Google Workspace phish from Google Gmail
Posted by Dave Yadallee onX-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Tue, 13 Oct 2026 06:53:41 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))
(envelope-from
id 1xGc0R-000000009sI-42CH
for dave@doctor.nl2k.ab.ca;
Tue, 13 Oct 2026 06:53:23 -0600
Resent-From: The Doctor
Resent-Date: Tue, 13 Oct 2026 06:53:23 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-pf1-f174.google.com ([209.85.210.174]:50568)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.100.1 (FreeBSD))
(envelope-from
id 1xGbt3-0000000097W-3bDJ
for doctor@nl2k.ab.ca;
Tue, 13 Oct 2026 06:45:56 -0600
Received: by mail-pf1-f174.google.com with SMTP id d2e1a72fcca58-887beafb714so1395147b3a.1
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20251104; t=1791895491; x=1792500291; darn=nl2k.ab.ca;
h=priority:importance:subject:from:to:mime-version:content-type:date
:message-id:from:to:cc:subject:date:message-id:reply-to:content-type;
bh=GS8fD7Gczmjzhq5G3h3VQfYjhO7T0/K2EfpJorCZols=;
b=d4gu11A3xi3jgfrdKrDw1Joxn0mpK/M585v8ZDY28OuQCQnaza5mJ89MQsa9BGbqYs
23OALqCLz3Vyjk58CdVBHxEuTmavjWllY/c2lyaaEsCR8jI0zStqh3knTMSzgfyjSCyc
MJVYk7khspBviXjF+jbbFh2rXnCxim/xezwUBveb77Tgq7D2PYZD+piCbMoLO9ubMdgM
0p38A1BSedk8551fMLnEcxJ4jmpfA3uEoJHe6InJs7CDf7xRDo1QfienRoT6md73nvag
T3jyd08ZR+Y3azqWxSC7CN5IQ7dHWuzk+nWc/rSQ1n44zuxzpb+2GTk+pE6C/cBL9ddT
wibQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20260707; t=1791895491; x=1792500291;
h=priority:importance:subject:from:to:mime-version:content-type:date
:message-id:x-gm-gg:x-gm-message-state:from:to:cc:subject:date
:message-id:reply-to:content-type;
bh=GS8fD7Gczmjzhq5G3h3VQfYjhO7T0/K2EfpJorCZols=;
b=Cmmq5DLkXfcr1+aVOiCheMaE/usSpafljU8UG+b3M+gM/YN0MLIMxEzBbfI9Y/eDG9
JlVNKfWNrDsJ0TU2YZXf2AF/bOzHaHsb6L+uQ8XWnemLCevxShkA0344I9Q7oE0pqUz3
uVfgB3CXgyQc/LjE0QqUDkaLQQXfchaU83IPTod5pINR4tco+PI1UhQJjVsGxJ69UIsX
kugWUiI+WcLzhGRz/gEhDjJZFaln7ZvYwHzVS6HkKiX9AV/Z5yQZF5zUJhfTcxqa5F45
9nmFtH7aKB8u07AOf1rqeWXGKwMNnY7Nx9b07OxS1VjL7GbX0Pd4gh/cGzHnGFjHluAF
QEJA==
X-Gm-Message-State: AFq9FYJJJEWgIE+E9sKMVEblptiSsFKnpkzqjKtUxaMdoQS8uBbcxeeB
RcI/M0YQqJ8uNmGMgnDHangI7d6Wrw02ze5N+rmOWStZsfv6Js0JOlBSu9sTA9N68Y3lDA==
X-Gm-Gg: AYBFou0RB20yUnVCBrmDGOApuCo/W8zy2X7l0MNJFzHyn6cecI4clZtI3VrA0iZH/mF
cJ/u31dxsdazi1JGbo+6HxhmZao9yWP5P8DqOqx/W7t2eqrpVJkjF0VfETiZIuic2JHD+ywmrGD
SWSt6YEC2K1/hnXyfSYkVg/NXX5Uk1Psi/7bf7626n/jI1pPqJ5SjyJumnLaY7U01eHXxuK1BM7
/17++TkacwbpiajswCoLZGm1rorzuEexl+73xxN0NJnbBs7h23ncvzeyOEeP0mPD18iRB3EaVV1
Hk9Jy9N7/hm1zWHypGXp0mApxD8VQ7gooj8LT0QHEl3GoLxzbMCQfkGITMk169r5YsvZ4/bu4AE
fTw5RrZFReqzCpiMSDe0fc8dLV4KaBoVX7e25ADj5EQNkTw9MW9iWry6bichDDYrpnE1FDpWmB8
gB3k95TTH/wNVj6JsJakVp0qpbOxB7ZUx/r3me8J39iHoLpo1yJTw/x9uPNQDJBSltqXOqKODSj
P/oRppb9jqs1P1ZYzCmhNjG1Q==
X-Received: by 2002:a05:6a00:9087:b0:892:8a3f:4515 with SMTP id d2e1a72fcca58-897c653fe48mr10529079b3a.13.1791895490641;
Tue, 13 Oct 2026 05:44:50 -0700 (PDT)
Received: from [172.29.0.63] ([43.166.7.121])
by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-896c3bcb9cbsm4861066b3a.28.2026.10.13.05.44.49
for
(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
Tue, 13 Oct 2026 05:44:50 -0700 (PDT)
Message-ID: <6ace27c2.8d268dd6.13a41e.eb77@mx.google.com>
Date: Tue, 13 Oct 2026 05:44:50 -0700 (PDT)
Content-Type: multipart/mixed; boundary="===============1760658736695121788=="
MIME-Version: 1.0
to: Doctor
from: Doctor
subject: Invoice 86296077 is processed for you
Importance: normal
Priority: normal
X-Antivirus: AVG (VPS 261012-6, 10/12/2026), Inbound message
X-Antivirus-Status: Clean
--===============1760658736695121788==
Content-Type: text/html; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
|
--===============1760658736695121788==--