McAfee Phish from Google

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 31 Jan 2023 08:28:38 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)

(envelope-from )

id 1pMsYo-000I5H-2K

for dave@doctor.nl2k.ab.ca;

Tue, 31 Jan 2023 08:28:38 -0700

Resent-From: The Doctor

Resent-Date: Tue, 31 Jan 2023 08:28:38 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pg1-f179.google.com ([209.85.215.179]:37554)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.96)

(envelope-from )

id 1pMrLc-00090y-1v

for sales@netknow.ca;

Tue, 31 Jan 2023 07:11:00 -0700

Received: by mail-pg1-f179.google.com with SMTP id v3so10127674pgh.4

for ; Tue, 31 Jan 2023 06:08:58 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20210112;

h=date:mime-version:to:subject:from:message-id:from:to:cc:subject

:date:message-id:reply-to;

bh=vO3VrkNQrgIAew2m1Rt2wfp2dsIwlV+7sJtSBGkG7fM=;

b=Pbhg4h9z4LtWcXEfZ3meEZYaE+RmKX0cNwRk771N6EpZocLTPuSEfzmS9nFpvYXM9f

bGOYdudFyYs4AFgyUCmKFgw1/vq94YBtVMhqNgV5Taxu5RhQDx4hG/7wS0whRDGac9q/

0hju1QoTsJEGqmLWznpQO34vVLumVOKjKQsVzMZqw+o8kaNsnu6N9cCH2qxOwgmRneYm

qh1h2PSE6b5n3IBJpKE/3/mW/3eDA2KJzRcY+bJVjKu2NMBiHPPS3WkjJriItVOX822i

wcjVpVcEOARQXYFrU/xxhwBq6OC/ePsi2voBiZWetUeMjpwXHm8yXMqeAnMjGF1bJybH

BSJA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=date:mime-version:to:subject:from:message-id:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=vO3VrkNQrgIAew2m1Rt2wfp2dsIwlV+7sJtSBGkG7fM=;

b=20xZK/F9RtykeOhr9lC8Z9mdUo4DtKdH+W1/9D7bhYHOXrm1SdDXEht0ijc5KWimSk

3nN1wskdo1ZTd263n1tfB/F6FuiUITIrCgGXP9MBYw+yjwfMlvytCzP6z0J78HZp7zX0

Y/oX/hw6fC3wfXT2V3rly2rzPHXZXiPn22BO9NIrDkqB5rFZSVMKsdpgzN8+MzKCJPKN

enXDripXntDvLDi0vBK/BeL71CnNWZ7Ia8K40aEY0I7QJes6GMMW5PhtbvXMZCRN36bs

WjfrVkEBSl5xzHqbdcQf585MisA+ig9PytO8ToYPwjX9w7+UWr3AkdkP6xJLC4cIEOPA

US9g==

X-Gm-Message-State: AO0yUKUEBAPPykXjPDS1VTlYkwvBAFn+lcSjZTTyO8RcwkJvmPBRbBZT

wsvW97BHfRjeuK6Czw7lnCVWS51TESpU+g==

X-Google-Smtp-Source: AK7set9BDcAi1ia/ueJNZ4q9VBr2G+w9o5gHnybyxzXV0HTRPW+Rmu9RNoy2A65cGvJ34ucCUfxsZw==

X-Received: by 2002:a05:6a00:ac7:b0:590:76bb:b969 with SMTP id c7-20020a056a000ac700b0059076bbb969mr26263469pfl.8.1675174131747;

Tue, 31 Jan 2023 06:08:51 -0800 (PST)

Received: from 192.145.119.179 ([192.145.119.179])

by smtp.gmail.com with ESMTPSA id x5-20020a056a00188500b0059072da44f3sm3623013pfh.130.2023.01.31.06.08.49

for

(version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);

Tue, 31 Jan 2023 06:08:51 -0800 (PST)

Message-ID: <63d920f3.050a0220.600f0.6d07@mx.google.com>

From: "Robert William"

Subject: Subscription Updated 68IGA

To: "sales"

Content-Type: multipart/alternative; boundary="gNuXJ9Hyd9fV4WN8NWfb=_PB6lAID13dXH"

MIME-Version: 1.0

Date: Tue, 31 Jan 2023 19:38:50 +0530



This is a multi-part message in MIME format



--gNuXJ9Hyd9fV4WN8NWfb=_PB6lAID13dXH

Content-Type: text/plain; charset="utf-8"

Content-Transfer-Encoding: quoted-printable

Content-Disposition: inline



Date: 31-Jan-2023





Customer Helpline: +1 808 272 9966



Annual Plan Update





Hi Dear, sales@netknow.ca



On 31-Jan-2023, Your McAfee Total Anti Protection Plan subscription fo=

r your devices comes up for renewal.



We are extending the life of your plan for an additional year due to d=

emand for our auto debit service.





Order Details:



Product: McAfee Total Anti Pro Shield ( 1 Year Subscription )

Charges: $329.99

Payment Mode: Auto-Debit

Renewal Date: 31-Jan-2023

Valid Till: 30-Jan-2024

Order Id: QBTY_490164

Transaction Id: VNHCJYNNZD8





You can cancel a recurring subscription from your account and your aut=

o debit services while managing your subscriptions here.



Please contact our online service team at (+1 808 272 9966) if you hav=

e any questions about this email or need more information about this t=

ransaction.





Many thanks,



Robert William

Consumer Handling & Account Team.





--gNuXJ9Hyd9fV4WN8NWfb=_PB6lAID13dXH

Content-Type: text/html; charset="utf-8"

Content-Transfer-Encoding: quoted-printable

Content-Disposition: inline




left; line-height: 115%; font-family: Calibri, sans-serif; font-size:=

15px;">
Times New Roman", serif; font-size: 14px;'>Date: 31-Jan-2023
an style=3D"font-size: 14px;">




font-family: Calibri, sans-serif; font-size: 15px;">
lor: rgb(0, 0, 0); font-size: 14px;">Customer Helpline: +1 808=

272 9966




font-family: Calibri, sans-serif; font-size: 15px;">
lor: black; line-height: 115%; font-family: "Times New Roman", serif; =

font-size: 14px;'>Annual Plan Update
>



Hello Dear, sales@netknow.ca
>



On 31-Jan-2023, Your McAfee Total =

Anti Protection Plan subscription for your devices comes up for renewa=

l.



We are extending the life of your =

plan for an additional year due to demand for our auto debit service.<=

/span>





nherit; font-size: 14px;">Order Details:



Product:
(85, 57, 130);">McAfee Total Anti Pro Shield ( 1 Year Subscription )
span>
Charges: $329.99
an>
Payment Mode: Auto-Deb=

it
Renewal Date: 31=

-Jan-2023
Valid Till:
;">30-Jan-2024
Order Id:
30);">QBTY_490164
Transaction Id: VSM8SUBJODF

=



You can cancel a recurring subscri=

ption from your account and your auto debit services while managing yo=

ur subscriptions here.



Please contac=

t our online service team at
47, 218, 100);">(+1 808 272 9966) if you h=

ave any questions about this email or need more information about this=

transaction.





Yours sincerely,




176);">
transform: none; text-indent: 0px; letter-spacing: normal; font-family=

: arial, sans-serif; font-size: 14px; font-style: normal; font-weight:=

400; word-spacing: 0px; float: none; display: inline !important; whit=

e-space: nowrap; orphans: 2; widows: 2; background-color: rgb(255, 255=

, 255); font-variant-ligatures: normal; font-variant-caps: normal; -we=

bkit-text-stroke-width: 0px; text-decoration-thickness: initial; text-=

decoration-style: initial; text-decoration-color: initial;">Robert Wil=

liam
McAfee Total Tech & Support Team.


dy>





--gNuXJ9Hyd9fV4WN8NWfb=_PB6lAID13dXH--



Nigerian Gmail spam

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 30 Jan 2023 23:01:37 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)

(envelope-from )

id 1pMjhf-000A3F-0Y

for dave@doctor.nl2k.ab.ca;

Mon, 30 Jan 2023 23:01:11 -0700

Resent-From: The Doctor

Resent-Date: Mon, 30 Jan 2023 23:01:11 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pg1-f174.google.com ([209.85.215.174]:40514)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.96)

(envelope-from )

id 1pMjFd-0008xe-12

for doctor@doctor.nl2k.ab.ca;

Mon, 30 Jan 2023 22:32:16 -0700

Received: by mail-pg1-f174.google.com with SMTP id 7so4359766pgh.7

for ; Mon, 30 Jan 2023 21:30:14 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20210112;

h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc

:subject:date:message-id:reply-to;

bh=IMYWIrRq8ndNWOy0tMStjdQPcxxkMl/m7Y5ibQCpJCE=;

b=Spp6eW44KcUO1D7NWRjHf+wNECTj49Kn9IK8xT2NHhIIgVDHCQkQydlC3ap1HheAW7

2dIbFeHr5XODEOGD/9uU+eYqp/J+BPPvvhXsfaskaFXSQOKjwjTIkhmBIVe/5fogF1qm

YohMOlKmlHGmWTPMiVQVqySiCm4S++2A6f1vv5C3ZbsIhq76tqOp2pa0ItMo9n7k1qJE

ovRBt/d5Ho59JMuxJFqpo1jliIOOJuOy2wMorFreJdjJX8A9MwglCBRTgoIgmYbllRab

1g9OWJQayt5aRuIG9SfACBrmzPom7sw4GzzTYNGmF+aSSYz4jc3bjp5HFvLEzcdriJHc

uFDw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=to:subject:message-id:date:from:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=IMYWIrRq8ndNWOy0tMStjdQPcxxkMl/m7Y5ibQCpJCE=;

b=3yJlU+rQyPUnMc27BR4Y/3Puehma+bGtwH3BlEZgp+nOXeDaLQKJVwU/hzV82gq8Ab

9kZhyvzhm2ZP4edi7/nirfOZQLk0UWbkUKAUu6VHW3u/Kq48j+ak2nekO29iZESeRqUB

Db1Dc0VlVNPmmcUfDlG21ZW9/n5b1dzjr/jBUnELxvUOT0lSdB3PF4/kkfoUBLUDDfPz

OfmlRDtz+NhQN/OWsLGk+BWdI/9KOb4Wokw3xDSquzNb9QAT5QRlfjLZf/1Tnml/Fa5x

4bCKoNclRfs2ja//ui/YBZ7PDUZj/jSrIzsnnn519/XPdXGUfxZF3FtwKNk29CUYY7mj

jK1g==

X-Gm-Message-State: AO0yUKW3Solp+l1aSeQMejgfusG24EbmVs9+gM3Q9kKPWrdYUV0cKDWD

5mcr7bIZksCL3EAbui2N3whwWTJjA61P/GwC47k=

X-Google-Smtp-Source: AK7set/AdTyRrf3xyBWUYQCZAzIOhUZd+E4nMqdIqBULx6sRGfJyDPuQoEZZ1DN0usaQ8QNpJYRWpdupZZcE1hEXLc8=

X-Received: by 2002:a62:3681:0:b0:593:d4cb:dba2 with SMTP id

d123-20020a623681000000b00593d4cbdba2mr863916pfa.13.1675143008520; Mon, 30

Jan 2023 21:30:08 -0800 (PST)

MIME-Version: 1.0

Reply-To: cbudanov@gmx.com

From: cyril bedanov

Date: Mon, 30 Jan 2023 21:29:25 -0800

Message-ID:

Subject: I NEED YOUR ASSISTANCE..

To: budanov11

Content-Type: multipart/alternative; boundary="000000000000f891e105f3889f58"

Bcc: doctor@doctor.nl2k.ab.ca

X-Spam_score: 6.8

X-Spam_score_int: 68

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Greetings Dear, I am General Cyril Budanov, officer commanding

363rd security and service battalion (MU A1785). Ukraine.. I need your assistance

in securing some funds on my behalf and this is why I am contacting you..

my troops have stumbled upon (€16.2million euro) which was discovered last

month here in ukraine..



Content analysis details: (6.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.215.174 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

1.6 SUBJ_ALL_CAPS Subject is all capitals

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[bedanobudanova(at)gmail.com]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.215.174 listed in wl.mailspike.net]

0.0 HTML_MESSAGE BODY: HTML included in message

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different

freemails

0.0 LOTS_OF_MONEY Huge... sums of money

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?

0.5 MONEY_FRAUD_8 Lots of money and very many fraud phrases

3.7 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money

Subject: {SPAM?} I NEED YOUR ASSISTANCE..



--000000000000f891e105f3889f58

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Greetings Dear,



I am General Cyril Budanov, officer commanding 363rd security and

service battalion (MU A1785). Ukraine..



I need your assistance in securing some funds on my behalf and this

is why I am contacting you.. my troops have stumbled upon

(=E2=82=AC16.2million euro) which was discovered last month here in ukrain=

e..



my officers came across this raw cash during our strategic night

routing in one of the local banks here in eastern cities of ukraine,

after the bombardment by the russian soldier through an air rocket

lunchers a day earlier..



.The 2 locked boxes was handed over to me as a commandant in-charge

and I have successfully deposited and move this funds out of here

through diplomatic courier service to one of the southeast asian

country that will later be disclosed to you..



I need someone I could trust and deal with. If you accept, I shall

instruct the diplomatic courier to contact you and move the funds to

wherever you are as the beneficiary without any delay..



Should you interested in this transaction, I will provide full details

as to how you can handle this transaction successfully.. I believe I

can trust you and tender my resignation letter as soon as you recieve

the funds and come over to your country for a joint business partners



I can only communicate through our military communication facilities

for now of which i believe is more secured and safer to avoid any

detection, I will only reach you through emails at the moments for

security reasons.... Telephone calls may be monitored,



Do not be sceptical neither worried about how this large sum will get to

you..



. herebelow are the statutory obligation of DIPLOMATIC COURIERS



Under the Vienna Convention, couriers are also granted diplomatic

immunity delivery status. This means that when couriers are travelling

with designated diplomatic ;pouchs; they cannot be arrested or

detained. To ensure their diplomatic immunity delivery status,

couriers always travel with the proper documentation reporting their

status as couriers and outlining the number of packages they are

transporting.



,Do note that am revealing this deal to you with belief that you will

never let me down..



please reply me immediately so that I can contact you for further

inquiries. REPLYWITH MY DIRECT EMAIL ADRESS .. (cbudanov@gmx.com)



Await for your reply..



Gen. Cyril Budanov



--000000000000f891e105f3889f58

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Greetings Dear,

I am =C2=A0General Cyril Budanov, =

=C2=A0officer commanding 363rd security and
service battalion (MU A1785)=

. Ukraine..

I need your assistance in securing some funds on my beha=

lf =C2=A0and this
is why I am contacting you.. =C2=A0my troops have stum=

bled upon
(=E2=82=AC16.2million euro) =C2=A0which was discovered last mo=

nth here in ukraine..

=C2=A0my officers came across this raw cash du=

ring our strategic night
routing in one of the local banks here in easte=

rn cities of ukraine,
after the bombardment by the russian soldier throu=

gh an air rocket
lunchers a day earlier..

.The 2 locked boxes was=

handed over to me as a commandant in-charge
and I have successfully dep=

osited =C2=A0and move this funds out of here
through diplomatic courier =

service to one of the southeast asian
country that will later be disclos=

ed to you..

I need someone I could trust and deal with. If you accep=

t, I shall
instruct the diplomatic courier to contact you and move the f=

unds to
wherever you are as the beneficiary without any delay..

S=

hould you interested in this transaction, I will provide full details
as=

to how you can handle this transaction successfully.. I believe I
can t=

rust you and tender my resignation letter as soon as you recieve
the fun=

ds and come over to your country for a joint business partners

=C2=

=A0I can only communicate through our military communication facilities
=

for now of which i believe is =C2=A0more secured and safer to avoid any
=

detection, =C2=A0I will only reach you through emails at the moments for
>security reasons.... Telephone calls may be monitored,

Do not be sc=

eptical neither worried about how this large sum will get to you..

.=

herebelow are the statutory obligation of DIPLOMATIC COURIERS

Under=

the Vienna Convention, couriers are also granted diplomatic
immunity de=

livery status. This means that when couriers are travelling
with designa=

ted diplomatic ;pouchs; they cannot be arrested or
detained. To ensure t=

heir diplomatic immunity delivery status,
couriers always travel with th=

e proper documentation reporting their
status as couriers and outlining =

the number of packages they are
transporting.

,Do note that am re=

vealing this deal to you with belief that you will
never let me down..
r>
=C2=A0please reply me immediately so that I can contact you for furth=

er
inquiries. REPLYWITH MY DIRECT EMAIL ADRESS .. (
danov@gmx.com">cbudanov@gmx.com)

Await for your reply..

G=

en. Cyril Budanov




--000000000000f891e105f3889f58--