Geek squad phish from Google Gmail
Posted by Dave Yadallee on
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Fri, 13 Feb 2026 08:15:00 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))
(envelope-from)
id 1vqush-000000002xF-3AgX
for dave@doctor.nl2k.ab.ca;
Fri, 13 Feb 2026 08:14:55 -0700
Resent-From: The Doctor
Resent-Date: Fri, 13 Feb 2026 08:14:55 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-oi1-f202.google.com ([209.85.167.202]:59842)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.98.2 (FreeBSD))
(envelope-from)
id 1vqtw0-00000000Jnw-2Q6V
for doctor@nl2k.ab.ca;
Fri, 13 Feb 2026 07:14:24 -0700
Received: by mail-oi1-f202.google.com with SMTP id 5614622812f47-45e76684274so5457506b6e.3
for; Fri, 13 Feb 2026 06:13:29 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=google.com; s=20230601; t=1770992004; x=1771596804; darn=nl2k.ab.ca;
h=from:subject:date:message-id:sender:reply-to:mime-version:from:to
:cc:subject:date:message-id:reply-to;
bh=idNTdUvjrAqB4N3za/VbvkqjswsxXPsp2r8TweUt9VM=;
b=KUb/clb8UfLX9xioeHWo2eWluwNR+zewotdeEP01VoyPk8SP2SPIqLOUKf3Fk0z1X+
+ksOxX115BslM/ym8fORBEy2dTS/BOhMwU3EdncKHbUDTCLr3RdfLzcK9DO2iHdP5uli
478Rp5owwNr7C+y+6z9GAFZgQ6khgpiVT4SFNQwjYUTauQr33vYUpKNTfzCg0F8I1Kue
TJRpKbUC/N1v4Q4HGouyo1QLbteKoTSmVAWtELZO2moOvaE68ns1qIJWbsVB+MWfiunI
YMD9YHPf+l+88O/7u1YKL/7RJ0BB0jmyjBLHqHEkjwR1sMQe8It2apcfRVRXvfEx78B0
HznQ==
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=ambpskd-org.20230601.gappssmtp.com; s=20230601; t=1770992004; x=1771596804; darn=nl2k.ab.ca;
h=from:subject:date:message-id:sender:reply-to:mime-version:from:to
:cc:subject:date:message-id:reply-to;
bh=idNTdUvjrAqB4N3za/VbvkqjswsxXPsp2r8TweUt9VM=;
b=eJvvF9QxSuB2zlg58ceOaJ/g4TbHeJuibBFANQVvEyOCA4KelpKlMDtMI8jCWrXf2A
cRYNWtwlNZbIh7XDxwVtA2CajEv6z03yUDwVg452oZ/sA7oFeF3KM3OvXxyImpCrZVEh
CGOQHLn1M34chYlyV6EVvR2fejZqeKbfjw98Zrcd+Dqjr8xh0EGBiUT74nKiHN71XB0e
+2bZS6erwQXPkXdLAecg81uerBlJhePP1U9GGL3eRaxxIIJvAdP4NW2ErDs5el1MC3f4
uLHQvTEQQ+uFk8QScIq+hOg0xbqIHbPy069CIAzvrj9sC3SNig7UPiBqI10NbeYcYa57
eMpw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20230601; t=1770992004; x=1771596804;
h=from:subject:date:message-id:sender:reply-to:mime-version
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
bh=idNTdUvjrAqB4N3za/VbvkqjswsxXPsp2r8TweUt9VM=;
b=sS9Vova+HaxLOubPqVs5JzTVI60EL7KkrcIK+5EmXRl0eflQL5fnDyWwtIW6CtH9YB
9rg9RX0+kZE378wymYc7Pu68jjZXzXKyykdbTyJo7r7xcQWjqum7ORO26RiwsHk/IUru
xu9arherIkPTtRv9oXjMHpOOmNb3dkyDKNEUqX5DSIAAlhIRLgmyHhXCqxrG5wCrO70P
8iTGfQ3zhaApomZOYwN9lkJBMWHGqY+9ZPn/TksDa1s8mRCPrHyG5xq0quIQhbMcmG5L
trDxzppa6IwaieysAfpCH5mdCCnuRTW8HFW2eZgvluV2PAYSY6ZEEBwnPx5TvNFSOAMX
pBzA==
X-Forwarded-Encrypted: i=1; AJvYcCWWAdpQfd8J17CSMmI4MgJTijrXA2F4a6m++pDjDrF7zONVoM1QmKtmSDlJMhLs77dwfpGZ/hk=@nl2k.ab.ca
X-Gm-Message-State: AOJu0YyuX6VWtaQeMfoQrh1P9q8AS5Erd92xn93zhDuK9JLF4PLNgiD4
z5MTELgyuz4M43hwfNu/k4y4aMpUAlUKW4SUnP+6GQsTFi2bLws7mQuzQUt2ExSIn+qfYx7eEfn
XLRfqk61EDvAiTp0vWhiDMFr44PwllBnTcrsDsNSaw028BA==
MIME-Version: 1.0
X-Received: by 2002:a05:6808:c2a3:b0:45e:ed0b:88a5 with SMTP id
5614622812f47-4639ef50bd0mt1272621b6e.25.1770992003775; Fri, 13 Feb 2026
06:13:23 -0800 (PST)
Reply-To: Kyle Simmons
Sender: Google Calendar
Message-ID:
Date: Fri, 13 Feb 2026 14:13:23 +0000
Subject: Review details saved for Valued Customer Receipt
From: Kyle Simmons
Content-Type: multipart/alternative; boundary="0000000000004bd6c8064ab53573"
X-Spam_score: 15.1
X-Spam_score_int: 151
X-Spam_bar: +++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Review details saved for Valued Customer Receipt Review details
saved for Valued Customer Receipt Friday Feb 13, 2026 â‹… 10:13pm Eastern
Time - New York Geek Squad{ 1-806- 577-5489 }Receipt Date: Friday, 13 February
2026Receipt no: 1087-1095-324Subscription active after renewalYour subscription
with Geek Squad has now expired after 12 Months.Order Inf [...]
Content analysis details: (15.1 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[209.85.167.202 listed in dnsbl.ahbl.org]
[209.85.167.202 listed in dnsbl.ahbl.org]
[209.85.167.202 listed in dnsbl.ahbl.org]
[209.85.167.202 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[209.85.167.202 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[209.85.167.202 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[209.85.167.202 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[209.85.167.202 listed in dnsbl.ahbl.org]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.167.202 listed in list.dnswl.org]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[209.85.167.202 listed in will-spam-for-food.eu.org]
[209.85.167.202 listed in will-spam-for-food.eu.org]
[209.85.167.202 listed in will-spam-for-food.eu.org]
[209.85.167.202 listed in will-spam-for-food.eu.org]
[209.85.167.202 listed in will-spam-for-food.eu.org]
[209.85.167.202 listed in will-spam-for-food.eu.org]
[209.85.167.202 listed in will-spam-for-food.eu.org]
[209.85.167.202 listed in will-spam-for-food.eu.org]
1.2 MISSING_HEADERS Missing To: header
0.6 J_CHICKENPOX_83 BODY: 8alpha-pock-3alpha
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.167.202 listed in wl.mailspike.net]
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
1.9 REPLYTO_WITHOUT_TO_CC No description available.
2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
3.0 LONG_INVISIBLE_TEXT Long block of hidden text - bayes poison?
1.5 VOWEL_FROM_6 Impronouncable from header (6 consecutive vowels)
Subject: {SPAM?} Review details saved for Valued Customer Receipt
Review details saved for Valued Customer Receipt
Review details saved for Valued Customer Receipt
Friday Feb 13, 2026 ⋅ 10:13pm (Eastern Time - New York)
Geek Squad
{ 1-806- 577-5489 }
Receipt Date: Friday, 13 February 2026
Receipt no: 1087-1095-324
Subscription active after renewal
Your subscription with Geek Squad has now expired after 12 Months.
Order Information Dashboard
Subscribed Service- Premium Complete
Warranty Coverage- 12 Months
Total Charged- $442.88
This notice is sent because you were enrolled in our services.
To request cancellation and a full refund, contact +1 (864) 363-1207.
With pleasure,
The Geek Squad, llc
Manager: Bobbie Bell
Copyright ©2026 company. All rights reserved.
Guests
(Guest list has been hidden at organizer's request)
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Fri, 13 Feb 2026 08:15:00 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))
(envelope-from
id 1vqush-000000002xF-3AgX
for dave@doctor.nl2k.ab.ca;
Fri, 13 Feb 2026 08:14:55 -0700
Resent-From: The Doctor
Resent-Date: Fri, 13 Feb 2026 08:14:55 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-oi1-f202.google.com ([209.85.167.202]:59842)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.98.2 (FreeBSD))
(envelope-from
id 1vqtw0-00000000Jnw-2Q6V
for doctor@nl2k.ab.ca;
Fri, 13 Feb 2026 07:14:24 -0700
Received: by mail-oi1-f202.google.com with SMTP id 5614622812f47-45e76684274so5457506b6e.3
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=google.com; s=20230601; t=1770992004; x=1771596804; darn=nl2k.ab.ca;
h=from:subject:date:message-id:sender:reply-to:mime-version:from:to
:cc:subject:date:message-id:reply-to;
bh=idNTdUvjrAqB4N3za/VbvkqjswsxXPsp2r8TweUt9VM=;
b=KUb/clb8UfLX9xioeHWo2eWluwNR+zewotdeEP01VoyPk8SP2SPIqLOUKf3Fk0z1X+
+ksOxX115BslM/ym8fORBEy2dTS/BOhMwU3EdncKHbUDTCLr3RdfLzcK9DO2iHdP5uli
478Rp5owwNr7C+y+6z9GAFZgQ6khgpiVT4SFNQwjYUTauQr33vYUpKNTfzCg0F8I1Kue
TJRpKbUC/N1v4Q4HGouyo1QLbteKoTSmVAWtELZO2moOvaE68ns1qIJWbsVB+MWfiunI
YMD9YHPf+l+88O/7u1YKL/7RJ0BB0jmyjBLHqHEkjwR1sMQe8It2apcfRVRXvfEx78B0
HznQ==
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=ambpskd-org.20230601.gappssmtp.com; s=20230601; t=1770992004; x=1771596804; darn=nl2k.ab.ca;
h=from:subject:date:message-id:sender:reply-to:mime-version:from:to
:cc:subject:date:message-id:reply-to;
bh=idNTdUvjrAqB4N3za/VbvkqjswsxXPsp2r8TweUt9VM=;
b=eJvvF9QxSuB2zlg58ceOaJ/g4TbHeJuibBFANQVvEyOCA4KelpKlMDtMI8jCWrXf2A
cRYNWtwlNZbIh7XDxwVtA2CajEv6z03yUDwVg452oZ/sA7oFeF3KM3OvXxyImpCrZVEh
CGOQHLn1M34chYlyV6EVvR2fejZqeKbfjw98Zrcd+Dqjr8xh0EGBiUT74nKiHN71XB0e
+2bZS6erwQXPkXdLAecg81uerBlJhePP1U9GGL3eRaxxIIJvAdP4NW2ErDs5el1MC3f4
uLHQvTEQQ+uFk8QScIq+hOg0xbqIHbPy069CIAzvrj9sC3SNig7UPiBqI10NbeYcYa57
eMpw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20230601; t=1770992004; x=1771596804;
h=from:subject:date:message-id:sender:reply-to:mime-version
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
bh=idNTdUvjrAqB4N3za/VbvkqjswsxXPsp2r8TweUt9VM=;
b=sS9Vova+HaxLOubPqVs5JzTVI60EL7KkrcIK+5EmXRl0eflQL5fnDyWwtIW6CtH9YB
9rg9RX0+kZE378wymYc7Pu68jjZXzXKyykdbTyJo7r7xcQWjqum7ORO26RiwsHk/IUru
xu9arherIkPTtRv9oXjMHpOOmNb3dkyDKNEUqX5DSIAAlhIRLgmyHhXCqxrG5wCrO70P
8iTGfQ3zhaApomZOYwN9lkJBMWHGqY+9ZPn/TksDa1s8mRCPrHyG5xq0quIQhbMcmG5L
trDxzppa6IwaieysAfpCH5mdCCnuRTW8HFW2eZgvluV2PAYSY6ZEEBwnPx5TvNFSOAMX
pBzA==
X-Forwarded-Encrypted: i=1; AJvYcCWWAdpQfd8J17CSMmI4MgJTijrXA2F4a6m++pDjDrF7zONVoM1QmKtmSDlJMhLs77dwfpGZ/hk=@nl2k.ab.ca
X-Gm-Message-State: AOJu0YyuX6VWtaQeMfoQrh1P9q8AS5Erd92xn93zhDuK9JLF4PLNgiD4
z5MTELgyuz4M43hwfNu/k4y4aMpUAlUKW4SUnP+6GQsTFi2bLws7mQuzQUt2ExSIn+qfYx7eEfn
XLRfqk61EDvAiTp0vWhiDMFr44PwllBnTcrsDsNSaw028BA==
MIME-Version: 1.0
X-Received: by 2002:a05:6808:c2a3:b0:45e:ed0b:88a5 with SMTP id
5614622812f47-4639ef50bd0mt1272621b6e.25.1770992003775; Fri, 13 Feb 2026
06:13:23 -0800 (PST)
Reply-To: Kyle Simmons
Sender: Google Calendar
Message-ID:
Date: Fri, 13 Feb 2026 14:13:23 +0000
Subject: Review details saved for Valued Customer Receipt
From: Kyle Simmons
Content-Type: multipart/alternative; boundary="0000000000004bd6c8064ab53573"
X-Spam_score: 15.1
X-Spam_score_int: 151
X-Spam_bar: +++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Review details saved for Valued Customer Receipt Review details
saved for Valued Customer Receipt Friday Feb 13, 2026 â‹… 10:13pm Eastern
Time - New York Geek Squad{ 1-806- 577-5489 }Receipt Date: Friday, 13 February
2026Receipt no: 1087-1095-324Subscription active after renewalYour subscription
with Geek Squad has now expired after 12 Months.Order Inf [...]
Content analysis details: (15.1 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[209.85.167.202 listed in dnsbl.ahbl.org]
[209.85.167.202 listed in dnsbl.ahbl.org]
[209.85.167.202 listed in dnsbl.ahbl.org]
[209.85.167.202 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[209.85.167.202 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[209.85.167.202 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[209.85.167.202 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[209.85.167.202 listed in dnsbl.ahbl.org]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.167.202 listed in list.dnswl.org]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[209.85.167.202 listed in will-spam-for-food.eu.org]
[209.85.167.202 listed in will-spam-for-food.eu.org]
[209.85.167.202 listed in will-spam-for-food.eu.org]
[209.85.167.202 listed in will-spam-for-food.eu.org]
[209.85.167.202 listed in will-spam-for-food.eu.org]
[209.85.167.202 listed in will-spam-for-food.eu.org]
[209.85.167.202 listed in will-spam-for-food.eu.org]
[209.85.167.202 listed in will-spam-for-food.eu.org]
1.2 MISSING_HEADERS Missing To: header
0.6 J_CHICKENPOX_83 BODY: 8alpha-pock-3alpha
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.167.202 listed in wl.mailspike.net]
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
1.9 REPLYTO_WITHOUT_TO_CC No description available.
2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
3.0 LONG_INVISIBLE_TEXT Long block of hidden text - bayes poison?
1.5 VOWEL_FROM_6 Impronouncable from header (6 consecutive vowels)
Subject: {SPAM?} Review details saved for Valued Customer Receipt
Review details saved for Valued Customer Receipt
Review details saved for Valued Customer Receipt
Friday Feb 13, 2026 ⋅ 10:13pm (Eastern Time - New York)
Geek Squad
{ 1-806- 577-5489 }
Receipt Date: Friday, 13 February 2026
Receipt no: 1087-1095-324
Subscription active after renewal
Your subscription with Geek Squad has now expired after 12 Months.
Order Information Dashboard
Subscribed Service- Premium Complete
Warranty Coverage- 12 Months
Total Charged- $442.88
This notice is sent because you were enrolled in our services.
To request cancellation and a full refund, contact +1 (864) 363-1207.
With pleasure,
The Geek Squad, llc
Manager: Bobbie Bell
Copyright ©2026 company. All rights reserved.
Guests
(Guest list has been hidden at organizer's request)