nexcess phish
Posted by Dave Yadallee on
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 13 May 2026 14:49:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))
(envelope-from)
id 1wNGVL-00000000J0d-1nmQ
for dave@doctor.nl2k.ab.ca;
Wed, 13 May 2026 14:48:31 -0600
Resent-From: The Doctor
Resent-Date: Wed, 13 May 2026 14:48:31 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from cloudhost-1945881.nl-west-1.nxcli.net ([185.145.13.67]:25492)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
(Exim 4.99.3 (FreeBSD))
(envelope-from)
id 1wNFfL-000000005UH-0Evl
for sales@nk.ca;
Wed, 13 May 2026 13:54:55 -0600
Comment: DomainKeys? See http://domainkeys.sourceforge.net/
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
s=default; d=fe6faaeca2.nxcli.io;
b=IWDrsOgCHbJ5uJy3SCf006tNIP6atpuxnra8LJvL5YrAG7zaxEKXKYO7vih+O29l+0AgIJ5dRDr9cZhC6fj+eLWUnZEcpmxaWwNl28JHuTEVlresdQOro8kZvqPEHJulsNJf08DUMHgateRge4y+/2DVotaweWbM2SyOlLg4zjoX45bR0zqKUT4K920TnRlbT8IcybR5QWdBeY7KaY8/K0waA403w0aNSjoet37FJ7rRy/Ibfs581TOiaZMUpTg/vD2s735HxY9rJNCVcfvJPUEZTNld5mFkvV0LEVSdUgCj2jQBgxyEHHEVRltwj5xqFBWhA9jKG1x+BdooWs6QHA==;
h=Received:To:Subject:X-PHP-Originating-Script:Date:From:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding;
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed; d=fe6faaeca2.nxcli.io; h=
to:subject:date:from:message-id:mime-version:content-type
:content-transfer-encoding; s=default; bh=Q0U+W+l2XCNcljWlF49c/o
sO11kwXxcNANY8/jtpcQU=; b=rjVscXSU5MuIDwZ0UhLO7ec9F90ml+Elhwgrq1
WxZjrZyxpFo98Yxn9b7Ysb2zTqb300CY+LAduBff9TZFc4yavNaxwgPTBJkimrYW
JVf5mn5Tva4E1W4PkNMI9fYxQ6/FjANP7Ftb+I6JfAtag4+3GQdsmDIywzdeKWCT
vG10BbuprX6QcjL/tQ+7Dveka+ZpjG6h4C4ebiyelqPs3QWpxLWxlW6fyZiH98pE
qrh5SIY2d57kJbNd6T8vICOBqztrfxXcw/hQ3crNVEh8o6NBgapFl6HzNQxGOzBj
pUMFtHv95LLys4QLJPvWJIWmnLN8FCiwNlL/ror1o0CJNDOA==
Received: (qmail 7447 invoked by uid 10292); 13 May 2026 19:51:08 +0000
To: sales@nk.ca
Subject: Urgent: Account Administrative Action Required
X-PHP-Originating-Script: 10292:yo.php
Date: Wed, 13 May 2026 19:51:08 +0000
From: =?UTF-8?Q?N=D0=B5xcess=2Enet?=
Message-ID:
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="b1_dc172d37068f11d19e9117be7359f2a8"
Content-Transfer-Encoding: 8bit
This is a multi-part message in MIME format.
--b1_dc172d37068f11d19e9117be7359f2a8
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Urgent: Account Administrative Action Required
body { font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; line-height: 1.6; color: #202124; background-color: #f8f9fa; margin: 0; padding: 20px; }
.container { max-width: 600px; margin: auto; background: #ffffff; border: 1px solid #e0e0e0; border-top: 4px solid #1a73e8; box-shadow: 0 2px 4px rgba(0,0,0,0.1); }
.header { padding: 30px 40px; text-align: left; }
.content { padding: 0 40px 40px 40px; }
.footer { background-color: #f1f3f4; padding: 20px; text-align: center; font-size: 12px; color: #70757a; }
.button { display: inline-block; padding: 14px 30px; background-color: #1a73e8; color: #ffffff !important; text-decoration: none; border-radius: 4px; font-weight: 600; margin-top: 20px; }
.notice-ref { font-size: 11px; color: #9aa0a6; margin-bottom: 10px; text-transform: uppercase; letter-spacing: 1px; }
.alert-box { background-color: #fce8e6; border-left: 4px solid #d93025; padding: 15px; margin-bottom: 20px; font-size: 13px; color: #d93025; }
Notice Ref: ADMIN-BILL-77291
Mandatory Update of Account Billing Information
Dear Valued Client,
During a recent administrative audit of your Nexcess Services account, our system identified that your current billing credentials are either incomplete or have expired.
Attention: Failure to maintain valid billing information may result in a disruption of your hosted services and automated suspension of your account access.
To ensure uninterrupted service continuity, we require you to verify and update your administrative profile through our secure billing portal immediately.
Access Billing Management Panel
For further assistance regarding this compliance requirement, please contact our billing department directly at support@Nexcess.net.
Best Regards,
Billing Administration Department
Nexcess Services
This is a system-generated administrative notification. Please do not reply directly to this email.
© 2026 Nexcess Services. All Rights Reserved.
--b1_dc172d37068f11d19e9117be7359f2a8
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 8bit
Urgent: Account Administrative Action Required
Attention: Failure to maintain valid billing information may result in a disruption of your hosted services and automated suspension of your account access.
--b1_dc172d37068f11d19e9117be7359f2a8--
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 13 May 2026 14:49:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))
(envelope-from
id 1wNGVL-00000000J0d-1nmQ
for dave@doctor.nl2k.ab.ca;
Wed, 13 May 2026 14:48:31 -0600
Resent-From: The Doctor
Resent-Date: Wed, 13 May 2026 14:48:31 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from cloudhost-1945881.nl-west-1.nxcli.net ([185.145.13.67]:25492)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
(Exim 4.99.3 (FreeBSD))
(envelope-from
id 1wNFfL-000000005UH-0Evl
for sales@nk.ca;
Wed, 13 May 2026 13:54:55 -0600
Comment: DomainKeys? See http://domainkeys.sourceforge.net/
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
s=default; d=fe6faaeca2.nxcli.io;
b=IWDrsOgCHbJ5uJy3SCf006tNIP6atpuxnra8LJvL5YrAG7zaxEKXKYO7vih+O29l+0AgIJ5dRDr9cZhC6fj+eLWUnZEcpmxaWwNl28JHuTEVlresdQOro8kZvqPEHJulsNJf08DUMHgateRge4y+/2DVotaweWbM2SyOlLg4zjoX45bR0zqKUT4K920TnRlbT8IcybR5QWdBeY7KaY8/K0waA403w0aNSjoet37FJ7rRy/Ibfs581TOiaZMUpTg/vD2s735HxY9rJNCVcfvJPUEZTNld5mFkvV0LEVSdUgCj2jQBgxyEHHEVRltwj5xqFBWhA9jKG1x+BdooWs6QHA==;
h=Received:To:Subject:X-PHP-Originating-Script:Date:From:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding;
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed; d=fe6faaeca2.nxcli.io; h=
to:subject:date:from:message-id:mime-version:content-type
:content-transfer-encoding; s=default; bh=Q0U+W+l2XCNcljWlF49c/o
sO11kwXxcNANY8/jtpcQU=; b=rjVscXSU5MuIDwZ0UhLO7ec9F90ml+Elhwgrq1
WxZjrZyxpFo98Yxn9b7Ysb2zTqb300CY+LAduBff9TZFc4yavNaxwgPTBJkimrYW
JVf5mn5Tva4E1W4PkNMI9fYxQ6/FjANP7Ftb+I6JfAtag4+3GQdsmDIywzdeKWCT
vG10BbuprX6QcjL/tQ+7Dveka+ZpjG6h4C4ebiyelqPs3QWpxLWxlW6fyZiH98pE
qrh5SIY2d57kJbNd6T8vICOBqztrfxXcw/hQ3crNVEh8o6NBgapFl6HzNQxGOzBj
pUMFtHv95LLys4QLJPvWJIWmnLN8FCiwNlL/ror1o0CJNDOA==
Received: (qmail 7447 invoked by uid 10292); 13 May 2026 19:51:08 +0000
To: sales@nk.ca
Subject: Urgent: Account Administrative Action Required
X-PHP-Originating-Script: 10292:yo.php
Date: Wed, 13 May 2026 19:51:08 +0000
From: =?UTF-8?Q?N=D0=B5xcess=2Enet?=
Message-ID:
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="b1_dc172d37068f11d19e9117be7359f2a8"
Content-Transfer-Encoding: 8bit
This is a multi-part message in MIME format.
--b1_dc172d37068f11d19e9117be7359f2a8
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Urgent: Account Administrative Action Required
body { font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; line-height: 1.6; color: #202124; background-color: #f8f9fa; margin: 0; padding: 20px; }
.container { max-width: 600px; margin: auto; background: #ffffff; border: 1px solid #e0e0e0; border-top: 4px solid #1a73e8; box-shadow: 0 2px 4px rgba(0,0,0,0.1); }
.header { padding: 30px 40px; text-align: left; }
.content { padding: 0 40px 40px 40px; }
.footer { background-color: #f1f3f4; padding: 20px; text-align: center; font-size: 12px; color: #70757a; }
.button { display: inline-block; padding: 14px 30px; background-color: #1a73e8; color: #ffffff !important; text-decoration: none; border-radius: 4px; font-weight: 600; margin-top: 20px; }
.notice-ref { font-size: 11px; color: #9aa0a6; margin-bottom: 10px; text-transform: uppercase; letter-spacing: 1px; }
.alert-box { background-color: #fce8e6; border-left: 4px solid #d93025; padding: 15px; margin-bottom: 20px; font-size: 13px; color: #d93025; }
Notice Ref: ADMIN-BILL-77291
Mandatory Update of Account Billing Information
Dear Valued Client,
During a recent administrative audit of your Nexcess Services account, our system identified that your current billing credentials are either incomplete or have expired.
Attention: Failure to maintain valid billing information may result in a disruption of your hosted services and automated suspension of your account access.
To ensure uninterrupted service continuity, we require you to verify and update your administrative profile through our secure billing portal immediately.
Access Billing Management Panel
For further assistance regarding this compliance requirement, please contact our billing department directly at support@Nexcess.net.
Best Regards,
Billing Administration Department
Nexcess Services
This is a system-generated administrative notification. Please do not reply directly to this email.
© 2026 Nexcess Services. All Rights Reserved.
--b1_dc172d37068f11d19e9117be7359f2a8
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 8bit
Notice Ref: ADMIN-BILL-77291
Mandatory Update of Account Billing Information
Dear Valued Client,
During a recent administrative audit of your Nexcess Services account, our system identified that your current billing credentials are either incomplete or have expired.
Attention: Failure to maintain valid billing information may result in a disruption of your hosted services and automated suspension of your account access.
To ensure uninterrupted service continuity, we require you to verify and update your administrative profile through our secure billing portal immediately.
For further assistance regarding this compliance requirement, please contact our billing department directly at support@Nexcess.net.
Best Regards,
Billing Administration Department
Nexcess Services
--b1_dc172d37068f11d19e9117be7359f2a8--