Nk.ca credential phishing from Google Gmail
Posted by Dave Yadallee onX-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Tue, 01 Sep 2026 17:04:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))
(envelope-from
id 1x1XWF-00000000Ikw-11MC
for dave@doctor.nl2k.ab.ca;
Tue, 01 Sep 2026 17:03:55 -0600
Resent-From: The Doctor
Resent-Date: Tue, 1 Sep 2026 17:03:55 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-pf1-f229.google.com ([209.85.210.229]:59432)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.100 (FreeBSD))
(envelope-from
id 1x1WMf-000000008RK-2KME
for sales@nk.ca;
Tue, 01 Sep 2026 15:50:06 -0600
Received: by mail-pf1-f229.google.com with SMTP id d2e1a72fcca58-84e04df8c46so481498b3a.2
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=nwhssasi-com.20251104.gappssmtp.com; s=20251104; t=1788299345; x=1788904145; darn=nk.ca;
h=content-transfer-encoding:content-type:mime-version:message-id:date
:subject:to:from:reply-to:from:to:cc:subject:date:message-id
:reply-to:content-type;
bh=UqZC9WRq5jsVHIYwqmfzEfWK/qUcx0YrHuAIw1T7O+g=;
b=c1mUrigwt/hkX11L1G66spPd/CcdX8Yqfj2AE0gVEZwdfcHuAmOEF6cKkQrmZWc6hg
h1nKImP0TdesAzfua3sWhSvpm92aqnFJZvVY5Xe06h6tJ2CRnxDMHniC2xhTS9Kr/1v0
zELIoVR8tADrHVP9Jb0LWK3glXHUZNFBTLnRbFGo5oFFhCf6vm1j6PuEWQLj+OMtj1Ac
pjpnG9IMGZSKeQsY9CGuQeDQrCQsd2+xBHsom7ZviVYGy/70YQPtmpYhxJfbL/laaFnZ
SEC3IOB765BdD3TLyeIiLf38vRSRtpkLOfzwuwXxLlYylZZyfqrForspey9q6f15MiVI
vjSQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20251104; t=1788299345; x=1788904145;
h=content-transfer-encoding:content-type:mime-version:message-id:date
:subject:to:from:reply-to:x-gm-gg:x-gm-message-state:from:to:cc
:subject:date:message-id:reply-to:content-type;
bh=UqZC9WRq5jsVHIYwqmfzEfWK/qUcx0YrHuAIw1T7O+g=;
b=JT31ci0ETXRfs2H5/P8B8JIod/Hb5vmZ8uHGj4mVayaGe8tACrq8AOb75Q1vRaoCkM
Vc+wGezAp/flDTryuDKXcRiWTdnqScyIaD5WpCoY/ql2J9cr0SoUiDk9fuRwirO994DX
CX2D0V11/0P556VbvDvKdHDiaHnOhuGeHKZttNRkWmTSI3zXFV51Kdb8VxkAH2eaK2VA
BsW7kWhc4hQOBcgkr7Bxd9Ku/DDhQ2aLFVPg5Pbw4UD3LX+IN38Es/v8GVq+EhD4+Tid
p4Tibis3pK2FycYN8/+LkYU0kpDZMM1M8hCp4gjlHh6jkciK41coH118fQwr5q8SrP9F
2rGA==
X-Gm-Message-State: AFuF++mOJuXkXqmP21EFvp1ITQ4wb/ESfhO0HY1vMKfX6qb5LgEuwZNT
LGD9/eIGLISsZVptKPpoiKzxf5FNNtARlP94l55F3t4qSNuN6TtpxUm64sx0uro8Chm9sZnZkFs
rkWFx87Zt7tB17I20eqcMr0ZcjvufjN8t8+BMUl6XqbfP6LU=
X-Gm-Gg: AR+sD10QaSMr7vg1rtIbD/X7e7vnlcqicOF/8UqeJWVk8UErPbM0GjXSnpIWnc4vMv8
UIEEz7/ht3VmwLfBsv+U8r9LR9uLR8pumP1L2fYQErRbL2d2/qM7WHN/I6aUCT3aVUMwe0/cUzo
m7Nj0AbBpciqM9Kl3wkefkIWls0PVNdr64s3nFbICG61xP9MzMS7fQL8DVSZ0Uf+FutniiD3sUN
MuedIDNH7mDZm3U58roWxWGZa0io97r0iZRS9fpO+bqkMsc6NxCgFr+f0HcehwEn4oilLW8E7ok
Ll9wfgwAJYCtAdAsF9amTHdbWeXPWNiPRpP5tXzEdlY3mtm6wdoHhHRFams2ivq6pKmh+YDWnnq
Jp9A=
X-Received: by 2002:a05:6a00:8013:b0:85c:9bb4:a7ea with SMTP id d2e1a72fcca58-85ed27e4114mr1265192b3a.11.1788299344851;
Tue, 01 Sep 2026 14:49:04 -0700 (PDT)
Received: from sasinm.com ([45.77.86.178])
by smtp-relay.gmail.com with ESMTPS id d2e1a72fcca58-85dbfc50ea0sm261265b3a.7.2026.09.01.14.49.04
for
(version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);
Tue, 01 Sep 2026 14:49:04 -0700 (PDT)
X-Relaying-Domain: sasinm.com
Reply-To: noreply@nk.ca
From: "Postmaster"
To: sales@nk.ca
Subject: =?UTF-8?B?W0FjdGlvbiBSZXF1aXJlZF0gOu+4jyBTdXNwaWNpb3VzIEFjdGl2aXRpZXMgRGV0ZWN0ZWQgb24g?=sales@nk.ca
Date: 01 Sep 2026 21:49:04 +0000
Message-ID: <20260901214904.EE2B06E41933F0CC@sasinm.com>
MIME-Version: 1.0
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
X-Spam_score: 9.4
X-Spam_score_int: 94
X-Spam_bar: +++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Email Sending Has Been Temporarily Suspended! We have temporarily
suspended email sending from your account "sales@nk.ca " due to continuous
suspicious activities such as sending spam-like or harmful emails. This may
suggest a potential compromis [...]
Content analysis details: (9.4 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[45.77.86.178 listed in will-spam-for-food.eu.org]
[45.77.86.178 listed in will-spam-for-food.eu.org]
[45.77.86.178 listed in will-spam-for-food.eu.org]
[45.77.86.178 listed in will-spam-for-food.eu.org]
[45.77.86.178 listed in will-spam-for-food.eu.org]
[45.77.86.178 listed in will-spam-for-food.eu.org]
[45.77.86.178 listed in will-spam-for-food.eu.org]
[45.77.86.178 listed in will-spam-for-food.eu.org]
[209.85.210.229 listed in will-spam-for-food.eu.org]
[209.85.210.229 listed in will-spam-for-food.eu.org]
[209.85.210.229 listed in will-spam-for-food.eu.org]
[209.85.210.229 listed in will-spam-for-food.eu.org]
[209.85.210.229 listed in will-spam-for-food.eu.org]
[209.85.210.229 listed in will-spam-for-food.eu.org]
[209.85.210.229 listed in will-spam-for-food.eu.org]
[209.85.210.229 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[45.77.86.178 listed in dnsbl.ahbl.org]
[45.77.86.178 listed in dnsbl.ahbl.org]
[45.77.86.178 listed in dnsbl.ahbl.org]
[45.77.86.178 listed in dnsbl.ahbl.org]
[209.85.210.229 listed in dnsbl.ahbl.org]
[209.85.210.229 listed in dnsbl.ahbl.org]
[209.85.210.229 listed in dnsbl.ahbl.org]
[209.85.210.229 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[45.77.86.178 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[45.77.86.178 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[45.77.86.178 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[45.77.86.178 listed in dnsbl.ahbl.org]
1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist
[URI: centurycollision.ca]
1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist
[URI: centurycollision.ca]
-0.0 SPF_PASS SPF: sender matches SPF record
0.6 HK_RANDOM_ENVFROM Envelope sender username looks random
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[209.85.210.229 listed in bl.score.senderscore.com]
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.210.229 listed in wl.mailspike.net]
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
2.7 URI_WPADMIN WordPress login/admin URI, possible phishing
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.0 NO_RDNS2 Sending MTA has no reverse DNS
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.210.229 listed in list.dnswl.org]
Subject: {SPAM?} =?UTF-8?B?W0FjdGlvbiBSZXF1aXJlZF0gOu+4jyBTdXNwaWNpb3VzIEFjdGl2aXRpZXMgRGV0ZWN0ZWQgb24g?=sales@nk.ca
em-ui, sans-serif; WHITE-SPACE: normal; WORD-SPACING: 0px; BORDER-COLLAPSE:=
collapse; TABLE-LAYOUT: auto; TEXT-TRANSFORM: none; FONT-WEIGHT: 400; COLO=
R: rgb(34,34,34); FONT-STYLE: normal; TEXT-ALIGN: left; ORPHANS: 2; WIDOWS:=
2; LETTER-SPACING: normal; LINE-HEIGHT: 1.5; BACKGROUND-COLOR: rgb(255,255=
,255); font-variant-ligatures: normal; font-variant-caps: normal; -webkit-t=
ext-stroke-width: 0px; text-decoration-thickness:=20
initial; text-decoration-style: initial; text-decoration-color: initial" ce=
llspacing=3D"0" cellpadding=3D"0" width=3D"100%" align=3D"center" border=3D=
"0">
apse; TABLE-LAYOUT: auto; COLOR: rgb(0,0,0); MARGIN: 0px auto; LINE-HEIGHT:=
1.5; border-radius: 0px" cellspacing=3D"0" cellpadding=3D"0" width=3D"600"=
align=3D"center" border=3D"0">
-HEIGHT: 1.5" width=3D"100%">
YOUT: auto; LINE-HEIGHT: 1.5" cellspacing=3D"0" cellpadding=3D"0" width=3D"=
100%" border=3D"0">
XT-ALIGN: center; PADDING-TOP: 8px; PADDING-LEFT: 24px; MARGIN: 0px; LINE-H=
EIGHT: 1.5; PADDING-RIGHT: 24px">
", Arial, sans-serif; FONT-WEIGHT: 500; COLOR: rgb(29,30,32); DIRECTION: lt=
r; MARGIN: 0px; LINE-HEIGHT: 1.2'>
NE-HEIGHT: 1.5">Email Sending Has Been Temporarily Suspended!=
TD>
YOUT: auto; LINE-HEIGHT: 1.5" cellspacing=3D"0" cellpadding=3D"0" width=3D"=
100%" border=3D"0">
HEIGHT: 1.5; PADDING-RIGHT: 24px">
s", Arial, sans-serif; DIRECTION: ltr; PADDING-TOP: 0px; LETTER-SPACING: 0p=
x; LINE-HEIGHT: 1.5; BORDER-TOP-WIDTH: 0px'>
>We have temporarily=
HEIGHT: 1.5">
e=3D"BOX-SIZING: border-box" color=3D#1d1e20>suspended email sending from y=
our account "=
sales@nk.ca
" due to continuous =
suspicious activities
r=3D#1d1e20> such as sending spam-like or harmful emails.
This may=
suggest a potential compromise through one of your connected applications =
or devices.
-HEIGHT: 1.5">To resolve this issue, click the button below and follow the =
steps to get your email account active again.
TABLE>
em-ui, sans-serif; WHITE-SPACE: normal; WORD-SPACING: 0px; BORDER-COLLAPSE:=
collapse; TABLE-LAYOUT: auto; TEXT-TRANSFORM: none; FONT-WEIGHT: 400; COLO=
R: rgb(34,34,34); FONT-STYLE: normal; TEXT-ALIGN: left; ORPHANS: 2; WIDOWS:=
2; LETTER-SPACING: normal; LINE-HEIGHT: 1.5; BACKGROUND-COLOR: rgb(255,255=
,255); font-variant-ligatures: normal; font-variant-caps: normal; -webkit-t=
ext-stroke-width: 0px; text-decoration-thickness:=20
initial; text-decoration-style: initial; text-decoration-color: initial" ce=
llspacing=3D"0" cellpadding=3D"0" width=3D"100%" align=3D"center" border=3D=
"0">
apse; TABLE-LAYOUT: auto; COLOR: rgb(0,0,0); MARGIN: 0px auto; LINE-HEIGHT:=
1.5; border-radius: 0px" cellspacing=3D"0" cellpadding=3D"0" width=3D"600"=
align=3D"center" border=3D"0">
4px; PADDING-TOP: 24px; MARGIN: 0px; LINE-HEIGHT: 1.5" width=3D"100%">
YOUT: auto; LINE-HEIGHT: 1.5" cellspacing=3D"0" cellpadding=3D"0" width=3D"=
100%" border=3D"0">
HEIGHT: 1.5">
ORDER-TOP-WIDTH: 0px" align=3Dcenter>
XT-DECORATION: none; COLOR: rgb(255,255,255); LINE-HEIGHT: 1.5; BACKGROUND-=
COLOR: transparent" href=3D"https://centurycollision.ca/wp-admin/update/ver=
ification-request/#c2FsZXNAbmsuY2E=3D" rel=3Dnoreferrer target=3D_blank>
,255,255) 0px solid; FONT-FAMILY: "DM Sans", Arial, sans-serif; BORDER-RIGH=
T: rgb(255,255,255) 0px solid; WIDTH: auto; BORDER-BOTTOM: rgb(255,255,255)=
0px solid; PADDING-BOTTOM: 12px; PADDING-TOP: 12px; PADDING-LEFT: 24px; BO=
RDER-LEFT: rgb(255,255,255) 0px solid; DISPLAY: inline-block; LINE-HEIGHT: =
1.5; PADDING-RIGHT: 24px; BACKGROUND-COLOR: rgb(103,61,230); border-radius:=
8px'>
REOLVE IS=
SUES NOW
TD>
Verify My Account