Nk.CA credential phishing to Google Gmail
Posted by Dave Yadallee onX-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Tue, 25 Aug 2026 07:46:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))
(envelope-from
id 1wyrSh-00000000CR1-3IFW
for dave@doctor.nl2k.ab.ca;
Tue, 25 Aug 2026 07:45:11 -0600
Resent-From: The Doctor
Resent-Date: Tue, 25 Aug 2026 07:45:11 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-ot1-f103.google.com ([209.85.210.103]:43434)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.100 (FreeBSD))
(envelope-from
id 1wylJv-000000008Xy-0cmD
for root@nl2k.ab.ca;
Tue, 25 Aug 2026 01:11:51 -0600
Received: by mail-ot1-f103.google.com with SMTP id 46e09a7af769-7ee4f241f42so447466a34.1
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=brushme.com.ua; s=google; t=1787641802; x=1788246602; darn=nl2k.ab.ca;
h=content-transfer-encoding:content-type:mime-version:message-id:date
:subject:to:from:from:to:cc:subject:date:message-id:reply-to
:content-type;
bh=yygeFoTg4U6V/0mVjOueeTqvRKSLqeJTOr+D9s3WyKE=;
b=Ixnc6Q+3BRgobdAjvycUOFJXr4MtpFRDbpsLgme0/UE+NufZDLrukuR1YQZ96HuZvg
hQEibl5vJoNTTxnD3vN5818oPB/ku8YI1AeVo7dbP170RdC8pHLnsEfOsAhom3067W+k
y9kV8MkFA99qxS1N+hBmMSAaez7KmU+ccdt1xrXSCcB7KX1AYs6JbUAg3hh7yM4e1PPR
R7JAadWLz51RfCe35A1TMTxCTRzjUKce6gPq+QLNlb2NANwdtZsu1PqOIkNKfuSqRWl+
xXQKaF128pMYbraI4pHn9LB8Lgu17MTe/yucG8r3l2OLRh+uKEVmS6+n8EEM54mZuuEa
HpFw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20251104; t=1787641802; x=1788246602;
h=content-transfer-encoding:content-type:mime-version:message-id:date
:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date
:message-id:reply-to:content-type;
bh=yygeFoTg4U6V/0mVjOueeTqvRKSLqeJTOr+D9s3WyKE=;
b=V7U/HHMHEOIcDY/i4sjCpPW7GRt+B2vJxw6BgO+pV57yaq+3eJQgtKQZ6RTVQKArqL
WuQd5Wku2YLoXhS+w5jTkon89NWTIJjZ4GGrFUflWUhGaQ1opmjAsuDTSLelzFJOmu9s
4jYXgjdHlnOjoLlfODGuRJtzJyU6rox6Bdd7RS0vEqxnbB1JzcZTzTXWXD7HNNZejNPv
aS9IRcf3VzOyob2brdzXQdK7xsZhIZ+4NhTRG2mtUEoEFPGZcohJh8gHAHUnDsvBlRSE
920/Wjh3njg1An5jmvebEkL+cZzGVY3dsK2QjsJmfJw2arkZpZRqhWOgxJNUQCJEXxF2
Ce1A==
X-Gm-Message-State: AFuF++mGXD/dKJhbUx6Zk8eZYXUY3HWnHPw7c6N2G4nmng/84zAfz273
bEPbXLfW2FclJxYmgiTTsOMo0U/C7b+GmIF+iNZTkmeN1q2gKTCYpJJdGGLFdhT2cLn69E8+Dfk
KEPk5fb/VM/VV2/OFashoZkv85mBc79Cyq0wKpL5xCeLG3z4=
X-Gm-Gg: AR+sD11yfDDm5CQ/iqHEMh4te02Np0jB4luRud6DN6vh6GIGsCUjSQun2/c22TFJdu7
i7lezgXmw4B//vdBZCq7sfUxWOqXkD9xOM0LdYs1gJpt9cCrtSnD/86PyYU4VAaOl/Yy1MK6WYk
fepA37Kr26MMJym9svfa5UidaV6xBwHNAKB7XJrzhw9wnQpSQb912sdDXdlO0qSIMljtFm8qGLt
88YJ4VlqCXan58u+cu1Tyx24SvLK3r8KJXtVDbw8a92ZzsiKipUreKwRl2U+h3dfhi0X4tf3VRU
6HdtNsoO2rSQSTeZZRGFHN+xIvjFEo2f7jgF2HZk/9dfl8ZM0WrR3oQA4XReM0eaQudQM9J5PMb
g82INJrlQCaygH9VIHgPq
X-Received: by 2002:a05:6830:1b73:b0:7f3:daf9:eda3 with SMTP id 46e09a7af769-7f4aebe890amr2798782a34.4.1787641801928;
Tue, 25 Aug 2026 00:10:01 -0700 (PDT)
Received: from brushme.com.ua ([192.3.96.79])
by smtp-relay.gmail.com with ESMTP id 46e09a7af769-7f4b8d32377sm46824a34.7.2026.08.25.00.10.01
for
Tue, 25 Aug 2026 00:10:01 -0700 (PDT)
X-Relaying-Domain: brushme.com.ua
From: IT Helpdesk
To: root@nl2k.ab.ca
Subject: Email Account Deactivation in progress
Date: 25 Aug 2026 00:10:01 -0700
Message-ID: <20260825001001.63E370AE382F267C@brushme.com.ua>
MIME-Version: 1.0
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
X-Spam_score: 9.8
X-Spam_score_int: 98
X-Spam_bar: +++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Email Services Shutdown in Progress The mailbox root@nl2k.ab.ca
has a pending deactivation request scheduled within 24 hours. A request was
received to deactivate this mailbox. If this action was initiated by you,
no further steps are required.
Content analysis details: (9.8 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[192.3.96.79 listed in will-spam-for-food.eu.org]
[192.3.96.79 listed in will-spam-for-food.eu.org]
[192.3.96.79 listed in will-spam-for-food.eu.org]
[192.3.96.79 listed in will-spam-for-food.eu.org]
[192.3.96.79 listed in will-spam-for-food.eu.org]
[192.3.96.79 listed in will-spam-for-food.eu.org]
[192.3.96.79 listed in will-spam-for-food.eu.org]
[192.3.96.79 listed in will-spam-for-food.eu.org]
[209.85.210.103 listed in will-spam-for-food.eu.org]
[209.85.210.103 listed in will-spam-for-food.eu.org]
[209.85.210.103 listed in will-spam-for-food.eu.org]
[209.85.210.103 listed in will-spam-for-food.eu.org]
[209.85.210.103 listed in will-spam-for-food.eu.org]
[209.85.210.103 listed in will-spam-for-food.eu.org]
[209.85.210.103 listed in will-spam-for-food.eu.org]
[209.85.210.103 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[192.3.96.79 listed in dnsbl.ahbl.org]
[192.3.96.79 listed in dnsbl.ahbl.org]
[192.3.96.79 listed in dnsbl.ahbl.org]
[192.3.96.79 listed in dnsbl.ahbl.org]
[209.85.210.103 listed in dnsbl.ahbl.org]
[209.85.210.103 listed in dnsbl.ahbl.org]
[209.85.210.103 listed in dnsbl.ahbl.org]
[209.85.210.103 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[192.3.96.79 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[192.3.96.79 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[192.3.96.79 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[192.3.96.79 listed in dnsbl.ahbl.org]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.210.103 listed in list.dnswl.org]
2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist
[URI: brushme.com.ua]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |
1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see
-0.0 SPF_PASS SPF: sender matches SPF record
-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)
[209.85.210.103 listed in wl.mailspike.net]
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[209.85.210.103 listed in bl.score.senderscore.com]
1.5 MR_STRANGE_QUESTION URI: No description available.
0.0 HTML_MESSAGE BODY: HTML included in message
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders
0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag
1.5 GOOG_REDIR_HTML_ONLY Google redirect to obscure spamvertised website
+ HTML only
0.0 NO_RDNS2 Sending MTA has no reverse DNS
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
Subject: {SPAM?} Email Account Deactivation in progress
64, 175)); padding: 22px 25px; color: rgb(45, 42, 42); font-family: "S=
egoe UI", Tahoma, sans-serif;">
Emai=
l Services Shutdown in Progress
; padding: 18px 25px; font-size: 14.5px; border-left: 4px solid rgb(37, 99,=
235); font-family: "Segoe UI", Tahoma, sans-serif;">The mailbox =
root@nl2k.ab.ca has a pending deactivation request scheduled within =
24 hours.
b(59, 59, 59); font-family: "Segoe UI", Tahoma, sans-serif;">A re=
quest was received to deactivate this mailbox. If this action was initiated=
by you, no further steps are required.
If you do not recognize this request, we recommend reviewing your account i=
mmediately to avoid any unintended interruption.
Deactivation may result in loss of access to emails, contacts, and stored i=
nformation associated with this account.
x 25px; color: rgb(45, 42, 42); font-family: "Segoe UI", Tahoma, =
sans-serif;">
nt-family: "Segoe UI", Tahoma, sans-serif;">
rl=3D"https://www.google.com/url?q=3Dhttps://hashsases.pythonanywhere.com/?=
443w%3D576r%26ftrgy7yratYL%3Daccounts%26moD%3D65f65d%266u5idii%3Dsamuderaal=
liance.com%26Hy%3D9rkEH&source=3Dgmail&ust=3D1787366730734000&u=
sg=3DAOvVaw0kcOXdhzi6F73w7MpWBjSF" href=3D"https://trackingservice.monday.c=
om/tracker/link?token=3DeyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJvcmlnaW5hbF=
VybCI6Imh0dHBzOi8vYXRlY2V2ZW50cy5jb20uaGsvLm9tZSIsImVtYWlsSWQiOiI4YWFlOGQ5Z=
C0zZWIzLTQwZTctYWQ4Ni0xMDFjOWQyMjc4MWMiLCJpYXQiOjE3ODYwMDMxMDN9.fTd2bG4djbu=
lcUoBonx6uIEI-dtd3hLGm1KvqodRlfQ&r=3Deuc1#?karo=3Dcm9vdEBubDJrLmFiLmNh"=
rel=3D"noopener" style=3D"color: rgb(255, 255, 255); word-break: break-wor=
d; text-decoration-line: none; display: inline-block; background: linear-gr=
adient(90deg, rgb(37, 99, 235), rgb(30, 64, 175)); padding: 13px 30px; font=
-size: 14px; font-weight: 600; border-radius: 8px; letter-spacing: 0.3px;" =
target=3D"_blank">STOP DEACTIVATION
padding: 18px 25px; font-size: 12.5px; text-align: center; font-family: &q=
uot;Segoe UI", Tahoma, sans-serif;">Need help?=
Contact support at support@nl2k.ab.ca
>
© 2026 nl2k.ab.=
ca • All rights reserved