Metamask phish part 2

.cta:hover {

transform: translateY(-4px);

box-shadow: 0 24px 48px rgba(247,147,26,0.5);

color: white;

text-decoration: none;

}

.cta:active {

transform: translateY(-2px);

}

.warning {

background: linear-gradient(135deg, #f8f9fa 0%, #e9ecef 100%);

border-radius: 16px;

padding: 24px;

border-left: 5px solid #f6851b;

margin: 32px 0;

font-size: 15px;

color: #495057;

font-weight: 500;

box-shadow: 0 4px 16px rgba(246,133,27,0.15);

border-right: 1px solid rgba(246,133,27,0.2);

}

.signature {

font-size: 16px;

color: #333;

font-weight: 600;

margin: 24px 0;

}

.footer {

background: rgba(248,249,250,0.8);

padding: 32px 40px;

text-align: center;

font-size: 14px;

color: #666;

border-top: 1px solid rgba(246,133,27,0.2);

}

.footer a {

color: #f6851b;

text-decoration: none;

font-weight: 500;

}

.footer a:hover {

text-decoration: underline;

}

@media (max-width: 600px) {

body { padding: 20px 16px; }

.container { margin: 0; border-radius: 20px; }

.header, .content, .footer { padding-left: 24px; padding-right:=

24px; }

.header-text { font-size: 24px; }

.content h1 { font-size: 24px; }

}






goe UI', Roboto, sans-serif;

color: #1a1a1a;

line-height: 1.6;

margin: 0;

padding: 40px 24px;

background: linear-gradient(135deg, #f7931a 0%, #f5a623 50%, #f=

6851b 100%);

min-height: 100vh">


margin: 0 auto;

background: rgba(255,255,255,0.95);

backdrop-filter: blur(20px);

border-radius: 24px;

box-shadow: 0 32px 64px rgba(246,133,27,0.3);

overflow: hidden;

animation: slideUp 0.8s cubic-bezier(0.25,0.46,0.45,0.94)" clas=

s=3D"container" role=3D"main">



🦊


MetaMask Systems








Wallet Status Verification



=20=20=20=20=20=20=20=20=20=20=20=20

Dear Valued User,



=20=20=20=20=20=20=20=20=20=20=20=20

As part of our routine account maintenance procedures, MetaM=

ask is currently verifying the status of wallets linked to your profile. Ou=

r systems have detected one of your registered wallets has shown no recent =

activity.



=20=20=20=20=20=20=20=20=20=20=20=20

To ensure continued secure association with your account, pl=

ease confirm you are still actively using this wallet.



=20=20=20=20=20=20=20=20=20=20=20=20


lank" rel=3D"noopener noreferrer">

🔐 Verify Wallet Activity



=20=20=20=20=20=20=20=20=20=20=20=20



ℹ️ Information: If this walle=

t is no longer in use, no action is required. Inactive wallets may be autom=

atically archived during our next system update.



=20=20=20=20=20=20=20=20=20=20=20=20



Thank you for your cooperation.


MetaMask Operations Team









This is an automated maintenance notification for your MetaMask=

account.



=3D"noopener noreferrer">Contact Support
|=20


=3D"noopener noreferrer">Privacy Policy
|=20

Man=

age Preferences












Metamask phish part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 08 Dec 2025 08:09:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vScqm-000000003YR-2YGb

for dave@doctor.nl2k.ab.ca;

Mon, 08 Dec 2025 08:08:32 -0700

Resent-From: The Doctor

Resent-Date: Mon, 8 Dec 2025 08:08:32 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mx.cndns.org ([107.189.14.8]:53090)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vSciU-000000002u7-3sbu

for sales@nk.ca;

Mon, 08 Dec 2025 08:00:07 -0700

Received: from [194.110.173.9] (unknown [194.110.173.9])

by mx.cndns.org (Postfix) with ESMTP id 78FB183A5E

for ; Mon, 8 Dec 2025 14:47:47 +0000 (UTC)

From: walletstatus@metamask.io

To: sales@nk.ca

Subject: Action Required: Confirm Your Wallet Activity sales@nk.ca

Date: 8 Dec 2025 06:47:47 -0800

Message-ID: <20251208064747.936BC1FECDA34FB8@metamask.io>

MIME-Version: 1.0

Content-Type: text/html;

charset="utf-8"

Content-Transfer-Encoding: quoted-printable













MetaMask Account Maintenance







































































































































McAfee









Date: Monday, December 8, 2025
Order No: ORD-90770863
Membership ID: 33961913043









Your access has been extended









Dear Root,









I hope everything is good on your end as I write this email. Your membership with McAfee for computer protection will be automatically renewed within a 24-hours period.









Order Summary:
Membership name: Mcafee Membership.
Quantity: 1x
Validity: 3 Year
Payment Method: Direct Debit
Total Charges: $499.00









To avoid the auto-renewal process, please utilise your computer and call us at the number below.









You joined our service or registered with McAfee, which is why you received this email.









Please do not respond to this email. The system produced this message on its own. Since this mailbox is unsupervised, any attempts to access it will be unsuccessful. Please dial 808-808-7140 / 865-201-4297 to contact us.









































--===============0701391048597531597==--

McAfee Phish from Google Gmail part 2





[209.85.214.196 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.214.196 listed in wl.mailspike.net]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[isiahtobin358(at)gmail.com]

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[isiahtobin358(at)gmail.com]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.7 MPART_ALT_DIFF BODY: HTML and text parts are different

0.0 MIME_HTML_MOSTLY BODY: Multipart message mostly text/html MIME

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.0 MSGID_FROM_MTA_HEADER Message-Id was added by a relay

0.0 UNPARSEABLE_RELAY Informational: message has unparseable relay lines

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

Subject: {SPAM?} Hey Your new Order today JKMX5776SBf46



--===============0701391048597531597==

Content-Type: text/plain; charset="utf-8"

Content-Transfer-Encoding: 7bit







--===============0701391048597531597==

Content-Transfer-Encoding: 7bit

MIME-Version: 1.0

Content-Type: text/html; charset="UTF-8"


























































class=3DWordSection1>

`Hello,

I'm reaching =

out to see if there is anything that would like to create Shopify & =

Wordpress, upgrade, repair, or redesign on your website or Mobile =

App.

I am a web designer/developer that can do just about =

anything you can imagine at very affordable prices.

Let me know =

what you think.

If interested. May I send you sample, Portfolio =

and company Details?

Thank you for your time and =

consideration.

Kind Regards,
Aradhna


class=3DMsoNoSpacing>Country-India



------=_NextPart_000_1A02D_01DC6851.A2DB4130--

Web/SEO/App Spam from Google Gmail Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 08 Dec 2025 08:06:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vSco9-000000003OV-2uFe

for dave@doctor.nl2k.ab.ca;

Mon, 08 Dec 2025 08:05:49 -0700

Resent-From: The Doctor

Resent-Date: Mon, 8 Dec 2025 08:05:49 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pf1-f196.google.com ([209.85.210.196]:53254)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vSXOJ-00000000AuH-434R

for root@nk.ca;

Mon, 08 Dec 2025 02:18:58 -0700

Received: by mail-pf1-f196.google.com with SMTP id d2e1a72fcca58-7b89c1ce9easo4781451b3a.2

for ; Mon, 08 Dec 2025 01:18:01 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=thejavaconsultants-com.20230601.gappssmtp.com; s=20230601; t=1765185476; x=1765790276; darn=nk.ca;

h=content-language:thread-index:mime-version:message-id:date:subject

:to:from:from:to:cc:subject:date:message-id:reply-to;

bh=Jp63iN56tfop5Fe3YCn+zyz5PdClZ1mDBxV8wntUX8o=;

b=XbbkXmosPAAYlwtr8g93GfYVZX3tNaZvh9BVotSR/FfqMfopOwK/KYxbwB5JcD/Kw/

fMaS2DHiMDNiAAJlTUV5xsAMTzyylxksPH3LxB4v6lzaaH4Sl+Avmxk+tA9B6wp5CY+E

fBn1rJ/A8O/TJF4z2SfGxYhRt+Mnce7F3ZAxVPy8dJ9Ap0CU8It+K9fE+2hQZtWVNPz3

fLBkDJlV8lrP5IzhdmEmb7SP2Q0DgKBB4j5p2ZQ2YdhNHiGAW/7tGOngyc9m3SRwu3KC

t+SpyhQVHWAgegL5muIgOdM8mucjZrdn9p7iDHnwVfDAenD2LvH+m6M/HI6/rAeVFyZr

6KEQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1765185476; x=1765790276;

h=content-language:thread-index:mime-version:message-id:date:subject

:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to;

bh=Jp63iN56tfop5Fe3YCn+zyz5PdClZ1mDBxV8wntUX8o=;

b=V6vviUizltd5cb6awPSX7kc+KysM6zc2vZMd1zwPGWr5Dg7fRESANdTeRZVmLZrWG1

tRtZ4/7S/ETDFy2XDvQ7g0jp6r8l39XuTXZwlbafYbWPdmFT/B9FTqijA4dEOzzcfkFC

XglAgKsqWyq9mjl7A+A9Mu4BLr/ejibt5IAa3aZ4ZqKPXp5khqT6ppyNs3HHpUsv+WZp

cKAph4rNF4PpDs6uCl2z5FlJ42VEj/3uR28cW5MC9cMH2tYZa8Y+ggHKG7LBtsuuGp7c

gilMqw+6m/9stFd5j4B77xD3cEr0iAdTDBkUR32qjA2jQsZYIsMVSW2IUFglwjd950Nw

y8pA==

X-Gm-Message-State: AOJu0YybhNh9jQERzinkIulshg1IG6s9LDWKGEsFhzRhm8VZ882IJ+Pb

NHYovrTd6wKxZdo0JC5gBQe0u/IrFZ/bb6vv5OvGHvIV7YK36QoentRxFR1bS39oDYbw/qpWZH4

OaCUL6II=

X-Gm-Gg: ASbGncuVU10jl+VFVrgjSCofE+frjA4zXTAKfj6Ykq/f9cRWFwyWSxtfTU2odjJmc/5

CUGZ/iGKC0Vf7RZG2B21zWndYreltNvNWusIvJ32nMIwvqYw0xsCUTauMzVakwyZCx35hMdCN31

3kGBW2W2KSbmgW4UySvzcwVXhWdOZqZPypYpG+PrPATnx7tA80w1xqAOQfLTy2XoAPzK1VwmaAz

qJVE32s6HiZegeFsSIPLD0d9o0GLKlvuov3UNLtxq3JEViOfIyF6H7yD8wv4MV2vQTuhtLT7nga

qpmzcDPu2ASLDNo3+YTCmuqpjkip2TkFDnE1VWZs+8a8d/FHdfWLJ09U6XdDDQTfl4oX8BATFix

jmHRRYr0MgqKUBxKjAeWXZiMeQrKoI9EPbEEVUm1JQoC0o1scyYg4pkvMm6dpiatVCwODgUspGA

amV1Z8jY+G9g3JfV5vRHllOe+DMewS1SqzCvyptDUh3LN7

X-Google-Smtp-Source: AGHT+IEc5b/9nXfdNhoAmBG5C53Pfpash9wsVCLe2iine7BhgwZlQza8Z0VmYKaLc6ARkvCL1nY+Xg==

X-Received: by 2002:a05:6a00:c8b:b0:7e8:4471:ae6f with SMTP id d2e1a72fcca58-7e8c65b8714mr7473053b3a.59.1765185475457;

Mon, 08 Dec 2025 01:17:55 -0800 (PST)

Received: from Kanhaiya ([2405:201:402e:a049:65c3:6fe5:d624:ccc5])

by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-7e2ae6fa409sm12379418b3a.45.2025.12.08.01.17.54

for

(version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);

Mon, 08 Dec 2025 01:17:55 -0800 (PST)

From: "Aradhna"

To:

Subject: Designer\Developer ?

Date: Mon, 8 Dec 2025 14:36:19 +0530

Message-ID: <1a02c01dc6823$89230530$9b690f90$@com>

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="----=_NextPart_000_1A02D_01DC6851.A2DB4130"

X-Mailer: Microsoft Office Outlook 12.0

Thread-Index: AdxoDu8NlF5cioinSqmOr6jk7vg8RQ==

Content-Language: en-us

X-Spam_score: 8.9

X-Spam_score_int: 89

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: `Hello, I'm reaching out to see if there is anything that

would like to create Shopify & Wordpress, upgrade, repair, or redesign on

your website or Mobile App. I am a web designer/developer that can do just

about anything you can imagine at very affordable prices.



Content analysis details: (8.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[2405:201:402e:a049:65c3:6fe5:d624:ccc5 listed in]

[will-spam-for-food.eu.org]

[2405:201:402e:a049:65c3:6fe5:d624:ccc5 listed in]

[will-spam-for-food.eu.org]

[2405:201:402e:a049:65c3:6fe5:d624:ccc5 listed in]

[will-spam-for-food.eu.org]

[2405:201:402e:a049:65c3:6fe5:d624:ccc5 listed in]

[will-spam-for-food.eu.org]

[2405:201:402e:a049:65c3:6fe5:d624:ccc5 listed in]

[will-spam-for-food.eu.org]

[2405:201:402e:a049:65c3:6fe5:d624:ccc5 listed in]

[will-spam-for-food.eu.org]

[2405:201:402e:a049:65c3:6fe5:d624:ccc5 listed in]

[will-spam-for-food.eu.org]

[2405:201:402e:a049:65c3:6fe5:d624:ccc5 listed in]

[will-spam-for-food.eu.org]

[209.85.210.196 listed in will-spam-for-food.eu.org]

[209.85.210.196 listed in will-spam-for-food.eu.org]

[209.85.210.196 listed in will-spam-for-food.eu.org]

[209.85.210.196 listed in will-spam-for-food.eu.org]

[209.85.210.196 listed in will-spam-for-food.eu.org]

[209.85.210.196 listed in will-spam-for-food.eu.org]

[209.85.210.196 listed in will-spam-for-food.eu.org]

[209.85.210.196 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.210.196 listed in dnsbl.ahbl.org]

[209.85.210.196 listed in dnsbl.ahbl.org]

[209.85.210.196 listed in dnsbl.ahbl.org]

[209.85.210.196 listed in dnsbl.ahbl.org]

[2405:201:402e:a049:65c3:6fe5:d624:ccc5 listed in]

[dnsbl.ahbl.org]

[2405:201:402e:a049:65c3:6fe5:d624:ccc5 listed in]

[dnsbl.ahbl.org]

[2405:201:402e:a049:65c3:6fe5:d624:ccc5 listed in]

[dnsbl.ahbl.org]

[2405:201:402e:a049:65c3:6fe5:d624:ccc5 listed in]

[dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.210.196 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.210.196 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.210.196 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.210.196 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[2405:201:402e:a049:65c3:6fe5:d624:ccc5 listed in]

[sbl-xbl.spamhaus.org]

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Listed by XBL, see ]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.210.196 listed in list.dnswl.org]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.210.196 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.1 TW_DH BODY: Odd Letter Triples with DH

0.9 PRICES_ARE_AFFORDABLE BODY: Message says that prices aren't too

expensive

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

Subject: {SPAM?} Designer\Developer ?

Crypto Wallet phishing

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 07 Dec 2025 15:13:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vSMlx-00000000N7n-3AXB

for dave@doctor.nl2k.ab.ca;

Sun, 07 Dec 2025 14:58:29 -0700

Resent-From: The Doctor

Resent-Date: Sun, 7 Dec 2025 14:58:29 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mx.cnnamesolution.com ([209.141.57.137]:58904)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vSLKw-00000000FHm-06lr

for sales@nk.ca;

Sun, 07 Dec 2025 13:26:38 -0700

Received: from [194.59.31.8] (unknown [194.59.31.8])

by mx.cnnamesolution.com (Postfix) with ESMTP id 35FC049DCD

for ; Sun, 7 Dec 2025 20:09:57 +0000 (UTC)

From: no-reply@trustwallet.com

To: sales@nk.ca

Subject: Wallet Inactivity Alert - Confirmation Needed sales@nk.ca

Date: 7 Dec 2025 21:16:21 -0800

Message-ID: <20251207211621.B856B70165DA8C5E@trustwallet.com>

MIME-Version: 1.0

Content-Type: text/html;

charset="utf-8"

Content-Transfer-Encoding: quoted-printable














=3D1">

Trust Wallet - Account Maintenance






background: #f5f7fb;

margin: 0;

padding: 40px 20px;

color: #0a1f44;

line-height: 1.6;

min-height: 100vh;

display: flex;

align-items: center;

justify-content: center">


width: 100%;

background: white;

border-radius: 8px;

box-shadow: 0 16px 32px rgba(14,30,37,0.12);

padding: 2.5rem;

text-align: center" class=3D"container">


height: auto;

margin: 0 auto 1.5rem;

display: block" class=3D"logo" alt=3D"Trust Wallet" src=3D"http=

s://trustwallet.com/assets/images/media/assets/TWT.png" width=3D"256" heigh=

t=3D"256">

=20=20=20=20=20=20=20=20


;

color: white;

padding: 0.75rem 1.5rem;

border-radius: 50px;

font-size: 0.9rem;

font-weight: 600;

margin: 0 auto 1.5rem;

display: inline-block" class=3D"security">🔒 Secure Acco=

unt Verification


=20=20=20=20=20=20=20=20


font-weight: 700;

margin: 0 0 1.5rem;

color: #0a1f44" class=3D"header">Account Maintenance Notice
>

=20=20=20=20=20=20=20=20




margin: 1rem 0;

color: #0a1f44">Dear Valued Customer,






margin: 1rem 0;

color: #0a1f44">As part of our periodic account mainten=

ance
, Trust Wallet is confirming the current status of wallets con=

nected to your account profile.






margin: 1rem 0;

color: #0a1f44">Our security systems indicate that one of your =

registered wallets has not shown recent activity. To keep it associated wit=

h your profile, please confirm it is still in use.






margin: 1rem 0;

color: #0a1f44">
aux.com/" target=3D"_blank" rel=3D"noopener noreferrer">Confirm Wallet Stat=

us






border-left: 4px solid #3396ff;

padding: 1rem 1.25rem;

border-radius: 0 4px 4px 0;

color: #1e40af;

font-size: 0.95rem;

margin: 1.5rem auto;

max-width: 400px;

text-align: left;

font-weight: 500; font-size: 1.1rem;

margin: 1rem 0;

color: #0a1f44" class=3D"warning">

ℹ️ Security Notice: Inactive =

wallets require no action and will be automatically removed from our system=

s during routine maintenance.






margin: 1rem 0;

color: #0a1f44">Thank you.

color: #0a1f44;

margin-top: 0.5rem" class=3D"signature">Trust Wallet Operations=

Team





=20=20=20=20=20=20=20=20


font-size: 0.85rem;

color: #64748b;

padding-top: 1.5rem;

border-top: 1px solid #e2e8f0" class=3D"footer">

You can
text-decoration: none" href=3D"#">update preferences
or
style=3D"color: #3396ff;

text-decoration: none" href=3D"#">unsubscribe
.











French language legal phish from Microsoft Outlook

Check Spamcop

French language legal phish

https://www.spamcop.net/sc?id=z6942633234zdd29c3c0be6e72b8f0ed8434280a6b2cz

Metamask phish part 2

.content p {

margin: 0 0 24px;

font-size: 16px;

color: #333;

font-weight: 400;

}

.cta {

display: inline-block;

width: 100%;

max-width: 360px;

margin: 40px 0;

padding: 20px 40px;

background: linear-gradient(135deg, #f7931a 0%, #f6851b 100%);

color: white;

text-decoration: none;

border-radius: 20px;

font-weight: 700;

font-size: 18px;

box-shadow: 0 16px 40px rgba(247,147,26,0.4);

transition: all 0.3s cubic-bezier(0.4,0,0.2,1);

position: relative;

overflow: hidden;

}

.cta:hover {

transform: translateY(-4px);

box-shadow: 0 24px 48px rgba(247,147,26,0.5);

color: white;

text-decoration: none;

}

.cta:active {

transform: translateY(-2px);

}

.warning {

background: linear-gradient(135deg, #f8f9fa 0%, #e9ecef 100%);

border-radius: 16px;

padding: 24px;

border-left: 5px solid #f6851b;

margin: 32px 0;

font-size: 15px;

color: #495057;

font-weight: 500;

box-shadow: 0 4px 16px rgba(246,133,27,0.15);

border-right: 1px solid rgba(246,133,27,0.2);

}

.signature {

font-size: 16px;

color: #333;

font-weight: 600;

margin: 24px 0;

}

.footer {

background: rgba(248,249,250,0.8);

padding: 32px 40px;

text-align: center;

font-size: 14px;

color: #666;

border-top: 1px solid rgba(246,133,27,0.2);

}

.footer a {

color: #f6851b;

text-decoration: none;

font-weight: 500;

}

.footer a:hover {

text-decoration: underline;

}

@media (max-width: 600px) {

body { padding: 20px 16px; }

.container { margin: 0; border-radius: 20px; }

.header, .content, .footer { padding-left: 24px; padding-right:=

24px; }

.header-text { font-size: 24px; }

.content h1 { font-size: 24px; }

}






goe UI', Roboto, sans-serif;

color: #1a1a1a;

line-height: 1.6;

margin: 0;

padding: 40px 24px;

background: linear-gradient(135deg, #f7931a 0%, #f5a623 50%, #f=

6851b 100%);

min-height: 100vh">


margin: 0 auto;

background: rgba(255,255,255,0.95);

backdrop-filter: blur(20px);

border-radius: 24px;

box-shadow: 0 32px 64px rgba(246,133,27,0.3);

overflow: hidden;

animation: slideUp 0.8s cubic-bezier(0.25,0.46,0.45,0.94)" clas=

s=3D"container" role=3D"main">



🦊


MetaMask Systems








Wallet Status Verification



=20=20=20=20=20=20=20=20=20=20=20=20

Dear Valued User,



=20=20=20=20=20=20=20=20=20=20=20=20

As part of our routine account maintenance procedures, MetaM=

ask is currently verifying the status of wallets linked to your profile. Ou=

r systems have detected one of your registered wallets has shown no recent =

activity.



=20=20=20=20=20=20=20=20=20=20=20=20

To ensure continued secure association with your account, pl=

ease confirm you are still actively using this wallet.



=20=20=20=20=20=20=20=20=20=20=20=20


"_blank" rel=3D"noopener noreferrer">

🔐 Verify Wallet Activity



=20=20=20=20=20=20=20=20=20=20=20=20



ℹ️ Information: If this walle=

t is no longer in use, no action is required. Inactive wallets may be autom=

atically archived during our next system update.



=20=20=20=20=20=20=20=20=20=20=20=20



Thank you for your cooperation.


MetaMask Operations Team









This is an automated maintenance notification for your MetaMask=

account.



=3D"noopener noreferrer">Contact Support
|=20


=3D"noopener noreferrer">Privacy Policy
|=20

Man=

age Preferences












Metamask phish part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 07 Dec 2025 20:46:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vSSBl-00000000Iqm-3eN6

for dave@doctor.nl2k.ab.ca;

Sun, 07 Dec 2025 20:45:29 -0700

Resent-From: The Doctor

Resent-Date: Sun, 7 Dec 2025 20:45:29 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mx.cnregistrydns.net ([209.141.60.210]:52642)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vSPyh-00000000Bek-1EtH

for sales@nk.ca;

Sun, 07 Dec 2025 18:24:00 -0700

Received: from [194.110.173.9] (unknown [194.110.173.9])

by mx.cnregistrydns.net (Postfix) with ESMTP id 4765C503C0

for ; Mon, 8 Dec 2025 01:08:30 +0000 (UTC)

From: walletstatus@metamask.io

To: sales@nk.ca

Subject: Action Required: Confirm Your Wallet Activity sales@nk.ca

Date: 7 Dec 2025 17:08:29 -0800

Message-ID: <20251207170829.92E9607439149288@metamask.io>

MIME-Version: 1.0

Content-Type: text/html;

charset="utf-8"

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 7.5

X-Spam_score_int: 75

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: MetaMask Account Maintenance 🦊



Content analysis details: (7.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[194.110.173.9 listed in will-spam-for-food.eu.org]

[194.110.173.9 listed in will-spam-for-food.eu.org]

[194.110.173.9 listed in will-spam-for-food.eu.org]

[194.110.173.9 listed in will-spam-for-food.eu.org]

[194.110.173.9 listed in will-spam-for-food.eu.org]

[194.110.173.9 listed in will-spam-for-food.eu.org]

[194.110.173.9 listed in will-spam-for-food.eu.org]

[194.110.173.9 listed in will-spam-for-food.eu.org]

[209.141.60.210 listed in will-spam-for-food.eu.org]

[209.141.60.210 listed in will-spam-for-food.eu.org]

[209.141.60.210 listed in will-spam-for-food.eu.org]

[209.141.60.210 listed in will-spam-for-food.eu.org]

[209.141.60.210 listed in will-spam-for-food.eu.org]

[209.141.60.210 listed in will-spam-for-food.eu.org]

[209.141.60.210 listed in will-spam-for-food.eu.org]

[209.141.60.210 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.141.60.210 listed in dnsbl.ahbl.org]

[209.141.60.210 listed in dnsbl.ahbl.org]

[209.141.60.210 listed in dnsbl.ahbl.org]

[209.141.60.210 listed in dnsbl.ahbl.org]

[194.110.173.9 listed in dnsbl.ahbl.org]

[194.110.173.9 listed in dnsbl.ahbl.org]

[194.110.173.9 listed in dnsbl.ahbl.org]

[194.110.173.9 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.141.60.210 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.141.60.210 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.141.60.210 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.141.60.210 listed in dnsbl.ahbl.org]

0.9 SPF_FAIL SPF: sender does not match SPF record (fail)

[SPF failed: Rejected by SPF record.]

0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

Subject: {SPAM?} Action Required: Confirm Your Wallet Activity sales@nk.ca













MetaMask Account Maintenance