
=20
=20
/>=20
1" />=20
=20
=20
=20
=20
=20
=20
=20
=20
=20
rmal; background-color: #ffffff;" class=3D" eb-drag-and-drop-builder">=20
ffffff; line-height: 1px;max-height: 0px; max-width: 0px; opacity: 0; overf=
low: hidden;mso-hide: all; visibility: hidden;">
=F0=9F=8E=81 Congratulations, You have been chosen to receive your Milwauke=
e M18 Combo Kit - Claim it now
role=3D"presentation" style=3D"width:100%;">=20
=20
=20
=3D"0" role=3D"presentation" style=3D"width:100%;">=20
=20
;text-align:center;">=20
=20
-eb_bda5cd93-a797-4b86-94b7-0277627795c0" style=3D"background:#ffffff;backg=
round-color:#ffffff;margin:0px auto;max-width:700px;">=20
cing=3D"0" role=3D"presentation" style=3D"background:#ffffff;background-col=
or:#ffffff;width:100%;">=20
10px 10px;text-align:center;">=20
=20
column-b09accf2-56a0-2305-7be0-c87706a08162" style=3D"font-size:0px;text-al=
ign:left;direction:ltr;display:inline-block;vertical-align:middle;width:100=
%;">=20
ole=3D"presentation" width=3D"100%">=20
0px ;">=20
0" role=3D"presentation" style=3D"" width=3D"100%">=20
fe-8835-4635-beec-28617613b987 mj-text" style=3D"background:transparent;fon=
t-size:0px;padding:10px 15px 10px 15px;word-break:break-word;">=20
serif;font-size:13px;font-weight:normal;line-height:1.6;text-align:left;col=
or:#000000;">=20
y;margin: 0px; word-break: break-word; text-align: center;">
s://flixyinsiderforeverytvoffer14.eblink6.com/openurl?lid=3D654967736185651=
2&nid=3D5136131927310336&" style=3D"text-decoration: underline; mso-line-he=
ight-rule: exactly;" data-eblinkid=3D"6549677361856512">
line-height-rule:exactly;color: #000000;">Struggle to see the content
>, click here<=
/span>=20
=20
=20
=20
=20
=20
=20
=20
=20
=20
=20
=20
=20
=20
=20
=20
=20
=20
=20
role=3D"presentation" style=3D"width:100%;">=20
=20
=20
=3D"0" role=3D"presentation" style=3D"width:100%;">=20
=20
;text-align:center;">=20
=20
ection mjml-section-id1614841174008RAND3404" style=3D"background:transparen=
t;background-color:transparent;margin:0px auto;max-width:700px;">=20
cing=3D"0" role=3D"presentation" style=3D"background:transparent;background=
-color:transparent;width:100%;">=20
px 10px;text-align:center;">=20
=20
column-undefined" style=3D"font-size:0px;text-align:left;direction:ltr;disp=
lay:inline-block;vertical-align:top;width:100%;">=20
ole=3D"presentation" width=3D"100%">=20
x ;">=20
0" role=3D"presentation" style=3D"" width=3D"100%">=20
c94a-ddcc-4b3c-ab53-a91df534c308 eb-image-full-width max-width-100 eb-image=
" style=3D"background:transparent;font-size:0px;padding:0px 0px 0px 0px;wor=
d-break:break-word;">=20
=3D"0" role=3D"presentation" style=3D"min-width:100%;max-width:100%;width:6=
80px;border-collapse:collapse;border-spacing:0px;width:100%;" class=3D"mj-f=
ull-width-mobile">=20
th-mobile">
enurl?lid=3D6549677361856512&nid=3D5136131927310336&" target=3D"_blank" sty=
le=3D"text-decoration: underline;" data-eblinkid=3D"6549677361856512">
alt=3D"" src=3D"https://1e222ed2-fri-14.eblinks.cc/uploads/572660793946931=
2/Screenshot_2025_11_14_at_16_57_32_Good_Ranchers_Survey.png" style=3D"bord=
er:0px solid #3498DB;border-radius:0px;display:block;outline:none;text-deco=
ration:none;height:auto;min-width:100%;width:100%;max-width:100%;font-size:=
13px;max-width:100%;box-sizing: border-box;width:100%;" width=3D"680" heigh=
t=3D"auto" /> =20
=20
176767RAND30514 mj-text" style=3D"background:transparent;font-size:0px;padd=
ing:5px 15px 5px 15px;word-break:break-word;">=20
serif;font-size:13px;font-weight:normal;line-height:1.6;text-align:left;col=
or:#000000;">=20
y;margin: 0px; word-break: break-word; line-height: 1.6; text-align: center=
;">
2px;">
eight-rule:exactly;" />
yle=3D"mso-line-height-rule:exactly;" />Don't want to get emails like this?=
b-unsubscribe-link" style=3D"mso-line-height-rule: exactly; text-decoration=
: none; color: #000000;" href=3D"http://#" target=3D"_blank" rel=3D"noopene=
r">unsubscribe from our emails=20
=20
=20
=20
=20
=20
=20
=20
=20
=20
=20
=20
=20
=20
=20
=20
=20
=20
=20
=20
=20
=20
=20
--0000000000006a7b6e0643ca3833--
