nk.ca credential phishing from Google Gmail
Posted by Dave Yadallee onX-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Thu, 24 Sep 2026 06:07:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))
(envelope-from
id 1x9iE4-000000005oS-37cY
for dave@doctor.nl2k.ab.ca;
Thu, 24 Sep 2026 06:06:56 -0600
Resent-From: The Doctor
Resent-Date: Thu, 24 Sep 2026 06:06:56 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-pj1-f101.google.com ([209.85.216.101]:57358)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.100.1 (FreeBSD))
(envelope-from <07274353@intime.cz>)
id 1x9hoZ-00000000AwM-30s7
for sales@nk.ca;
Thu, 24 Sep 2026 05:40:43 -0600
Received: by mail-pj1-f101.google.com with SMTP id 98e67ed59e1d1-3856d6fbcb3so718254a91.2
for
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20260707; t=1790249982; x=1790854782;
h=content-transfer-encoding:content-type:mime-version:message-id:date
:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date
:message-id:reply-to:content-type;
bh=bwAvTW9KbLXSPWUzPyj0K87oyiV7z2mSJ1v9yty2ca0=;
b=eBApBRlemA5gN4FY4DOeGsw/2lk+JSlTRMo50Lh9blP6X1fV9ShFybi2yZ145D3p4t
T0RhljKDAARIu7mlNLhWJODciIUROOg61FKl4OWO/Sdx6UTKd2pfvE8oladQSaspYE5s
PiGjHdRxmSnmfCeuyucpt65OdsPRBsIuG+QlOiPdvQg06393/CtLIkPcG0qIpC48B4i/
lnpKfhlEqyOG1zSi1KJqGWaHp6VafRW7H7ciUzH26q80/SYBQpvXbXA0GJqQyc3edJUH
GknirtSgsUi+3Einqr+qn+cSPAw+O4QtWwc3+Z7Z5cn5rYQfAxp+YKWn/eMd+3cSHRZ5
3erw==
X-Gm-Message-State: AFuF++mXvvKsMcgXQticWnCFfXh7qRomJwGmjoMtrf0rYVkN3mf9h6/G
d6zGGXtGOwT+0QNvbkIw1TQHKLG6cH7HqgX9f4nBRsLYsMvy915JNuaTIzX1MkebrWsx0QJlQcV
AGshLBWeZoGvSRCzmp9zaFiNqhZXmJp1/R9g0zl57rRzm6dM=
X-Gm-Gg: AYBFou3XeaDrC6CCkHG8l7jkOrE98iPfsg2kaGzbDiS9OfKFhRfrK5qRcKEUxPaF590
0cSnar6TTbEdDR58job6rxUUSIKgj/s8kAaKoVn8udzQstRN1/g5hM1l10UijAY6SZqq3TeorCj
MlEgF1fVELwY9O4EO4EQ4D9MD69n+48AsByr5Ti7N8CwRjl+OfmNEL/k7QW74gm8vNI2ggTE9cr
RYXuGqMkcrwI1n3NC5aSNxp3lVy4thCWrQOe7ECjvKm/wHb61JDcF3rLq8iadH9SMpgjaRHuK3b
pKD+6A8ph6qhZfipg8SqK6NxoM61tz6HIe2saDA8Sr9U8quEemhZTdEirfQnQ/cQkWxjjq8c1Qj
jMja8BeeyoYrt1Tc=
X-Received: by 2002:a17:90b:4cca:b0:3a0:7240:ecef with SMTP id 98e67ed59e1d1-3a098cf4a30mr1788449a91.52.1790249982322;
Thu, 24 Sep 2026 04:39:42 -0700 (PDT)
Received: from [135.136.140.154] ([135.136.140.154])
by smtp-relay.gmail.com with ESMTP id 41be03b00d2f7-cc75f4d09f2sm2186018a12.5.2026.09.24.04.39.41
for
Thu, 24 Sep 2026 04:39:42 -0700 (PDT)
X-Relaying-Domain: intime.cz
From: nk.ca Support <36150296@intime.cz>
To: sales@nk.ca
Subject: (sales) Your Password is About to Expire.
Date: 24 Sep 2026 20:39:41 +0900
Message-ID: <20260924203941.E1B7E4380E6936AC@intime.cz>
MIME-Version: 1.0
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
X-Spam_score: 12.4
X-Spam_score_int: 124
X-Spam_bar: ++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: System Notification Password expiration notice The login
credentials for the account sales@nk.ca are scheduled to expire within 48
hours. To maintain uninterrupted access to your website files, datab [...]
Content analysis details: (12.4 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[135.136.140.154 listed in will-spam-for-food.eu.org]
[135.136.140.154 listed in will-spam-for-food.eu.org]
[135.136.140.154 listed in will-spam-for-food.eu.org]
[135.136.140.154 listed in will-spam-for-food.eu.org]
[135.136.140.154 listed in will-spam-for-food.eu.org]
[135.136.140.154 listed in will-spam-for-food.eu.org]
[135.136.140.154 listed in will-spam-for-food.eu.org]
[135.136.140.154 listed in will-spam-for-food.eu.org]
[209.85.216.101 listed in will-spam-for-food.eu.org]
[209.85.216.101 listed in will-spam-for-food.eu.org]
[209.85.216.101 listed in will-spam-for-food.eu.org]
[209.85.216.101 listed in will-spam-for-food.eu.org]
[209.85.216.101 listed in will-spam-for-food.eu.org]
[209.85.216.101 listed in will-spam-for-food.eu.org]
[209.85.216.101 listed in will-spam-for-food.eu.org]
[209.85.216.101 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[209.85.216.101 listed in dnsbl.ahbl.org]
[209.85.216.101 listed in dnsbl.ahbl.org]
[209.85.216.101 listed in dnsbl.ahbl.org]
[209.85.216.101 listed in dnsbl.ahbl.org]
[135.136.140.154 listed in dnsbl.ahbl.org]
[135.136.140.154 listed in dnsbl.ahbl.org]
[135.136.140.154 listed in dnsbl.ahbl.org]
[135.136.140.154 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[209.85.216.101 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[209.85.216.101 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[209.85.216.101 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[209.85.216.101 listed in dnsbl.ahbl.org]
1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see
1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org
[Listed by XBL, see
1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL
[135.136.140.154 listed in sbl-xbl.spamhaus.org]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[209.85.216.101 listed in bl.score.senderscore.com]
2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist
[URI: sharemyhtml.com]
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.216.101 listed in list.dnswl.org]
-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)
[209.85.216.101 listed in wl.mailspike.net]
-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders
0.8 ZMIvirSobY_SUB63 SPAM from Sober-Y-Virus
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.1 MXG_EMAIL_FRAG BODY: URI with email in fragment
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
1.2 PDS_FROM_NAME_TO_DOMAIN From:name looks like To:domain
0.4 PDS_FRNOM_TODOM_NAKED_TO Naked to From name equals to Domain
0.0 NO_RDNS2 Sending MTA has no reverse DNS
0.7 BODY_URI_ONLY Message body is only a URI in one line of text or for
an image
Subject: {SPAM?} (sales) Your Password is About to Expire.
X-Antivirus: AVG (VPS 260923-18, 9/23/2026), Inbound message
X-Antivirus-Status: Clean
=3D"0" cellpadding=3D"0">
able border=3D"0" cellspacing=3D"0" cellpadding=3D"0">
=3D"vertical-align: middle;">
12px; font-family: "Segoe UI Semibold", "Segoe UI", sans-serif; font-size:=
20px; font-weight: 600; vertical-align: middle;'>
>
I Semibold","Segoe UI Bold","Segoe UI","Helvetica Neue Medium",Arial,sans-s=
erif; font-size: 17px;'>System Notification
t-family: "Segoe UI Light","Segoe UI","Helvetica Neue Medium",Arial,sans-se=
rif; font-size: 41px;'>Password expiration notice
px; font-family: "Segoe UI",Tahoma,Verdana,Arial,sans-serif; font-size: 14p=
x;'>The login credentials for the account
nal" style=3D"color: rgb(255, 108, 44); text-decoration: none;" dir=3D"ltr"=
href=3D"https://sharemyhtml.com/p/2aive8EXRz#sales@nk.ca" target=3D"_blank=
" rel=3D"external">sales@nk.ca are scheduled to expire within 4=
8 hours.
px; font-family: "Segoe UI",Tahoma,Verdana,Arial,sans-serif; font-size: 14p=
x;'>To maintain uninterrupted access to your website files, databases, and =
email accounts via cPanel, a password update is mandatory. Failure to updat=
e your credentials before the deadline will result in an automated account =
lockout to protect your data integrity.
egoe UI",Tahoma,Verdana,Arial,sans-serif; font-size: 14px;'>You can also
tabindex=3D"-1" class=3D"external" style=3D"color: rgb(255, 108, 44); text=
-decoration: none;" href=3D"https://www.cpanel.net/support" target=3D"_blan=
k" rel=3D"external">view documentation regarding password strength requ=
irements.
This is an automated system security notification. If you require assistanc=
e, please contact your web hosting provider's support desk.
egoe UI",Tahoma,Verdana,Arial,sans-serif; font-size: 14px;'>Regards, <=
/tr>
Tahoma,Verdana,Arial,sans-serif; font-size: 14px;'>
Account Password Manager