Telnet communications phish

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 12 Mar 2026 11:57:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1w0kH3-000000000Sc-0zk2

for dave@doctor.nl2k.ab.ca;

Thu, 12 Mar 2026 11:56:41 -0600

Resent-From: The Doctor

Resent-Date: Thu, 12 Mar 2026 11:56:41 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mx.ite.net ([202.88.64.59]:47218 helo=mail.ite.net)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1w0fbo-00000000PMs-1zYp

for sales@nk.ca;

Thu, 12 Mar 2026 06:57:58 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=mail.ite.net;

s=smtp1dkim; t=1773320210;

bh=586i8RmFghXM+yWFZvYT783fnu9CNZDVNfj+lf5YtLk=;

h=From:Subject:Date:From;

b=DsYsgtcCI8jmPhEZPmNMRviSsavmuTHa0+ksx322LECAVcHGx9a9A5p42VM1NM+1p

+Q4m+IuhyhY6/sHOzLSJr6eHt1hopvFc8unf6QNiYV6Yf6JXsa9+vuu7Y47FuyfxgZ

i4Y9/EZYZ5AD7Dl6I4kK26uF59XVXvaXGlOELKDA=

Received: from User (216-131-80-80.lax.as62651.net [216.131.80.80])

by mail.ite.net (Postfix) with ESMTPA id A1BA38CCAC40;

Thu, 12 Mar 2026 22:56:22 +1000 (ChST)

From:

Subject: : TELNET EMAIL SERVICE SUSPENSION :

Date: Thu, 12 Mar 2026 07:56:49 -0500

MIME-Version: 1.0

Content-Type: multipart/related;

boundary="----=_NextPart_000_0028_01C2AA85.5E07EFC2"

X-Priority: 3

X-MSMail-Priority: Normal

X-Mailer: Microsoft Outlook Express 6.00.2800.1081

X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1081

X-Virus-Scanned: clamav-milter 1.4.3 at av01.ite.net

X-Virus-Status: Clean

X-Spam_score: 25.0

X-Spam_score_int: 250

X-Spam_bar: +++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: For failure to Revalidate Your Telnet email account - Your

Telnet Account will be SUSPENDED by 14th March 2026. If you wish to continue

using the Telnet email services - CLICK HERE TO REVALIDATE



Content analysis details: (25.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.1 MISSING_MID Missing Message-Id: header

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[216.131.80.80 listed in will-spam-for-food.eu.org]

[216.131.80.80 listed in will-spam-for-food.eu.org]

[216.131.80.80 listed in will-spam-for-food.eu.org]

[216.131.80.80 listed in will-spam-for-food.eu.org]

[216.131.80.80 listed in will-spam-for-food.eu.org]

[216.131.80.80 listed in will-spam-for-food.eu.org]

[216.131.80.80 listed in will-spam-for-food.eu.org]

[216.131.80.80 listed in will-spam-for-food.eu.org]

[202.88.64.59 listed in will-spam-for-food.eu.org]

[202.88.64.59 listed in will-spam-for-food.eu.org]

[202.88.64.59 listed in will-spam-for-food.eu.org]

[202.88.64.59 listed in will-spam-for-food.eu.org]

[202.88.64.59 listed in will-spam-for-food.eu.org]

[202.88.64.59 listed in will-spam-for-food.eu.org]

[202.88.64.59 listed in will-spam-for-food.eu.org]

[202.88.64.59 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[202.88.64.59 listed in dnsbl.ahbl.org]

[202.88.64.59 listed in dnsbl.ahbl.org]

[202.88.64.59 listed in dnsbl.ahbl.org]

[202.88.64.59 listed in dnsbl.ahbl.org]

[216.131.80.80 listed in dnsbl.ahbl.org]

[216.131.80.80 listed in dnsbl.ahbl.org]

[216.131.80.80 listed in dnsbl.ahbl.org]

[216.131.80.80 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[202.88.64.59 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[202.88.64.59 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[202.88.64.59 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[202.88.64.59 listed in dnsbl.ahbl.org]

0.7 SPF_NEUTRAL SPF: sender does not match SPF record (neutral)

0.0 NSL_RCVD_FROM_USER Received from User

1.6 SUBJ_ALL_CAPS Subject is all capitals

1.2 MISSING_HEADERS Missing To: header

1.0 HTML_IMAGE_ONLY_16 BODY: HTML: images with 1200-1600 bytes of words

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_IMAGE_RATIO_06 BODY: HTML has a low ratio of text to image area

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only

2.0 WINDOWS_7BITS Windows charset announced as 7 bit

0.6 FSL_NEW_HELO_USER Spam's using Helo and User

1.5 TVD_PH_BODY_ACCOUNTS_PRE The body matches phrases such as "accounts

suspended", "account credited", "account

verification"

1.2 AXB_XMAILER_MIMEOLE_OL_1ECD5 Yet another X header trait

0.6 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format

1.0 ZMIde_OutlookExpress Outlook Express should not be used anymore

2.0 MIXED_HREF_CASE Has href in mixed case

2.8 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook

2.5 TO_NO_BRKTS_MSFT To: misformatted and supposed Microsoft tool

Subject: {SPAM?} : TELNET EMAIL SERVICE SUSPENSION :



This is a multi-part message in MIME format.



------=_NextPart_000_0028_01C2AA85.5E07EFC2

Content-Type: text/html;

charset="Windows-1251"

Content-Transfer-Encoding: 7bit

















For failure to Revalidate Your Telnet email account - Your Telnet Account will be SUSPENDED by 14th March 2026.




If you wish to continue using the Telnet email services -  CLICK HERE TO REVALIDATE




 




Telnet Communications.




http://www.telnetcommunications.com/




Club storage phish from google Gmai Part 2



.icon-stop {

width: 24px;

height: 24px;

background: #dc2626;

color: #fff;

border-radius: 50%;

text-align: center;

line-height: 24px;

font-weight: bold;

margin-right: 10px;

font-size: 14px;

}



.head-title {

font-weight: bold;

color: #1f2937;

font-size: 16px;

}



.main-body {

padding: 30px 20px;

text-align: center;

}



.logo-large {

display: block;

margin: 0 auto 15px auto;

max-width: 80px;

}



.h2 {

font-size: 22px;

color: #111827;

margin: 0 0 10px;

font-weight: 800;

}



.desc {

font-size: 15px;

color: #4b5563;

line-height: 1.5;

margin-bottom: 25px;

}



.status-bar {

background: #f3f4f6;

height: 12px;

border-radius: 10px;

overflow: hidden;

margin-bottom: 8px;

}



.fill {

width: 100%;

height: 100%;

background: #dc2626;

}



.stats {

display: flex;

justify-content: space-between;

font-size: 12px;

color: #6b7280;

margin-bottom: 25px;

font-weight: 600;

}



.btn-red {

background: #dc2626;

color: #fff;

text-decoration: none;

padding: 12px 24px;

border-radius: 6px;

font-weight: bold;

display: inline-block;

}













Sent automatically by Cloud Services. Unsubscribe.









--000000000000ff0c79064ccc8c0c--

cloud credential phishing from Google Gmail Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 12 Mar 2026 04:19:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1w0d86-00000000FYJ-2dPE

for dave@doctor.nl2k.ab.ca;

Thu, 12 Mar 2026 04:18:58 -0600

Resent-From: The Doctor

Resent-Date: Thu, 12 Mar 2026 04:18:58 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-oi1-f198.google.com ([209.85.167.198]:54318)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1w0Y59-000000000lD-3H6X

for root@nk.ca;

Wed, 11 Mar 2026 22:55:43 -0600

Received: by mail-oi1-f198.google.com with SMTP id 5614622812f47-466f705757bso3037899b6e.0

for ; Wed, 11 Mar 2026 21:54:48 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=firebaseapp.com; s=20230601; t=1773291283; x=1773896083; darn=nk.ca;

h=to:from:subject:date:message-id:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=zEIUnebzkF6eckM2yOh4+Cum8YCkYxemmb61cjXN1Mg=;

b=P1V0LdpABkCSA1jDa9b6AZJvU3Y2aBK6MiMsFRZ2tlL47RA7FBy6oFO7gFPxPlsx08

xH5SWGI8e9ldQvm701sowEqu/bj0ZUjwyA+g3H0YtTo7kMXjCR9qw1pvqItoW2xaPIqt

aw4BGTZ7Lcg322+e1fCfro2ttMHy7q5RzZqwuEo3J+OHADdhCgQ3uVJUIUp1AUTHcgvw

NuHfA/ZRKodUCXhXXI0fkUSJixVNu0rZa5NvTwMZ7t5x/G0wJQKY6j3QKrYRQuBQGqJw

Ro97PRQ28c3+unENKfKYOyU1tUr1TK7woBL69O6ijb0wmlIGAMDcsr06wxAjvhbm2baX

GW+A==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1773291283; x=1773896083;

h=to:from:subject:date:message-id:mime-version:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=zEIUnebzkF6eckM2yOh4+Cum8YCkYxemmb61cjXN1Mg=;

b=J2FLb2FMj3YE2Q52sY8ZVaQp0JAwyaWdwmeJyuDA/Rpc7cbS9k8PaCHzcKojdLsUqs

yzeMVaCMRm8+uWL8UOols/bxtsg+rw5fH1+YP++zgN4T+Jc9IxAB5GID3tPVUM+Wc2oH

HqATwnGxJmiKdl/JdG9l4cifGsGz8GIbUST3/D1+o4aX/uTi4RMyV9Io+2FbdRKKaTl1

RvlVd4LpWvXyiuz/nTSj80jVP45JpUUd2MLEzdX1nm6YLK8gfud3XQ2ecm9JrT+1s+H7

gZ1UVdwlFx+dqQLuC+2kIqCaWTJwHl0hgLVcQ1z+Qm5ud6k0PoD1L7nkVpaLjww4EO1D

Ybrg==

X-Gm-Message-State: AOJu0YycQN7L7Kfd41xGJlL9W6MktpKjtDv5C23ahs2+nUUwg65s6Keu

uD8eN38yA67nAbjOq21nwNFUs6gVboVpiYJEbXa77AoitcE35RV9LnddkJ8vSZK40Y8U3OVXpdb

AxxIiq7bLdQ==

MIME-Version: 1.0

X-Received: by 2002:a05:6808:f87:b0:45f:2788:afe2 with SMTP id

5614622812f47-46733499acfmr2603642b6e.20.1773291282827; Wed, 11 Mar 2026

21:54:42 -0700 (PDT)

Message-ID: <000000000000ff0c8b064ccc8c0f@google.com>

Date: Thu, 12 Mar 2026 04:54:42 +0000

Subject: Syncing disabled: Capacity exceeded

From: Sync Service

To: root@nk.ca

Content-Type: multipart/alternative; boundary="000000000000ff0c79064ccc8c0c"



--000000000000ff0c79064ccc8c0c

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes



!



System Alert: Uploads Paused





Disabled

Your Cloud is Disabled



We cannot sync your photos or documents because your storage is full and

your subscription is inactive.





Used: 50.0 GB Limit: 50.0 GB

Reactivate Storage Now





Sent automatically by Cloud Services. Unsubscribe.



--000000000000ff0c79064ccc8c0c

Content-Type: text/html; charset="UTF-8"















Cloud Disabled



Cloud credential phish from Google Gmail Part 4







=E2=9A=A0=EF=B8=8F URGENT SYSTEM ALERT =E2=80=A2
s_date">
=E2=80=A2 ACTION REQUIRED =E2=9A=A0=EF=B8=8F



=20



=E2=98=81=EF=B8=8F CLOUD SERVICES DISABLED



Critical storage limit exceeded
">EMERGENCY



















=F0=9F=94=B4 IMMEDIATE ACTION NEEDED =E2=80=94 All c=

loud services are temporarily suspended









=E2=9C=95 =F0=9F=93=B8 Ph=

oto Backup - DISABLED





=E2=9C=95 =F0=9F=93=81 Dr=

ive Uploads - BLOCKED





=E2=9C=95 =F0=9F=93=8E Em=

ail Attachments - PAUSED





=E2=9C=95 =F0=9F=92=BE Au=

to Backups - STOPPED









=F0=9F=94=B4 REACTIVATE STORAGE NOW







=E2=9A=A0=EF=B8=8F 95% storage used =E2=80=A2 2.3GB r=

emaining =E2=9A=A0=EF=B8=8F








=F0=

=9F=94=94 Alert settings
=E2=80=A2=20

=F0=

=9F=93=9E Emergency support
=E2=80=A2=20

=E2=

=9A=A1 Upgrade plan
















--00000000000066d88f064cca820f--