nk.ca credential phishing from Google Gmail
Posted by Dave Yadallee onX-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Thu, 03 Sep 2026 04:29:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))
(envelope-from
id 1x24fv-0000000015L-29Bi
for dave@doctor.nl2k.ab.ca;
Thu, 03 Sep 2026 04:28:07 -0600
Resent-From: The Doctor
Resent-Date: Thu, 3 Sep 2026 04:28:07 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-vk1-f231.google.com ([209.85.221.231]:54615)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.100 (FreeBSD))
(envelope-from
id 1x21Lu-000000001qs-2OrG
for doctor@netknow.ca;
Thu, 03 Sep 2026 00:55:25 -0600
Received: by mail-vk1-f231.google.com with SMTP id 71dfb90a1353d-5c7afda4515so1176202e0c.1
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=brushme-com-ua.20251104.gappssmtp.com; s=20251104; t=1788418431; x=1789023231; darn=netknow.ca;
h=content-type:mime-version:date:content-transfer-encoding:message-id
:subject:to:from:from:to:cc:subject:date:message-id:reply-to
:content-type;
bh=AzZNalKBLFY19lCJbAblyfDVx2F6NBrEHnle6DCzmBo=;
b=q5Rp+TUheP/qDamiTy7xdP88Y1EpDWzhpFqvoplAfFGKAvv0MtvQCGblvMPX1riBwm
AjHbsF6NFk5JzAfJEanS87VNlAVB6bNDqoW3bOwF1yRWgqerL59JbORRl9IAUUNHK3Qc
AXVISIRlEhYHfTuIJDbtqur0p0RN9nFhc+Gd3TFQP1B6xh/Etm/+vMv50/fS5HAyZw1H
jctrhE3Dny5kKHyX6evtbOOGzFDfBABNbH3DhK5jrsC2XY5ygX15dqbWFYFwJDeNDcHq
nhreBO+sUl7dVdOBYQlPQk1lTh64bx6ImlhjG/fGJozzr8kGpwLjDTjYB6ZLpi8HQSYH
i5yQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20251104; t=1788418431; x=1789023231;
h=content-type:mime-version:date:content-transfer-encoding:message-id
:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date
:message-id:reply-to:content-type;
bh=AzZNalKBLFY19lCJbAblyfDVx2F6NBrEHnle6DCzmBo=;
b=K7h71gIz7otS1tvgB6W4qHCgvKoDtReaDNQ7w+ppJAjrz9qQiJ6Mloq3Ul07fWCaoZ
7joXOFcNbHXpDI5mE5hj0SeVh9n3etMz4n+Vcjw4klDNCyt/qSqqpbWPpfDzW08HlkCB
6o1wGBVP2TMVR4x7IP7otDF1VBA3EmQUEIoeLmb1hbx+dhU8wXMwAMfmTnN0Fan1ueBI
Vkz7t1MlrIT59f0XTUvArRAYv6KxR2STcN7Kj0VduMq34ciizom7U1nwMNRQRdHYUGIF
2RyWkPmcxd3357niHBwokSxMcr5RanjhZEqhGeZW+i/ua0XyFd0un4VMSQ0KE/V+FraF
I6IA==
X-Gm-Message-State: AFuF++m1O2HCNB5LGp6zNkZwVPSe4J8klKcTqTLFnHYTeduo99rOOFIS
mXTgm/ZywYssP3cC3uEYeRSnxY5djK3S5/NZbeYv0qbIABWcmibHCJthj/La8m50+xz9gUbhxO4
P4J7uPGCQiKs/pZtcQsw1bUeG6Wq3czLVOWp/087LCaC9Y5Q=
X-Gm-Gg: AYBFou1Qtg5mMXRf9YuCqGYY4j/TcszZn+v12glxxZ/03nXQyMJFM/yTFagcx4wPZSf
/yxyFOQrTFRmstH3zYiu/dr5Al4aE1t0TEfUAvN/EYS8mXZn22wkRPDemcuYO2dTJ7WnN8Dmmiu
yRJn3O8Im6C2wueUKDfU59P0my9qopiGatGLMVyc7n1U3vFDvqUzANMsz+xaXONSOPBI/HQUpkf
6lwgTVyWjaHP8g6dEpApv6KaJfhSrNawqDgBGARBk/f0ra+UyQsP+kYNIxBD+uNdIw/8mL7zZi+
hkQLtWI5Uy60kP1X+eEOuyCeh8UXuJBvA8S0GYIy7VPJQX4HYZObHBrv5W2ir1Kt0m14M2dn8BA
hsTo/HDozNjT6pk2E
X-Received: by 2002:a05:6122:3d0b:b0:5bd:af82:fd9e with SMTP id 71dfb90a1353d-5c7d288d348mr4044878e0c.8.1788418431077;
Wed, 02 Sep 2026 23:53:51 -0700 (PDT)
Received: from brushmestore.de ([64.177.41.90])
by smtp-relay.gmail.com with ESMTPS id 71dfb90a1353d-5c7cd885a69sm1258836e0c.5.2026.09.02.23.53.51
for
(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
Wed, 02 Sep 2026 23:53:51 -0700 (PDT)
X-Relaying-Domain: brushmestore.de
From: Admin
To: doctor@netknow.ca
Subject: Email Deactivation
Message-ID: <1dbca495-9e30-199e-91ea-72b3e2208f25@brushmestore.de>
Content-Transfer-Encoding: quoted-printable
Date: Thu, 03 Sep 2026 06:53:49 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=utf-8
X-Spam_score: 5.8
X-Spam_score_int: 58
X-Spam_bar: +++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Account Deactivation Service Notice Account Deactivation
Service Notice
Content analysis details: (5.8 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[64.177.41.90 listed in will-spam-for-food.eu.org]
[64.177.41.90 listed in will-spam-for-food.eu.org]
[64.177.41.90 listed in will-spam-for-food.eu.org]
[64.177.41.90 listed in will-spam-for-food.eu.org]
[64.177.41.90 listed in will-spam-for-food.eu.org]
[64.177.41.90 listed in will-spam-for-food.eu.org]
[64.177.41.90 listed in will-spam-for-food.eu.org]
[64.177.41.90 listed in will-spam-for-food.eu.org]
[209.85.221.231 listed in will-spam-for-food.eu.org]
[209.85.221.231 listed in will-spam-for-food.eu.org]
[209.85.221.231 listed in will-spam-for-food.eu.org]
[209.85.221.231 listed in will-spam-for-food.eu.org]
[209.85.221.231 listed in will-spam-for-food.eu.org]
[209.85.221.231 listed in will-spam-for-food.eu.org]
[209.85.221.231 listed in will-spam-for-food.eu.org]
[209.85.221.231 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[209.85.221.231 listed in dnsbl.ahbl.org]
[209.85.221.231 listed in dnsbl.ahbl.org]
[209.85.221.231 listed in dnsbl.ahbl.org]
[209.85.221.231 listed in dnsbl.ahbl.org]
[64.177.41.90 listed in dnsbl.ahbl.org]
[64.177.41.90 listed in dnsbl.ahbl.org]
[64.177.41.90 listed in dnsbl.ahbl.org]
[64.177.41.90 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[209.85.221.231 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[209.85.221.231 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[209.85.221.231 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[209.85.221.231 listed in dnsbl.ahbl.org]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.221.231 listed in list.dnswl.org]
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.221.231 listed in wl.mailspike.net]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |
-0.0 SPF_PASS SPF: sender matches SPF record
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[209.85.221.231 listed in bl.score.senderscore.com]
0.0 NORMAL_HTTP_TO_IP URI: URI host has a public dotted-decimal IPv4
address
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.1 MXG_EMAIL_FRAG BODY: URI with email in fragment
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.0 NO_RDNS2 Sending MTA has no reverse DNS
1.5 GOOG_REDIR_HTML_ONLY Google redirect to obscure spamvertised website
+ HTML only
2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars
Subject: {SPAM?} Email Deactivation
initial-scale=3D1.0">
Arial, sans-serif; background-color: rgb(243, 242, 241);'>
=20
border=3D"0" cellspacing=3D"0" cellpadding=3D"0">
=20
background-color: rgb(255, 255, 255);" border=3D"0" cellspacing=3D"0" =
cellpadding=3D"0">
=20
rgb(43, 43, 43); font-family: "Segoe UI", Tahoma, Arial, sans-serif; =
font-size: 28px; font-weight: 600;'>
Account Deactivation Service Notice
=20
, 43, 43); line-height: 22px; font-family: "Segoe UI", Tahoma, Arial, =
sans-serif; font-size: 15px;'>
We are deactivating all inactive accounts
=20
, 43, 43); line-height: 22px; font-family: "Segoe UI", Tahoma, Arial, =
sans-serif; font-size: 15px;'>
Please confirm if your doctor@=
netknow.ca is still active by verifying now.
=20
, 43, 43); line-height: 22px; font-family: "Segoe UI", Tahoma, Arial, =
sans-serif; font-size: 15px;'>
In 48 hours, all Inactive accounts will be =
deactivated...
=20
border=3D"0" cellspacing=3D"0" cellpadding=3D"0">
background-color: rgb(0, 120, 212);">
color: rgb(255, 255, 255); font-family: "Segoe UI", Tahoma, Arial, =
sans-serif; font-size: 14px; font-weight: 500; text-decoration: none; =
display: inline-block;' href=3D"http://www.google.com/url?=
q=3Dhttp%3A%2F%2F153.122.129.67%2F%2Feccube%2F&sa=3DD&sntz=3D1&=
usg=3DAOvVaw3Zgzew1HOwpovnba0e1Js1#doctor@netknow.ca">
Verify account
=20
=20
background-color: rgb(243, 242, 241);" border=3D"0" cellspacing=3D"0" =
cellpadding=3D"0">
rgb(96, 94, 92); line-height: 18px; font-family: "Segoe UI", Tahoma, Arial=
, sans-serif; font-size: 12px;'>
=20
12px; text-decoration: underline;" href=3D"#&PRIVACYLINK;#">
Privacy Statement
=20
=20
13px; text-decoration: none;" href=3D"#&PORTALLINK;#">
netknow PORTAL
=20
=20
=20