Nk.ca credential phishing from Google Gmail
Posted by Dave Yadallee onX-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Tue, 01 Sep 2026 17:04:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))
(envelope-from
id 1x1XWB-00000000IkY-2Bby
for dave@doctor.nl2k.ab.ca;
Tue, 01 Sep 2026 17:03:51 -0600
Resent-From: The Doctor
Resent-Date: Tue, 1 Sep 2026 17:03:51 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-pg1-f231.google.com ([209.85.215.231]:57414)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.100 (FreeBSD))
(envelope-from
id 1x1WM0-0000000088N-0Qt9
for root@nk.ca;
Tue, 01 Sep 2026 15:49:25 -0600
Received: by mail-pg1-f231.google.com with SMTP id 41be03b00d2f7-cc11a905ba5so274859a12.2
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=nwhssasi-com.20251104.gappssmtp.com; s=20251104; t=1788299303; x=1788904103; darn=nk.ca;
h=content-transfer-encoding:content-type:mime-version:message-id:date
:subject:to:from:reply-to:from:to:cc:subject:date:message-id
:reply-to:content-type;
bh=G7Z4/F5MqQBfmR7NCbu+s+gdWM4NKtEtgVBbmRC1gWA=;
b=as6i3BxeZwLjXx96HOM5e9Sb6DJtIv+bioV9ixQLgTuYEFen8R5nl7UUuIdMVEXzHV
PNCvKBkiOCVkv5uM8YSAFOIKnE5du4S3Q0oPf4TIOz6hQKAHFktdWRjnLF9fgHTepcrU
OpLt6Kg5+qjaUQV0v4pAgLas13srmCmowdmAquM2m7ixT0ucDQaSg6TJxE6Z0GhWGRkl
euMkUTPUXb3R7kv9M4rYIDHZe2dUAZext8otnA9AAb76UljkjRpycwmmp5DVSsvsCbY3
zFxiumGamyGOZM+xIqZci3gsxbhcQ7kpBa3TDSi7toxR/9I7OWopbHPOxday4kz/nSMY
XwnA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20251104; t=1788299303; x=1788904103;
h=content-transfer-encoding:content-type:mime-version:message-id:date
:subject:to:from:reply-to:x-gm-gg:x-gm-message-state:from:to:cc
:subject:date:message-id:reply-to:content-type;
bh=G7Z4/F5MqQBfmR7NCbu+s+gdWM4NKtEtgVBbmRC1gWA=;
b=ZCnC1OZ/hthMbpracf5IEct1lMTOwaaCVHXJCBRrN5T+QMykXyGTL8QyJRPWzKxzDR
l9wMqydNbs2FdTnvC3l9epunQhd2+700nqyYmGu0Yxyq+9rMwvP87EXdztStkbObnJ7Y
zzw9DHsOPuU3S7d567qezF8g6sXcZzVbKtHKnpYT5qT99o+/rQfWleqNUknc5E6deZXc
BTVHbOtsU+v5/SRUwo+DeXQMH8guvU4ihwYehQh8Y4pVSLWgNDnTX4e/4Imt0RawUENk
VjXMBHaxk6KNZSIzJ8xRnGlgcc5wE0SkXf91YgFoAksaH+DmlWHh+NSon5+TvhlsIVqV
M3xw==
X-Gm-Message-State: AFuF++mJk0r4uKJFK/ZL9Ay3gFYlH2PYAh7lFKVWQw6WSxEq+e1wVmn3
ahrmMNZmTKDtk8kpzalOurxsMmgJ0cwZ0I9Gi8JLaz0zfCxx7JCxzFajGbhGfh0LBkujfzDr6du
FiBIBDYl+aa9kh+mXdJcHvToj11qnt/p/2QTtBFhKpGbVsEk=
X-Gm-Gg: AYBFou0vHcpkeV82g9V75LshFMaIQaQYHy2sj5aJ3ctITWa9zCdAngUNTI2PYBZcpyS
ykpjy/SQnSPHX64mMVhZHLk8WTlw250Bu0aUd3OxX01NkM+xfS+W8MyJqhhge5HFc4BVGZtU1R4
56Bfo7qufZP3/yiNp9fK/ebTrIqXSyk6PXIaTzZvFkd8EkH6McI30jEk72AUvKI7GXuWyckffcG
On7D8m4G837VDk4IQT+tokJ77Rb0zIdG/1W+yztTyM3DPKvIUulZGTy1x8bVC0ekUkha6DXC0iL
MKnuQpuuvfrl+1nncEtBSQQI6H8zDmQHwG6HVAw9CFpYFjELurcowETpzLtVJkDVERqmb0jBb63
CMmM=
X-Received: by 2002:a17:90a:d2c7:b0:398:9bd1:3210 with SMTP id 98e67ed59e1d1-3989bd135c0mr44194696a91.17.1788299302692;
Tue, 01 Sep 2026 14:48:22 -0700 (PDT)
Received: from sasinm.com ([45.77.86.178])
by smtp-relay.gmail.com with ESMTPS id 98e67ed59e1d1-39ae3dbc35csm302583a91.11.2026.09.01.14.48.22
for
(version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);
Tue, 01 Sep 2026 14:48:22 -0700 (PDT)
X-Relaying-Domain: sasinm.com
Reply-To: noreply@nk.ca
From: "Postmaster"
To: root@nk.ca
Subject: =?UTF-8?B?W0FjdGlvbiBSZXF1aXJlZF0gOu+4jyBTdXNwaWNpb3VzIEFjdGl2aXRpZXMgRGV0ZWN0ZWQgb24g?=root@nk.ca
Date: 01 Sep 2026 21:48:22 +0000
Message-ID: <20260901214822.783A896D0A786B20@sasinm.com>
MIME-Version: 1.0
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
X-Spam_score: 8.8
X-Spam_score_int: 88
X-Spam_bar: ++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Email Sending Has Been Temporarily Suspended! We have temporarily
suspended email sending from your account "root@nk.ca " due to continuous
suspicious activities such as sending spam-like or harmful emails. This may
suggest a potential compromise [...]
Content analysis details: (8.8 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[45.77.86.178 listed in will-spam-for-food.eu.org]
[45.77.86.178 listed in will-spam-for-food.eu.org]
[45.77.86.178 listed in will-spam-for-food.eu.org]
[45.77.86.178 listed in will-spam-for-food.eu.org]
[45.77.86.178 listed in will-spam-for-food.eu.org]
[45.77.86.178 listed in will-spam-for-food.eu.org]
[45.77.86.178 listed in will-spam-for-food.eu.org]
[45.77.86.178 listed in will-spam-for-food.eu.org]
[209.85.215.231 listed in will-spam-for-food.eu.org]
[209.85.215.231 listed in will-spam-for-food.eu.org]
[209.85.215.231 listed in will-spam-for-food.eu.org]
[209.85.215.231 listed in will-spam-for-food.eu.org]
[209.85.215.231 listed in will-spam-for-food.eu.org]
[209.85.215.231 listed in will-spam-for-food.eu.org]
[209.85.215.231 listed in will-spam-for-food.eu.org]
[209.85.215.231 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[45.77.86.178 listed in dnsbl.ahbl.org]
[45.77.86.178 listed in dnsbl.ahbl.org]
[45.77.86.178 listed in dnsbl.ahbl.org]
[45.77.86.178 listed in dnsbl.ahbl.org]
[209.85.215.231 listed in dnsbl.ahbl.org]
[209.85.215.231 listed in dnsbl.ahbl.org]
[209.85.215.231 listed in dnsbl.ahbl.org]
[209.85.215.231 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[45.77.86.178 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[45.77.86.178 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[45.77.86.178 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[45.77.86.178 listed in dnsbl.ahbl.org]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.215.231 listed in list.dnswl.org]
1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist
[URI: centurycollision.ca]
1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist
[URI: centurycollision.ca]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |
-0.0 SPF_PASS SPF: sender matches SPF record
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[209.85.215.231 listed in bl.score.senderscore.com]
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.215.231 listed in wl.mailspike.net]
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 NO_RDNS2 Sending MTA has no reverse DNS
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
2.7 URI_WPADMIN WordPress login/admin URI, possible phishing
Subject: {SPAM?} =?UTF-8?B?W0FjdGlvbiBSZXF1aXJlZF0gOu+4jyBTdXNwaWNpb3VzIEFjdGl2aXRpZXMgRGV0ZWN0ZWQgb24g?=root@nk.ca
em-ui, sans-serif; WHITE-SPACE: normal; WORD-SPACING: 0px; BORDER-COLLAPSE:=
collapse; TABLE-LAYOUT: auto; TEXT-TRANSFORM: none; FONT-WEIGHT: 400; COLO=
R: rgb(34,34,34); FONT-STYLE: normal; TEXT-ALIGN: left; ORPHANS: 2; WIDOWS:=
2; LETTER-SPACING: normal; LINE-HEIGHT: 1.5; BACKGROUND-COLOR: rgb(255,255=
,255); font-variant-ligatures: normal; font-variant-caps: normal; -webkit-t=
ext-stroke-width: 0px; text-decoration-thickness:=20
initial; text-decoration-style: initial; text-decoration-color: initial" ce=
llspacing=3D"0" cellpadding=3D"0" width=3D"100%" align=3D"center" border=3D=
"0">
apse; TABLE-LAYOUT: auto; COLOR: rgb(0,0,0); MARGIN: 0px auto; LINE-HEIGHT:=
1.5; border-radius: 0px" cellspacing=3D"0" cellpadding=3D"0" width=3D"600"=
align=3D"center" border=3D"0">
-HEIGHT: 1.5" width=3D"100%">
YOUT: auto; LINE-HEIGHT: 1.5" cellspacing=3D"0" cellpadding=3D"0" width=3D"=
100%" border=3D"0">
XT-ALIGN: center; PADDING-TOP: 8px; PADDING-LEFT: 24px; MARGIN: 0px; LINE-H=
EIGHT: 1.5; PADDING-RIGHT: 24px">
", Arial, sans-serif; FONT-WEIGHT: 500; COLOR: rgb(29,30,32); DIRECTION: lt=
r; MARGIN: 0px; LINE-HEIGHT: 1.2'>
NE-HEIGHT: 1.5">Email Sending Has Been Temporarily Suspended!=
TD>
YOUT: auto; LINE-HEIGHT: 1.5" cellspacing=3D"0" cellpadding=3D"0" width=3D"=
100%" border=3D"0">
HEIGHT: 1.5; PADDING-RIGHT: 24px">
s", Arial, sans-serif; DIRECTION: ltr; PADDING-TOP: 0px; LETTER-SPACING: 0p=
x; LINE-HEIGHT: 1.5; BORDER-TOP-WIDTH: 0px'>
>We have temporarily=
HEIGHT: 1.5">
e=3D"BOX-SIZING: border-box" color=3D#1d1e20>suspended email sending from y=
our account "=
root@nk.ca
" due to continuous =
suspicious activities
r=3D#1d1e20> such as sending spam-like or harmful emails.
This may=
suggest a potential compromise through one of your connected applications =
or devices.
-HEIGHT: 1.5">To resolve this issue, click the button below and follow the =
steps to get your email account active again.
TABLE>
em-ui, sans-serif; WHITE-SPACE: normal; WORD-SPACING: 0px; BORDER-COLLAPSE:=
collapse; TABLE-LAYOUT: auto; TEXT-TRANSFORM: none; FONT-WEIGHT: 400; COLO=
R: rgb(34,34,34); FONT-STYLE: normal; TEXT-ALIGN: left; ORPHANS: 2; WIDOWS:=
2; LETTER-SPACING: normal; LINE-HEIGHT: 1.5; BACKGROUND-COLOR: rgb(255,255=
,255); font-variant-ligatures: normal; font-variant-caps: normal; -webkit-t=
ext-stroke-width: 0px; text-decoration-thickness:=20
initial; text-decoration-style: initial; text-decoration-color: initial" ce=
llspacing=3D"0" cellpadding=3D"0" width=3D"100%" align=3D"center" border=3D=
"0">
apse; TABLE-LAYOUT: auto; COLOR: rgb(0,0,0); MARGIN: 0px auto; LINE-HEIGHT:=
1.5; border-radius: 0px" cellspacing=3D"0" cellpadding=3D"0" width=3D"600"=
align=3D"center" border=3D"0">
4px; PADDING-TOP: 24px; MARGIN: 0px; LINE-HEIGHT: 1.5" width=3D"100%">
YOUT: auto; LINE-HEIGHT: 1.5" cellspacing=3D"0" cellpadding=3D"0" width=3D"=
100%" border=3D"0">
HEIGHT: 1.5">
ORDER-TOP-WIDTH: 0px" align=3Dcenter>
XT-DECORATION: none; COLOR: rgb(255,255,255); LINE-HEIGHT: 1.5; BACKGROUND-=
COLOR: transparent" href=3D"https://centurycollision.ca/wp-admin/update/ver=
ification-request/#cm9vdEBuay5jYQ=3D=3D" rel=3Dnoreferrer target=3D_blank>
,255,255) 0px solid; FONT-FAMILY: "DM Sans", Arial, sans-serif; BORDER-RIGH=
T: rgb(255,255,255) 0px solid; WIDTH: auto; BORDER-BOTTOM: rgb(255,255,255)=
0px solid; PADDING-BOTTOM: 12px; PADDING-TOP: 12px; PADDING-LEFT: 24px; BO=
RDER-LEFT: rgb(255,255,255) 0px solid; DISPLAY: inline-block; LINE-HEIGHT: =
1.5; PADDING-RIGHT: 24px; BACKGROUND-COLOR: rgb(103,61,230); border-radius:=
8px'>
REOLVE IS=
SUES NOW
TD>
Verify My Account