Spotify Phish from Google Gmail PArt 1
Posted by Dave Yadallee on
lla-Status: 0001
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Thu, 19 Feb 2026 14:25:00 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))
(envelope-from)
id 1vtBVS-00000000JMV-1V9T
for dave@doctor.nl2k.ab.ca;
Thu, 19 Feb 2026 14:24:18 -0700
Resent-From: The Doctor
Resent-Date: Thu, 19 Feb 2026 14:24:18 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-ua1-f71.google.com ([209.85.222.71]:61584)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.98.2 (FreeBSD))
(envelope-from)
id 1vtApc-000000006wb-1sEr
for sales@nk.ca;
Thu, 19 Feb 2026 13:41:11 -0700
Received: by mail-ua1-f71.google.com with SMTP id a1e0cc1a2514c-94ad7cd3a35so14680797241.2
for; Thu, 19 Feb 2026 12:40:16 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=firebaseapp.com; s=20230601; t=1771533610; x=1772138410; darn=nk.ca;
h=to:from:subject:date:message-id:mime-version:from:to:cc:subject
:date:message-id:reply-to;
bh=Q9EBAerNvbgZQ10LDzi7AlRTN3kP3kqLQETj2MhJ75c=;
b=JXrwyC7P620TPlfdZ0IlJxL24hWxSjves6hBnYhokC4m11QvgdR7iODQGa86oSPocq
MIhCD5EEcwOxoRFDIsedUpTuRT8AfHpK57Xz7DYXWqK0RsTkpMlfH/oGs8vz4porDc7v
xHyS99Qw/7vpM70J+xmi03twoqBjQHplPKVx8UaDYl1tGziY4WNR4sA2vRXdCyngue3F
rRAG31nVBKrjEm+1Xom4IoHTngoSuoupqx7J2ATs9R8N8Kae+8nB9M8VaAQk7X8Za8Vc
HtBhB17OZKDJxP7MSAbLtuvkOUoz6CokaTSvVBGKWsm0Fw9rJOIq1SmJMYjOnGgxx2Ug
NwAw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20230601; t=1771533610; x=1772138410;
h=to:from:subject:date:message-id:mime-version:x-gm-message-state
:from:to:cc:subject:date:message-id:reply-to;
bh=Q9EBAerNvbgZQ10LDzi7AlRTN3kP3kqLQETj2MhJ75c=;
b=X6GBbhizvdSqUB5gRjIPSjlTK45VY4kvSAQAIOyXkJEXSs1B6GB8Uk8UVk1LjY2/eT
vTUurkKbyHHplLh+mOiyJFH5YHGlxLvQpRlmtwK2VtMh5hEQIxsx4VoQvVBTxKBv/HH5
bcq0ckUGSWFwGm1dzaBKvL/Ur8Xx4B5e+W31epIHmktK613W+hfArBOmmCp++ssXqmnw
kTd+e9IuOogD6zugmCQ7jEMayo+eZpRPaldm+qu83TMsMHMDq2y6MbPknTSUexZKuAlm
23JG1Hn6Ups/3A8oePe2QrrGSIwr2bokMn9gesWFMEk+taEkEuqNNv/S5qLs+EU3dizH
n7RQ==
X-Gm-Message-State: AOJu0YxPT2c/FrZtm9fEYMiLlgkxi+TMZI5n0VJXBVRH1EfM8oqLpJKu
PXivEHh4uBNHRdxe5AObrVKfk2f608TWqaUe0BxmUICBOWOIOo8hmbbFOZJHtTLMdObImBUkKKA
2qAGbf0NVsA==
MIME-Version: 1.0
X-Received: by 2002:a05:6102:2ac7:b0:5f9:39e8:5346 with SMTP id
ada2fe7eead31-5fe7fb393bfmr3374997137.9.1771533610694; Thu, 19 Feb 2026
12:40:10 -0800 (PST)
Message-ID: <00000000000092b846064b334f89@google.com>
Date: Thu, 19 Feb 2026 20:40:10 +0000
Subject: Verify your billing details
From: SpotifyAB
To: sales@nk.ca
Content-Type: multipart/alternative; boundary="00000000000092b83d064b334f86"
X-Spam_score: 9.3
X-Spam_score_int: 93
X-Spam_bar: +++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Your payment was unsuccessful. We were unable to process your
Premium subscription payment . Your card may have expired or the transaction
may have been declined by the bank. Important: If you do not update your
payment information, your account will be suspended and will switch to the
free version within 24 hours.
Content analysis details: (9.3 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[209.85.222.71 listed in dnsbl.ahbl.org]
[209.85.222.71 listed in dnsbl.ahbl.org]
[209.85.222.71 listed in dnsbl.ahbl.org]
[209.85.222.71 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[209.85.222.71 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[209.85.222.71 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[209.85.222.71 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[209.85.222.71 listed in dnsbl.ahbl.org]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[209.85.222.71 listed in will-spam-for-food.eu.org]
[209.85.222.71 listed in will-spam-for-food.eu.org]
[209.85.222.71 listed in will-spam-for-food.eu.org]
[209.85.222.71 listed in will-spam-for-food.eu.org]
[209.85.222.71 listed in will-spam-for-food.eu.org]
[209.85.222.71 listed in will-spam-for-food.eu.org]
[209.85.222.71 listed in will-spam-for-food.eu.org]
[209.85.222.71 listed in will-spam-for-food.eu.org]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.222.71 listed in list.dnswl.org]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.222.71 listed in wl.mailspike.net]
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
3.0 URI_FIREBASEAPP Link to hosted firebase web application, possible
phishing
1.5 TVD_PH_BODY_ACCOUNTS_PRE The body matches phrases such as "accounts
suspended", "account credited", "account
verification"
Subject: {SPAM?} Verify your billing details
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Thu, 19 Feb 2026 14:25:00 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))
(envelope-from
id 1vtBVS-00000000JMV-1V9T
for dave@doctor.nl2k.ab.ca;
Thu, 19 Feb 2026 14:24:18 -0700
Resent-From: The Doctor
Resent-Date: Thu, 19 Feb 2026 14:24:18 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-ua1-f71.google.com ([209.85.222.71]:61584)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.98.2 (FreeBSD))
(envelope-from
id 1vtApc-000000006wb-1sEr
for sales@nk.ca;
Thu, 19 Feb 2026 13:41:11 -0700
Received: by mail-ua1-f71.google.com with SMTP id a1e0cc1a2514c-94ad7cd3a35so14680797241.2
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=firebaseapp.com; s=20230601; t=1771533610; x=1772138410; darn=nk.ca;
h=to:from:subject:date:message-id:mime-version:from:to:cc:subject
:date:message-id:reply-to;
bh=Q9EBAerNvbgZQ10LDzi7AlRTN3kP3kqLQETj2MhJ75c=;
b=JXrwyC7P620TPlfdZ0IlJxL24hWxSjves6hBnYhokC4m11QvgdR7iODQGa86oSPocq
MIhCD5EEcwOxoRFDIsedUpTuRT8AfHpK57Xz7DYXWqK0RsTkpMlfH/oGs8vz4porDc7v
xHyS99Qw/7vpM70J+xmi03twoqBjQHplPKVx8UaDYl1tGziY4WNR4sA2vRXdCyngue3F
rRAG31nVBKrjEm+1Xom4IoHTngoSuoupqx7J2ATs9R8N8Kae+8nB9M8VaAQk7X8Za8Vc
HtBhB17OZKDJxP7MSAbLtuvkOUoz6CokaTSvVBGKWsm0Fw9rJOIq1SmJMYjOnGgxx2Ug
NwAw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20230601; t=1771533610; x=1772138410;
h=to:from:subject:date:message-id:mime-version:x-gm-message-state
:from:to:cc:subject:date:message-id:reply-to;
bh=Q9EBAerNvbgZQ10LDzi7AlRTN3kP3kqLQETj2MhJ75c=;
b=X6GBbhizvdSqUB5gRjIPSjlTK45VY4kvSAQAIOyXkJEXSs1B6GB8Uk8UVk1LjY2/eT
vTUurkKbyHHplLh+mOiyJFH5YHGlxLvQpRlmtwK2VtMh5hEQIxsx4VoQvVBTxKBv/HH5
bcq0ckUGSWFwGm1dzaBKvL/Ur8Xx4B5e+W31epIHmktK613W+hfArBOmmCp++ssXqmnw
kTd+e9IuOogD6zugmCQ7jEMayo+eZpRPaldm+qu83TMsMHMDq2y6MbPknTSUexZKuAlm
23JG1Hn6Ups/3A8oePe2QrrGSIwr2bokMn9gesWFMEk+taEkEuqNNv/S5qLs+EU3dizH
n7RQ==
X-Gm-Message-State: AOJu0YxPT2c/FrZtm9fEYMiLlgkxi+TMZI5n0VJXBVRH1EfM8oqLpJKu
PXivEHh4uBNHRdxe5AObrVKfk2f608TWqaUe0BxmUICBOWOIOo8hmbbFOZJHtTLMdObImBUkKKA
2qAGbf0NVsA==
MIME-Version: 1.0
X-Received: by 2002:a05:6102:2ac7:b0:5f9:39e8:5346 with SMTP id
ada2fe7eead31-5fe7fb393bfmr3374997137.9.1771533610694; Thu, 19 Feb 2026
12:40:10 -0800 (PST)
Message-ID: <00000000000092b846064b334f89@google.com>
Date: Thu, 19 Feb 2026 20:40:10 +0000
Subject: Verify your billing details
From: SpotifyAB
To: sales@nk.ca
Content-Type: multipart/alternative; boundary="00000000000092b83d064b334f86"
X-Spam_score: 9.3
X-Spam_score_int: 93
X-Spam_bar: +++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Your payment was unsuccessful. We were unable to process your
Premium subscription payment . Your card may have expired or the transaction
may have been declined by the bank. Important: If you do not update your
payment information, your account will be suspended and will switch to the
free version within 24 hours.
Content analysis details: (9.3 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[209.85.222.71 listed in dnsbl.ahbl.org]
[209.85.222.71 listed in dnsbl.ahbl.org]
[209.85.222.71 listed in dnsbl.ahbl.org]
[209.85.222.71 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[209.85.222.71 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[209.85.222.71 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[209.85.222.71 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[209.85.222.71 listed in dnsbl.ahbl.org]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[209.85.222.71 listed in will-spam-for-food.eu.org]
[209.85.222.71 listed in will-spam-for-food.eu.org]
[209.85.222.71 listed in will-spam-for-food.eu.org]
[209.85.222.71 listed in will-spam-for-food.eu.org]
[209.85.222.71 listed in will-spam-for-food.eu.org]
[209.85.222.71 listed in will-spam-for-food.eu.org]
[209.85.222.71 listed in will-spam-for-food.eu.org]
[209.85.222.71 listed in will-spam-for-food.eu.org]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.222.71 listed in list.dnswl.org]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.222.71 listed in wl.mailspike.net]
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
3.0 URI_FIREBASEAPP Link to hosted firebase web application, possible
phishing
1.5 TVD_PH_BODY_ACCOUNTS_PRE The body matches phrases such as "accounts
suspended", "account credited", "account
verification"
Subject: {SPAM?} Verify your billing details