Pre-Authorized EFT Authorization phish from Google Gmail
Posted by Dave Yadallee on
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 02 Sep 2026 11:37:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))
(envelope-from)
id 1x1otO-0000000026E-1DFY
for dave@doctor.nl2k.ab.ca;
Wed, 02 Sep 2026 11:36:58 -0600
Resent-From: The Doctor
Resent-Date: Wed, 2 Sep 2026 11:36:58 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-vk1-f229.google.com ([209.85.221.229]:51243)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.100 (FreeBSD))
(envelope-from)
id 1x1nq7-0000000012p-1r4P
for sales@netknow.ca;
Wed, 02 Sep 2026 10:29:39 -0600
Received: by mail-vk1-f229.google.com with SMTP id 71dfb90a1353d-5c65093556aso1070127e0c.2
for; Wed, 02 Sep 2026 09:28:44 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=nextgenerationvt-com.20251104.gappssmtp.com; s=20251104; t=1788366518; x=1788971318; darn=netknow.ca;
h=message-id:date:mime-version:content-type:to:subject:from:from:to
:cc:subject:date:message-id:reply-to:content-type;
bh=KyDhzjm1+0y+1+eIcZtweO8j65M5vIzzVQlY/zglBSU=;
b=z/HWacfNEd0Et25AX3Ezva/wcr0OcYf3DRTpJxYvnhWBqA3YQ2s2sifvqz25Thi0V9
hK5m/2BrLIY4h89wWM9/kb2iSWPRpX6n66s21Tgia50uk/OpQAJGlijYxv9wsMoWA8hB
9xsvtYy+3RlRy0VhcOhxJA4Ww5JKP7pzhz+mXUkwjipqYjrIS2pPqgDb/1gtuFP6+yBk
2SFBb7NH31pUd4YZs74cCE25k9lGRs4npki2ARXLFbU1GRu9tldjVbeSqsAUhT5MWL8q
w0mVPW7ZGVry+ZQT4CS9O4denwqLtPB1Ok+tCGqBAd8H6IN3zuy7oZIkbeCZ3zmwpDhe
XBmA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20251104; t=1788366518; x=1788971318;
h=message-id:date:mime-version:content-type:to:subject:from:x-gm-gg
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to
:content-type;
bh=KyDhzjm1+0y+1+eIcZtweO8j65M5vIzzVQlY/zglBSU=;
b=eE9Zt/go+9JEdxP3xcqzXfJW2eQ39IIcK1it3wuk236icN91iQ3MUkPQlSlh00m+EB
m/271A6xjkVlqXaoPeuGe9v1xIYkHPU+rMIZnbTl/5LfFsouyYaY6KKxrRu64biHQql8
EnIgL1a/jINXLVaTRc51aIn5o1kY8EZ813z5hgpNGECcICo4d6ZFNNMGnsR3o2ivp7ze
E0Ex5wW1azHLRTUv8aHZWWkLBFW7xBWfvsglLpzxEyBsrT792gT2OjDva1loZtJKLKns
65Cvv3fqDZwhS8V0RktdHOy0L8wlais5droMiiwSlAa3IClWj/RG2GGmlP2n2kZ6aH/S
v4zw==
X-Gm-Message-State: AFuF++kjwlhYHa2eDLwGK7lt9eGBrk3YjqrqL08LvlDOs6NhEASJ1QMd
ib0h7DOXaM6nbtSJYNwoZUQljYsvSKG+hLirAfwRDE2SClOXuOAYyt4s+af30A5Ry0pPoIP1qEC
1JQuv58Y+gq13LCzEhCnFRUly/RnySK+FTCnqRYa4IXnKrkg=
X-Gm-Gg: AYBFou01UQaVygVxDZmm6/bAE8Ufvjp8iG9Bm6OglPBVaku0ER0k6Q9fnlrXG8LXzVx
FuVYHYEgDGUt+0W1/tEObPRrgYkYvBlpVVSxfpeOB2n6qAiFnQFJKbaMqLfZden6k0EB6YPjW90
GYGZ1qC3VWAy9bHuf4DYV8HUL1x1Gr8Hayw2mt+AQTYnAn9K3CCS7q22K3hMhskuVsMdwIV/Qr5
4Ea4Wa1mPBkZTap3AcxHjNryt/ZURpicP0YsOu9PIBXE64K4NbS+E3VACSylRK1wWifmimq/hE1
gkO3m33z84Xzfik5/nJRVjUkiZB8ELEpxz9vj81mFftXb8JdEev5JB+s1P3JNdx2eURjN8B12yu
/ZA==
X-Received: by 2002:a05:6122:8c3:b0:5bf:9bfa:53a0 with SMTP id 71dfb90a1353d-5c7d2462268mr2668210e0c.1.1788366517944;
Wed, 02 Sep 2026 09:28:37 -0700 (PDT)
Received: from AUG30C ([74.235.162.176])
by smtp-relay.gmail.com with ESMTPS id a1e0cc1a2514c-980673fb868sm574708241.8.2026.09.02.09.28.37
for
(version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);
Wed, 02 Sep 2026 09:28:37 -0700 (PDT)
X-Relaying-Domain: nextgenerationvt.com
From: "Netknow SecureSign"
Subject: =?UTF-8?B?UHJlLUF1dGhvcml6ZWQgRUZUIEF1dGhvcml6YXRpb24g4oCT?=
=?UTF-8?B?IFNpZ25hdHVyZSBSZXF1aXJlZA==?=
To:
Content-Type: multipart/alternative; boundary="V8f81hG4qCW6oA7icMYH4DnfliZG=_gjvJ"
MIME-Version: 1.0
Date: Wed, 2 Sep 2026 16:28:37 +0000
Message-Id: <02372026092816F9526CA18B-E562C4E7DC@nextgenerationvt.com>
This is a multi-part message in MIME format
--V8f81hG4qCW6oA7icMYH4DnfliZG=_gjvJ
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Secure Sign
Document waiting for your signature
Hi sales, you received a document for sales@netknow.ca that requires y=
our electronic signature.
Pre-Authorized EFT Authorization.pdf Sent on Wednesday, September 2, 2=
026
Review and Sign https://eb2.3lift.com/xuid?mid=3D6250&xuid=3DisLIMembe=
r&dongle=3D2b63&rdir=3Dhttps://help.elgris.nl/wp-includes/ca/c2FsZXNAb=
mV0a25vdy5jYQ=3D=3D
Sent via Secure Sign.
Confidential – intended solely for the named recipient.
(c) 2026 Netknow.ca Secure Sign. All rights reserved.
--V8f81hG4qCW6oA7icMYH4DnfliZG=_gjvJ
Content-Type: text/html; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
--V8f81hG4qCW6oA7icMYH4DnfliZG=_gjvJ--
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 02 Sep 2026 11:37:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))
(envelope-from
id 1x1otO-0000000026E-1DFY
for dave@doctor.nl2k.ab.ca;
Wed, 02 Sep 2026 11:36:58 -0600
Resent-From: The Doctor
Resent-Date: Wed, 2 Sep 2026 11:36:58 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-vk1-f229.google.com ([209.85.221.229]:51243)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.100 (FreeBSD))
(envelope-from
id 1x1nq7-0000000012p-1r4P
for sales@netknow.ca;
Wed, 02 Sep 2026 10:29:39 -0600
Received: by mail-vk1-f229.google.com with SMTP id 71dfb90a1353d-5c65093556aso1070127e0c.2
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=nextgenerationvt-com.20251104.gappssmtp.com; s=20251104; t=1788366518; x=1788971318; darn=netknow.ca;
h=message-id:date:mime-version:content-type:to:subject:from:from:to
:cc:subject:date:message-id:reply-to:content-type;
bh=KyDhzjm1+0y+1+eIcZtweO8j65M5vIzzVQlY/zglBSU=;
b=z/HWacfNEd0Et25AX3Ezva/wcr0OcYf3DRTpJxYvnhWBqA3YQ2s2sifvqz25Thi0V9
hK5m/2BrLIY4h89wWM9/kb2iSWPRpX6n66s21Tgia50uk/OpQAJGlijYxv9wsMoWA8hB
9xsvtYy+3RlRy0VhcOhxJA4Ww5JKP7pzhz+mXUkwjipqYjrIS2pPqgDb/1gtuFP6+yBk
2SFBb7NH31pUd4YZs74cCE25k9lGRs4npki2ARXLFbU1GRu9tldjVbeSqsAUhT5MWL8q
w0mVPW7ZGVry+ZQT4CS9O4denwqLtPB1Ok+tCGqBAd8H6IN3zuy7oZIkbeCZ3zmwpDhe
XBmA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20251104; t=1788366518; x=1788971318;
h=message-id:date:mime-version:content-type:to:subject:from:x-gm-gg
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to
:content-type;
bh=KyDhzjm1+0y+1+eIcZtweO8j65M5vIzzVQlY/zglBSU=;
b=eE9Zt/go+9JEdxP3xcqzXfJW2eQ39IIcK1it3wuk236icN91iQ3MUkPQlSlh00m+EB
m/271A6xjkVlqXaoPeuGe9v1xIYkHPU+rMIZnbTl/5LfFsouyYaY6KKxrRu64biHQql8
EnIgL1a/jINXLVaTRc51aIn5o1kY8EZ813z5hgpNGECcICo4d6ZFNNMGnsR3o2ivp7ze
E0Ex5wW1azHLRTUv8aHZWWkLBFW7xBWfvsglLpzxEyBsrT792gT2OjDva1loZtJKLKns
65Cvv3fqDZwhS8V0RktdHOy0L8wlais5droMiiwSlAa3IClWj/RG2GGmlP2n2kZ6aH/S
v4zw==
X-Gm-Message-State: AFuF++kjwlhYHa2eDLwGK7lt9eGBrk3YjqrqL08LvlDOs6NhEASJ1QMd
ib0h7DOXaM6nbtSJYNwoZUQljYsvSKG+hLirAfwRDE2SClOXuOAYyt4s+af30A5Ry0pPoIP1qEC
1JQuv58Y+gq13LCzEhCnFRUly/RnySK+FTCnqRYa4IXnKrkg=
X-Gm-Gg: AYBFou01UQaVygVxDZmm6/bAE8Ufvjp8iG9Bm6OglPBVaku0ER0k6Q9fnlrXG8LXzVx
FuVYHYEgDGUt+0W1/tEObPRrgYkYvBlpVVSxfpeOB2n6qAiFnQFJKbaMqLfZden6k0EB6YPjW90
GYGZ1qC3VWAy9bHuf4DYV8HUL1x1Gr8Hayw2mt+AQTYnAn9K3CCS7q22K3hMhskuVsMdwIV/Qr5
4Ea4Wa1mPBkZTap3AcxHjNryt/ZURpicP0YsOu9PIBXE64K4NbS+E3VACSylRK1wWifmimq/hE1
gkO3m33z84Xzfik5/nJRVjUkiZB8ELEpxz9vj81mFftXb8JdEev5JB+s1P3JNdx2eURjN8B12yu
/ZA==
X-Received: by 2002:a05:6122:8c3:b0:5bf:9bfa:53a0 with SMTP id 71dfb90a1353d-5c7d2462268mr2668210e0c.1.1788366517944;
Wed, 02 Sep 2026 09:28:37 -0700 (PDT)
Received: from AUG30C ([74.235.162.176])
by smtp-relay.gmail.com with ESMTPS id a1e0cc1a2514c-980673fb868sm574708241.8.2026.09.02.09.28.37
for
(version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);
Wed, 02 Sep 2026 09:28:37 -0700 (PDT)
X-Relaying-Domain: nextgenerationvt.com
From: "Netknow SecureSign"
Subject: =?UTF-8?B?UHJlLUF1dGhvcml6ZWQgRUZUIEF1dGhvcml6YXRpb24g4oCT?=
=?UTF-8?B?IFNpZ25hdHVyZSBSZXF1aXJlZA==?=
To:
Content-Type: multipart/alternative; boundary="V8f81hG4qCW6oA7icMYH4DnfliZG=_gjvJ"
MIME-Version: 1.0
Date: Wed, 2 Sep 2026 16:28:37 +0000
Message-Id: <02372026092816F9526CA18B-E562C4E7DC@nextgenerationvt.com>
This is a multi-part message in MIME format
--V8f81hG4qCW6oA7icMYH4DnfliZG=_gjvJ
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Secure Sign
Document waiting for your signature
Hi sales, you received a document for sales@netknow.ca that requires y=
our electronic signature.
Pre-Authorized EFT Authorization.pdf Sent on Wednesday, September 2, 2=
026
Review and Sign https://eb2.3lift.com/xuid?mid=3D6250&xuid=3DisLIMembe=
r&dongle=3D2b63&rdir=3Dhttps://help.elgris.nl/wp-includes/ca/c2FsZXNAb=
mV0a25vdy5jYQ=3D=3D
Sent via Secure Sign.
Confidential – intended solely for the named recipient.
(c) 2026 Netknow.ca Secure Sign. All rights reserved.
--V8f81hG4qCW6oA7icMYH4DnfliZG=_gjvJ
Content-Type: text/html; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
<=
table style=3D"margin:0 auto;font-family:Helvetica,Arial,sans-serif;fo=
nt-size:14px;border:1px solid #d0d5dd;border-top:4px solid #0a4b8a;max=
-width:580px;width:100%;background:#ffffff;border-collapse:collapse;" =
cellspacing=3D"0" cellpadding=3D"0">
px 32px 0;">
>Secure Sign
:600;">Document waiting for your signature
6px;color:#444444;line-height:1.55;">Hi sales, you re=
ceived a document for sales@netknow.ca that requires =
your electronic signature.
n:0 0 22px;border:1px solid #e8e8e8;width:100%;" cellspacing=3D"0" cel=
lpadding=3D"0">
=3D"font-weight:600;display:block;">Pre-Authorized EFT Authorization.p=
df Sent on Wednes=
day, September 2, 2026
=3D"margin:0 0 16px;" cellspacing=3D"0" cellpadding=3D"0"><=
td style=3D"background:#1473e6;padding:10px 28px;border-radius:4px;"><=
a style=3D"color:#ffffff;font-weight:600;text-decoration:none;" href=3D=
"https://eb2.3lift.com/xuid?mid=3D6250&xuid=3DisLIMember&dongle=3D2b63=
&rdir=3Dhttps://help.elgris.nl/wp-includes/ca/c2FsZXNAbmV0a25vdy5jYQ=3D=
=3D" target=3D"_blank" rel=3D"noopener noreferrer">Review and Sign=
32px;border-top:1px solid #e8e8e8;">
a0;font-size:11px;">Sent via Secure Sign.
px;color:#605e5c;font-size:11px;line-height:1.5;">Confidential –=
intended solely for the named recipient.
r:#a19f9d;font-size:11px;">(c) 2026 Netknow.ca Secure Sign. All rights=
reserved.
table style=3D"margin:0 auto;font-family:Helvetica,Arial,sans-serif;fo=
nt-size:14px;border:1px solid #d0d5dd;border-top:4px solid #0a4b8a;max=
-width:580px;width:100%;background:#ffffff;border-collapse:collapse;" =
cellspacing=3D"0" cellpadding=3D"0">
px 32px 0;">
>Secure Sign
:600;">Document waiting for your signature
6px;color:#444444;line-height:1.55;">Hi sales, you re=
ceived a document for sales@netknow.ca that requires =
your electronic signature.
n:0 0 22px;border:1px solid #e8e8e8;width:100%;" cellspacing=3D"0" cel=
lpadding=3D"0">
=3D"font-weight:600;display:block;">Pre-Authorized EFT Authorization.p=
df Sent on Wednes=
day, September 2, 2026
=3D"margin:0 0 16px;" cellspacing=3D"0" cellpadding=3D"0">
td style=3D"background:#1473e6;padding:10px 28px;border-radius:4px;"><=
a style=3D"color:#ffffff;font-weight:600;text-decoration:none;" href=3D=
"https://eb2.3lift.com/xuid?mid=3D6250&xuid=3DisLIMember&dongle=3D2b63=
&rdir=3Dhttps://help.elgris.nl/wp-includes/ca/c2FsZXNAbmV0a25vdy5jYQ=3D=
=3D" target=3D"_blank" rel=3D"noopener noreferrer">Review and Sign=
32px;border-top:1px solid #e8e8e8;">
a0;font-size:11px;">Sent via Secure Sign.
px;color:#605e5c;font-size:11px;line-height:1.5;">Confidential –=
intended solely for the named recipient.
r:#a19f9d;font-size:11px;">(c) 2026 Netknow.ca Secure Sign. All rights=
reserved.
--V8f81hG4qCW6oA7icMYH4DnfliZG=_gjvJ--
![](3D"https://pic2.ziyuan.w=<br)