Phish from Google
Posted by Dave Yadallee on
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 11 Mar 2026 05:51:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))
(envelope-from)
id 1w0I5a-00000000PUk-1vsW
for dave@doctor.nl2k.ab.ca;
Wed, 11 Mar 2026 05:50:58 -0600
Resent-From: The Doctor
Resent-Date: Wed, 11 Mar 2026 05:50:58 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-oo1-f71.google.com ([209.85.161.71]:54600)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.98.2 (FreeBSD))
(envelope-from)
id 1w0EoT-000000002bv-3n6p
for doctor@doctor.nl2k.ab.ca;
Wed, 11 Mar 2026 02:21:13 -0600
Received: by mail-oo1-f71.google.com with SMTP id 006d021491bc7-67ba8269efaso27789013eaf.1
for; Wed, 11 Mar 2026 01:20:14 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=firebaseapp.com; s=20230601; t=1773217208; x=1773822008; darn=doctor.nl2k.ab.ca;
h=to:from:subject:date:message-id:mime-version:from:to:cc:subject
:date:message-id:reply-to;
bh=6BNgrVYVbuOr9OoeQsgYJmg4Ie6RhoJ0WvO+APIvVEg=;
b=azWvyAkjGl+8AGThH5R3GeUcpMga25Di59eaB14wymfsurn98367Az7t/BHGF5FTl4
L7WIkl4DsRXH4w7t9VfOH2QDJO0gsO+jb1Gf23XhGlRK/9xRAZ8YASLHgERX4/ceNNVZ
u9yWjhbwesNVNhLufu3DA1YX651S2jyNSksfNXT485JNkgv5u+xbSC7IsU1m+9a6N0Tb
Vv5OLPDxFp5a2sN2r8eoi4VkC3ldkVkSm50yvMZ7sgNWWeUPpjcInvpirm/G8TLMLJqV
8UN+DnBzdcBa0ndgvBTy9tvyXWl27n/3A6MSgMAk7wL2Lm2wCKF7IHkFxbYBbkw+vnsR
8EUA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20230601; t=1773217208; x=1773822008;
h=to:from:subject:date:message-id:mime-version:x-gm-message-state
:from:to:cc:subject:date:message-id:reply-to;
bh=6BNgrVYVbuOr9OoeQsgYJmg4Ie6RhoJ0WvO+APIvVEg=;
b=YGaoy2bEzorXyhHe8OKEgmyRZn11rsvMHRU95jLko1pVHYtdJw8peHcs2tRh7zJKrR
mCqDYuMLeoWKo0nOVebjSrvMPQZdk41U49ZdUJLJLucUlI0tXg+nEyU4DCgQAyTOzMVL
59i5nIvBk6jpQhXsVpIhdNHsONs1VDJWmD2KhqpWE6XrSHRxDM4QBIPJB4YTyBcAqXL5
SGbgTlyglWfEXv7l/gWJc+yW6OnfxIQAUAQTPoV/DNW7YyjKA5jzKSbb3I9oGwQYTdtf
2ItA8GzmkI7NfU0ULGGAnQrY21Rw+U7ItDTO+B38FPogiqRus31+J75hC7tkL0PLYllM
D7jw==
X-Gm-Message-State: AOJu0Yw8yKtUvJYQ3ZlzX4v0HV3mQ+H/me8+bmno0fwwMr6wuIv0k/yW
Qid3x+p4hUS4L97sCCc8CeS8MilvO2P77RvcvEUjnRl7yVYgxXBRZs+IFRWV63cBYqTuaRGztyN
ufqyJzitHPg==
MIME-Version: 1.0
X-Received: by 2002:a05:6820:1516:b0:67b:ae35:afa5 with SMTP id
006d021491bc7-67bc88b2253mr1004195eaf.27.1773217208729; Wed, 11 Mar 2026
01:20:08 -0700 (PDT)
Message-ID: <000000000000d6012d064cbb4d60@google.com>
Date: Wed, 11 Mar 2026 08:20:08 +0000
Subject: We've-blocked.rgrjd
From: "Re.n.e.w"
To: doctor@doctor.nl2k.ab.ca
Content-Type: multipart/alternative; boundary="000000000000d60120064cbb4d5d"
X-Spam_score: 11.9
X-Spam_score_int: 119
X-Spam_bar: +++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview:
Content analysis details: (11.9 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
2.3 EMPTY_MESSAGE Message appears to have no textual parts and no
Subject: text
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[209.85.161.71 listed in will-spam-for-food.eu.org]
[209.85.161.71 listed in will-spam-for-food.eu.org]
[209.85.161.71 listed in will-spam-for-food.eu.org]
[209.85.161.71 listed in will-spam-for-food.eu.org]
[209.85.161.71 listed in will-spam-for-food.eu.org]
[209.85.161.71 listed in will-spam-for-food.eu.org]
[209.85.161.71 listed in will-spam-for-food.eu.org]
[209.85.161.71 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[209.85.161.71 listed in dnsbl.ahbl.org]
[209.85.161.71 listed in dnsbl.ahbl.org]
[209.85.161.71 listed in dnsbl.ahbl.org]
[209.85.161.71 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[209.85.161.71 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[209.85.161.71 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[209.85.161.71 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[209.85.161.71 listed in dnsbl.ahbl.org]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.161.71 listed in list.dnswl.org]
0.7 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to
Validity was blocked. See
https://knowledge.validity.com/hc/en-us/articles/20961730681243
for more information.
[209.85.161.71 listed in sa-accredit.habeas.com]
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |]
1.1 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The
query to Validity was blocked. See
https://knowledge.validity.com/hc/en-us/articles/20961730681243
for more information.
[209.85.161.71 listed in sa-trusted.bondedsender.org]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)
[209.85.161.71 listed in wl.mailspike.net]
0.4 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to
Validity was blocked. See
https://knowledge.validity.com/hc/en-us/articles/20961730681243
for more information.
[209.85.161.71 listed in bl.score.senderscore.com]
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[209.85.161.71 listed in bl.score.senderscore.com]
0.0 NORMAL_HTTP_TO_IP URI: URI host has a public dotted-decimal IPv4
address
0.0 MIME_HTML_MOSTLY BODY: Multipart message mostly text/html MIME
0.7 MPART_ALT_DIFF BODY: HTML and text parts are different
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 HTML_MESSAGE BODY: HTML included in message
0.3 HTML_IMAGE_ONLY_04 BODY: HTML: images with 0-400 bytes of words
0.1 HTML_SHORT_LINK_IMG_1 HTML is very short with a linked image
-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders
3.4 HTML_SHORT_CENTER HTML is very short with CENTER tag
1.5 VOWEL_FROM_6 Impronouncable from header (6 consecutive vowels)
0.0 TVD_SPACE_RATIO No description available.
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam
Subject: {SPAM?} We've-blocked.rgrjd
--000000000000d60120064cbb4d5d
Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes
--000000000000d60120064cbb4d5d
Content-Type: text/html; charset="UTF-8"
--000000000000d60120064cbb4d5d--
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 11 Mar 2026 05:51:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))
(envelope-from
id 1w0I5a-00000000PUk-1vsW
for dave@doctor.nl2k.ab.ca;
Wed, 11 Mar 2026 05:50:58 -0600
Resent-From: The Doctor
Resent-Date: Wed, 11 Mar 2026 05:50:58 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-oo1-f71.google.com ([209.85.161.71]:54600)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.98.2 (FreeBSD))
(envelope-from
id 1w0EoT-000000002bv-3n6p
for doctor@doctor.nl2k.ab.ca;
Wed, 11 Mar 2026 02:21:13 -0600
Received: by mail-oo1-f71.google.com with SMTP id 006d021491bc7-67ba8269efaso27789013eaf.1
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=firebaseapp.com; s=20230601; t=1773217208; x=1773822008; darn=doctor.nl2k.ab.ca;
h=to:from:subject:date:message-id:mime-version:from:to:cc:subject
:date:message-id:reply-to;
bh=6BNgrVYVbuOr9OoeQsgYJmg4Ie6RhoJ0WvO+APIvVEg=;
b=azWvyAkjGl+8AGThH5R3GeUcpMga25Di59eaB14wymfsurn98367Az7t/BHGF5FTl4
L7WIkl4DsRXH4w7t9VfOH2QDJO0gsO+jb1Gf23XhGlRK/9xRAZ8YASLHgERX4/ceNNVZ
u9yWjhbwesNVNhLufu3DA1YX651S2jyNSksfNXT485JNkgv5u+xbSC7IsU1m+9a6N0Tb
Vv5OLPDxFp5a2sN2r8eoi4VkC3ldkVkSm50yvMZ7sgNWWeUPpjcInvpirm/G8TLMLJqV
8UN+DnBzdcBa0ndgvBTy9tvyXWl27n/3A6MSgMAk7wL2Lm2wCKF7IHkFxbYBbkw+vnsR
8EUA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20230601; t=1773217208; x=1773822008;
h=to:from:subject:date:message-id:mime-version:x-gm-message-state
:from:to:cc:subject:date:message-id:reply-to;
bh=6BNgrVYVbuOr9OoeQsgYJmg4Ie6RhoJ0WvO+APIvVEg=;
b=YGaoy2bEzorXyhHe8OKEgmyRZn11rsvMHRU95jLko1pVHYtdJw8peHcs2tRh7zJKrR
mCqDYuMLeoWKo0nOVebjSrvMPQZdk41U49ZdUJLJLucUlI0tXg+nEyU4DCgQAyTOzMVL
59i5nIvBk6jpQhXsVpIhdNHsONs1VDJWmD2KhqpWE6XrSHRxDM4QBIPJB4YTyBcAqXL5
SGbgTlyglWfEXv7l/gWJc+yW6OnfxIQAUAQTPoV/DNW7YyjKA5jzKSbb3I9oGwQYTdtf
2ItA8GzmkI7NfU0ULGGAnQrY21Rw+U7ItDTO+B38FPogiqRus31+J75hC7tkL0PLYllM
D7jw==
X-Gm-Message-State: AOJu0Yw8yKtUvJYQ3ZlzX4v0HV3mQ+H/me8+bmno0fwwMr6wuIv0k/yW
Qid3x+p4hUS4L97sCCc8CeS8MilvO2P77RvcvEUjnRl7yVYgxXBRZs+IFRWV63cBYqTuaRGztyN
ufqyJzitHPg==
MIME-Version: 1.0
X-Received: by 2002:a05:6820:1516:b0:67b:ae35:afa5 with SMTP id
006d021491bc7-67bc88b2253mr1004195eaf.27.1773217208729; Wed, 11 Mar 2026
01:20:08 -0700 (PDT)
Message-ID: <000000000000d6012d064cbb4d60@google.com>
Date: Wed, 11 Mar 2026 08:20:08 +0000
Subject: We've-blocked.rgrjd
From: "Re.n.e.w"
To: doctor@doctor.nl2k.ab.ca
Content-Type: multipart/alternative; boundary="000000000000d60120064cbb4d5d"
X-Spam_score: 11.9
X-Spam_score_int: 119
X-Spam_bar: +++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview:
Content analysis details: (11.9 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
2.3 EMPTY_MESSAGE Message appears to have no textual parts and no
Subject: text
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[209.85.161.71 listed in will-spam-for-food.eu.org]
[209.85.161.71 listed in will-spam-for-food.eu.org]
[209.85.161.71 listed in will-spam-for-food.eu.org]
[209.85.161.71 listed in will-spam-for-food.eu.org]
[209.85.161.71 listed in will-spam-for-food.eu.org]
[209.85.161.71 listed in will-spam-for-food.eu.org]
[209.85.161.71 listed in will-spam-for-food.eu.org]
[209.85.161.71 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[209.85.161.71 listed in dnsbl.ahbl.org]
[209.85.161.71 listed in dnsbl.ahbl.org]
[209.85.161.71 listed in dnsbl.ahbl.org]
[209.85.161.71 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[209.85.161.71 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[209.85.161.71 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[209.85.161.71 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[209.85.161.71 listed in dnsbl.ahbl.org]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.161.71 listed in list.dnswl.org]
0.7 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to
Validity was blocked. See
https://knowledge.validity.com/hc/en-us/articles/20961730681243
for more information.
[209.85.161.71 listed in sa-accredit.habeas.com]
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |
1.1 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The
query to Validity was blocked. See
https://knowledge.validity.com/hc/en-us/articles/20961730681243
for more information.
[209.85.161.71 listed in sa-trusted.bondedsender.org]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)
[209.85.161.71 listed in wl.mailspike.net]
0.4 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to
Validity was blocked. See
https://knowledge.validity.com/hc/en-us/articles/20961730681243
for more information.
[209.85.161.71 listed in bl.score.senderscore.com]
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[209.85.161.71 listed in bl.score.senderscore.com]
0.0 NORMAL_HTTP_TO_IP URI: URI host has a public dotted-decimal IPv4
address
0.0 MIME_HTML_MOSTLY BODY: Multipart message mostly text/html MIME
0.7 MPART_ALT_DIFF BODY: HTML and text parts are different
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 HTML_MESSAGE BODY: HTML included in message
0.3 HTML_IMAGE_ONLY_04 BODY: HTML: images with 0-400 bytes of words
0.1 HTML_SHORT_LINK_IMG_1 HTML is very short with a linked image
-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders
3.4 HTML_SHORT_CENTER HTML is very short with CENTER tag
1.5 VOWEL_FROM_6 Impronouncable from header (6 consecutive vowels)
0.0 TVD_SPACE_RATIO No description available.
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam
Subject: {SPAM?} We've-blocked.rgrjd
--000000000000d60120064cbb4d5d
Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes
--000000000000d60120064cbb4d5d
Content-Type: text/html; charset="UTF-8"
--000000000000d60120064cbb4d5d--