German language cloud credential phish from Google Gmail Part 1
Posted by Dave Yadallee on
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Thu, 12 Mar 2026 15:37:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))
(envelope-from)
id 1w0ni2-00000000NMn-3CPZ
for dave@doctor.nl2k.ab.ca;
Thu, 12 Mar 2026 15:36:46 -0600
Resent-From: The Doctor
Resent-Date: Thu, 12 Mar 2026 15:36:46 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-oa1-f71.google.com ([209.85.160.71]:58373)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.98.2 (FreeBSD))
(envelope-from)
id 1w0ko4-000000004j8-3q5U
for doctor@nl2k.ca;
Thu, 12 Mar 2026 12:30:57 -0600
Received: by mail-oa1-f71.google.com with SMTP id 586e51a60fabf-417765eb13cso11231883fac.0
for; Thu, 12 Mar 2026 11:30:02 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=cloudstorage11.jmpghana.com; s=firebase1; t=1773340195; x=1773944995; darn=nl2k.ca;
h=to:from:subject:date:message-id:mime-version:from:to:cc:subject
:date:message-id:reply-to;
bh=5Cbnb6KEfVHABR02leCZX9Vw/AAW9//eWEIncSBJPbw=;
b=l0Yz41KMMw+DbUhH8a9teFVjbPpWdo+BVw2oCiDThSAC4Tbv3TVxtZ/oEqe4iM3y6U
qkZ7wSTt1XC4+/2fG4HwNep7+FlKf8fN5ecSvzyer5pqxRQZ0KLJgmCTcn59501M+Be+
E5AlSJZ0VdimJUkPVO4Ve/xmYhM5E1A1tpmTlPyxIcTc6K8u+OG+hGkh5oE6sPsYYhUG
XaYpsSety7ViuJoqmEwS65BMNsWfj0lOr1NrDoV5NVJZcgWRGpuk4nxJw0qCWUFWE5gQ
iqZoJvzCwMBzBB6Ag6B4N//JUy0fHnaOnPUGnUHDCJqrmWp1mwQvMsmFO8OyR26xlDbS
3Pig==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20230601; t=1773340195; x=1773944995;
h=to:from:subject:date:message-id:mime-version:x-gm-message-state
:from:to:cc:subject:date:message-id:reply-to;
bh=5Cbnb6KEfVHABR02leCZX9Vw/AAW9//eWEIncSBJPbw=;
b=JduJybmYLjcYR7ixmWuFlJvTnasoZdESyvNu9I9ted2XTI/nrB17pIABrOmFq7gWKR
aA22TplD60p8qAdV6qUZFN/sJ8IEDnJHUPTsLk1r1WwnLm5Apykx10S1gqon1pNfOCGV
6lITwfCRAIgQj3j57sNd5eXuOT//b6/+wkgccG8HoqwxDDPN/ZL4gE8sAdiAIzcIu3js
6dzCKSNrCJvOZODVzXDNCLo4FFopyfOFV/0IOh5tDB5U513xO4BjhaI57V3PwY1i9mvG
8ESrfyN2dCukD/7PpVpSRojghWNLEPKi91oP4u5WHG7m+YJpb3nHtRKnbVy7+RokOcA7
NVqQ==
X-Gm-Message-State: AOJu0YyAK90aNSQnaBopS7MpX8GG0+HMjXwru60U3BF3lJR6ku1C5Wf7
pioTqv8STuWqh3pCvS2xXuwy17NJ0GFUbgE3LXAhNHVxqp91mMpd3RR9gNCr6p+24a2+r/3yA1t
nhh0LNguZ7PzUzA==
MIME-Version: 1.0
X-Received: by 2002:a05:6820:169e:b0:67b:baca:a49b with SMTP id
006d021491bc7-67bdaa9000bmr261050eaf.67.1773340195580; Thu, 12 Mar 2026
11:29:55 -0700 (PDT)
Message-ID: <0000000000006c6e72064cd7f037@google.com>
Date: Thu, 12 Mar 2026 18:29:55 +0000
Subject: =?UTF-8?Q?=F0=9F=9A=AB_Ihr_Konto_wird_am_13=2E_M=C3=A4rz_2026_deaktiviert_?=
=?UTF-8?Q?=E2=80=93_Fotos_=26_Videos?=
From: =?UTF-8?Q?iCIoud=2DSupport=C2=AE?=
To: doctor@nl2k.ca
Content-Type: multipart/alternative; boundary="0000000000006c6e64064cd7f034"
--0000000000006c6e64064cd7f034
Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes
Content-Transfer-Encoding: base64
WW91ciBhY2NvdW50IGhhcyBiZWVuIGRlYWN0aXZhdGVkIOKAkyB2ZXJpZmljYXRpb24gcmVxdWly
ZWQuDQoNCg0KDQoNCmlDSW91ZA0KDQoNCg0KUGF5bWVudCBmYWlsZWQg4oCTIFBsZWFzZSB1cGRh
dGUgeW91ciBwYXltZW50IG1ldGhvZC4NCg0KDQoNCmlDSW91ZCBTdG9yYWdlDQoNCllvdXIgYWNj
b3VudCBoYXMgYmVlbiBkZWFjdGl2YXRlZA0KDQpQYXltZW50IG1ldGhvZCB1cGRhdGUgcmVxdWly
ZWQg4pqg77iPIFlvdXIgcGhvdG9zIGFuZCB2aWRlb3Mgd2lsbCBiZSBkZWxldGVkLg0KDQoNCg0K
U3Vic2NyaXB0aW9uIGRldGFpbHMNCg0KDQoNClRhcmlmIFN0b3JhZ2UNCg0KRW1haWwgYWRkcmVz
cyBkb2N0b3JAbmwyay5jYQ0KDQpQcm9kdWN0IGlDbG91ZCBTdG9yYWdlDQoNClJlbmV3YWwgZGF0
ZSAxMy4wMy4yMDI2DQoNCg0KDQoNCg0KQWN0aW9uIHJlcXVpcmVkDQoNClZlcmlmaWNhdGlvbiBy
ZXF1aXJlZCBQbGVhc2UgdXBkYXRlIHlvdXIgcGF5bWVudCBtZXRob2QNCg0KDQoNClVwZGF0ZSBw
YXltZW50IG1ldGhvZA0KDQoNCg0KDQpUaGlzIG5vdGlmaWNhdGlvbiB3YXMgZ2VuZXJhdGVkIGF1
dG9tYXRpY2FsbHkgYW5kIGNvbmNlcm5zIHlvdXIgaUNsb3VkICANCnN0b3JhZ2UgcGxhbi4NCg0K
DQoNCkFwcGxlIFNlcnZpY2VzIMK3IGlDSW91ZCDCtyBTdXBwb3J0DQoNCg0KDQpVbnN1YmhlcmUg
dG8gcmVtb3ZlIHlvdXJzZWxmIGZyb20gb3VyIGVtYWlscyBsaXN0DQo=
--0000000000006c6e64064cd7f034
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
">
Kontomitteilung
J&e=3Ddoctor@nl2k.ca" style=3D"text-decoration:none; color:black;">
=20
ransparent;">
Your account has been deactivated =E2=80=93 verification required.
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Thu, 12 Mar 2026 15:37:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))
(envelope-from
id 1w0ni2-00000000NMn-3CPZ
for dave@doctor.nl2k.ab.ca;
Thu, 12 Mar 2026 15:36:46 -0600
Resent-From: The Doctor
Resent-Date: Thu, 12 Mar 2026 15:36:46 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-oa1-f71.google.com ([209.85.160.71]:58373)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.98.2 (FreeBSD))
(envelope-from
id 1w0ko4-000000004j8-3q5U
for doctor@nl2k.ca;
Thu, 12 Mar 2026 12:30:57 -0600
Received: by mail-oa1-f71.google.com with SMTP id 586e51a60fabf-417765eb13cso11231883fac.0
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=cloudstorage11.jmpghana.com; s=firebase1; t=1773340195; x=1773944995; darn=nl2k.ca;
h=to:from:subject:date:message-id:mime-version:from:to:cc:subject
:date:message-id:reply-to;
bh=5Cbnb6KEfVHABR02leCZX9Vw/AAW9//eWEIncSBJPbw=;
b=l0Yz41KMMw+DbUhH8a9teFVjbPpWdo+BVw2oCiDThSAC4Tbv3TVxtZ/oEqe4iM3y6U
qkZ7wSTt1XC4+/2fG4HwNep7+FlKf8fN5ecSvzyer5pqxRQZ0KLJgmCTcn59501M+Be+
E5AlSJZ0VdimJUkPVO4Ve/xmYhM5E1A1tpmTlPyxIcTc6K8u+OG+hGkh5oE6sPsYYhUG
XaYpsSety7ViuJoqmEwS65BMNsWfj0lOr1NrDoV5NVJZcgWRGpuk4nxJw0qCWUFWE5gQ
iqZoJvzCwMBzBB6Ag6B4N//JUy0fHnaOnPUGnUHDCJqrmWp1mwQvMsmFO8OyR26xlDbS
3Pig==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20230601; t=1773340195; x=1773944995;
h=to:from:subject:date:message-id:mime-version:x-gm-message-state
:from:to:cc:subject:date:message-id:reply-to;
bh=5Cbnb6KEfVHABR02leCZX9Vw/AAW9//eWEIncSBJPbw=;
b=JduJybmYLjcYR7ixmWuFlJvTnasoZdESyvNu9I9ted2XTI/nrB17pIABrOmFq7gWKR
aA22TplD60p8qAdV6qUZFN/sJ8IEDnJHUPTsLk1r1WwnLm5Apykx10S1gqon1pNfOCGV
6lITwfCRAIgQj3j57sNd5eXuOT//b6/+wkgccG8HoqwxDDPN/ZL4gE8sAdiAIzcIu3js
6dzCKSNrCJvOZODVzXDNCLo4FFopyfOFV/0IOh5tDB5U513xO4BjhaI57V3PwY1i9mvG
8ESrfyN2dCukD/7PpVpSRojghWNLEPKi91oP4u5WHG7m+YJpb3nHtRKnbVy7+RokOcA7
NVqQ==
X-Gm-Message-State: AOJu0YyAK90aNSQnaBopS7MpX8GG0+HMjXwru60U3BF3lJR6ku1C5Wf7
pioTqv8STuWqh3pCvS2xXuwy17NJ0GFUbgE3LXAhNHVxqp91mMpd3RR9gNCr6p+24a2+r/3yA1t
nhh0LNguZ7PzUzA==
MIME-Version: 1.0
X-Received: by 2002:a05:6820:169e:b0:67b:baca:a49b with SMTP id
006d021491bc7-67bdaa9000bmr261050eaf.67.1773340195580; Thu, 12 Mar 2026
11:29:55 -0700 (PDT)
Message-ID: <0000000000006c6e72064cd7f037@google.com>
Date: Thu, 12 Mar 2026 18:29:55 +0000
Subject: =?UTF-8?Q?=F0=9F=9A=AB_Ihr_Konto_wird_am_13=2E_M=C3=A4rz_2026_deaktiviert_?=
=?UTF-8?Q?=E2=80=93_Fotos_=26_Videos?=
From: =?UTF-8?Q?iCIoud=2DSupport=C2=AE?=
To: doctor@nl2k.ca
Content-Type: multipart/alternative; boundary="0000000000006c6e64064cd7f034"
--0000000000006c6e64064cd7f034
Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes
Content-Transfer-Encoding: base64
WW91ciBhY2NvdW50IGhhcyBiZWVuIGRlYWN0aXZhdGVkIOKAkyB2ZXJpZmljYXRpb24gcmVxdWly
ZWQuDQoNCg0KDQoNCmlDSW91ZA0KDQoNCg0KUGF5bWVudCBmYWlsZWQg4oCTIFBsZWFzZSB1cGRh
dGUgeW91ciBwYXltZW50IG1ldGhvZC4NCg0KDQoNCmlDSW91ZCBTdG9yYWdlDQoNCllvdXIgYWNj
b3VudCBoYXMgYmVlbiBkZWFjdGl2YXRlZA0KDQpQYXltZW50IG1ldGhvZCB1cGRhdGUgcmVxdWly
ZWQg4pqg77iPIFlvdXIgcGhvdG9zIGFuZCB2aWRlb3Mgd2lsbCBiZSBkZWxldGVkLg0KDQoNCg0K
U3Vic2NyaXB0aW9uIGRldGFpbHMNCg0KDQoNClRhcmlmIFN0b3JhZ2UNCg0KRW1haWwgYWRkcmVz
cyBkb2N0b3JAbmwyay5jYQ0KDQpQcm9kdWN0IGlDbG91ZCBTdG9yYWdlDQoNClJlbmV3YWwgZGF0
ZSAxMy4wMy4yMDI2DQoNCg0KDQoNCg0KQWN0aW9uIHJlcXVpcmVkDQoNClZlcmlmaWNhdGlvbiBy
ZXF1aXJlZCBQbGVhc2UgdXBkYXRlIHlvdXIgcGF5bWVudCBtZXRob2QNCg0KDQoNClVwZGF0ZSBw
YXltZW50IG1ldGhvZA0KDQoNCg0KDQpUaGlzIG5vdGlmaWNhdGlvbiB3YXMgZ2VuZXJhdGVkIGF1
dG9tYXRpY2FsbHkgYW5kIGNvbmNlcm5zIHlvdXIgaUNsb3VkICANCnN0b3JhZ2UgcGxhbi4NCg0K
DQoNCkFwcGxlIFNlcnZpY2VzIMK3IGlDSW91ZCDCtyBTdXBwb3J0DQoNCg0KDQpVbnN1YmhlcmUg
dG8gcmVtb3ZlIHlvdXJzZWxmIGZyb20gb3VyIGVtYWlscyBsaXN0DQo=
--0000000000006c6e64064cd7f034
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
">
J&e=3Ddoctor@nl2k.ca" style=3D"text-decoration:none; color:black;">
=20
ransparent;">
Your account has been deactivated =E2=80=93 verification required.
=3D"0" border=3D"0" style=3D"width:100%;background-color:#f5f5f7;">
pacing=3D"0" border=3D"0" style=3D"max-width:680px;">
pple-system,BlinkMacSystemFont,'SF Pro Display','Segoe UI',Arial,sans-serif=
;font-size:28px;line-height:32px;font-weight:600;color:#1d1d1f;letter-spaci=
ng:-0.3px;">
iCIoud
border-radius:22px;overflow:hidden;box-shadow:0 4px 14px rgba(0,0,0,0.04);"=
>
cellspacing=3D"0" border=3D"0">
olid #f1d1d1;padding:14px 24px;text-align:center;font-family:-apple-system,=
BlinkMacSystemFont,'SF Pro Text','Segoe UI',Arial,sans-serif;font-size:14px=
;line-height:20px;font-weight:600;color:#c9342f;">
Payment failed =E2=80=93 Please update your payment method. =
cellspacing=3D"0" border=3D"0">
e-system,BlinkMacSystemFont,'SF Pro Text','Segoe UI',Arial,sans-serif;font-=
size:13px;line-height:18px;color:#6e6e73;font-weight:600;">
iCIoud Storage