Phish | Entries from Thursday, July 13. 2023

Geek Squad phish from gmail

Posted by Dave Yadallee on Thursday, July 13. 2023

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 13 Jul 2023 14:07:05 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96 (FreeBSD))

(envelope-from )

id 1qK2YY-0008Tx-06

for dave@doctor.nl2k.ab.ca;

Thu, 13 Jul 2023 14:04:54 -0600

Resent-From: The Doctor

Resent-Date: Thu, 13 Jul 2023 14:04:54 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-yb1-f180.google.com ([209.85.219.180]:44049)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.96 (FreeBSD))

(envelope-from )

id 1qJzFQ-00057q-0R

for root@nl2k.ab.ca;

Thu, 13 Jul 2023 10:32:58 -0600

Received: by mail-yb1-f180.google.com with SMTP id 3f1490d57ef6-bd77424c886so858312276.0

for ; Thu, 13 Jul 2023 09:31:19 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20221208; t=1689265873; x=1691857873;

h=date:organization:mime-version:to:subject:from:message-id:from:to

:cc:subject:date:message-id:reply-to;

bh=osD5HHv4TT61vgSicVmw9pEQfgwqWCm0OjHcIuH9A54=;

b=WYT1mNa7W0zgWG4YVioMX8P5Lk52+Yn1u888o1v73DErRCEPwviowtebNFBa1jjBJN

6SECmxFo0Yuz1V1c2XoLUP0iOQ4l8x+SYznkOr0vBQZDyimvyBcVSNcnNUkSo0ASyt/T

Ii/oKPw/wTpZ3KSPYD0t5oO/8DkCsdqtzOKu0PZ3UFd0z9PMrLbFjw6SqeUMper9Tk1d

G5OKntpNxQX14S0nhPsfGvAPpT+1S34D6OPoTL/pwdKmHvISy9IAwhcyweN3/j04+xtB

vDY714aDeyAab/+2Fsi+ff7LbaPQ3QiN4m1wPMo48bM2OfvVopdBdGR0mEnkZknME7TZ

+hTA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20221208; t=1689265873; x=1691857873;

h=date:organization:mime-version:to:subject:from:message-id

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=osD5HHv4TT61vgSicVmw9pEQfgwqWCm0OjHcIuH9A54=;

b=LDN5nS6TEAEsC54DXc+TmWjJqBwnduAjR00wBTc/sYaN48DA8kQa3nV2WMwH0y4EN1

X8VEtPIWoYwHu0veG4rgnmHw79ZnH/RMq8Trq6TTe/8KrCT9NwEuw9qRYoHUXcYXFpcU

cgpcBIlSWVTNcJgORMoJmdYWKPxaxbZV0ZJwMYLLlsNiusv1KEs/bxWGgGwldjIpBYdB

+ix3NqcXSU9/XNl1IzJBb2iLq7/DMQb/6jK0jnZFmRVP7fNBI/VKmEzZgVzsYm/GYlQ0

ZcSY/6OHxFEsWSvc0nvk+TixaEyE/ErNhxW/o1QsfgBTuwvuKPgEVkNLJQH7U6SYmyoi

u43A==

X-Gm-Message-State: ABy/qLbgqhHGu8BkvBsQczts+mlowRPEmjxysrxcCbd6t/kwcBnoF7mP

vjRlO8Xun2mdAeVsY2zbeUqfBBQbIzexptj0oNRy9A==

X-Google-Smtp-Source: APBJJlELqpjC/mjLXfU1VQfGcBOym+43sm+7xjjX+M6mCbYmLIvqA/c+iHX004I9xiL1YH2h/A+HwA==

X-Received: by 2002:a5b:b51:0:b0:c60:8e77:6311 with SMTP id b17-20020a5b0b51000000b00c608e776311mr1739341ybr.30.1689265873504;

Thu, 13 Jul 2023 09:31:13 -0700 (PDT)

Received: from 194.233.98.55 ([194.233.98.55])

by smtp.gmail.com with ESMTPSA id b16-20020a5b0090000000b00c60a6b38427sm1398901ybp.26.2023.07.13.09.31.12

for

(version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);

Thu, 13 Jul 2023 09:31:13 -0700 (PDT)

Message-ID: <64b026d1.5b0a0220.2cd74.9a83@mx.google.com>

From: "Zack Johnson"

Subject: =?utf-8?B?T3JkZXIgQ29uZmlybWF0aW9uIERldGFpbHMjODQwODM3CQ==?=

To: "root"

Content-Type: multipart/alternative; boundary="kbtD6oG4=_auS2heATOAcb8DNLkBb364gs"

MIME-Version: 1.0

Organization: Subscription Renewal Dept.

Date: Thu, 13 Jul 2023 22:01:11 +0530

This is a multi-part message in MIME format

--kbtD6oG4=_auS2heATOAcb8DNLkBb364gs

Content-Type: text/plain; charset="utf-8"

Content-Transfer-Encoding: quoted-printable

Content-Disposition: inline

Receipt from : 13 July, 2023

Hello there, root@nl2k.ab.ca

We are delighted that you have renewed your PC Security yearly members=

hip with =C3=B9s.

The services will be restored within 04 to 24 hours, and the plan will=

be in =C3=A8ffect until July 12, 2024.

As authorized by you, we have debited your account with ($ 398.00) , t=

his amount will be visible on the statement shortly.

For assistance, reach out our support team at # +1 (833) 505-2616 (Tol=

l-free)

Order Renewal Details: -

Customer ID- 794-0361-73794

Product Name- Ge=C3=A9k-Squ=C3=A5d PC and Network Protection Shield

Renewal Date- July 13, 2023

Annual Charge- $ 398.00

Please be aware that because you have chosen auto debit, your subscrip=

tion will be =C3=A2utomatically renewed every year, and the same recur=

ring amount will be paid.

However, if you don't wish to continue with our services or you would =

like drop all the charges and get the full =C3=A0mount refunded back, =

please contact us immediately.

For Cancellation, Contact Support at # +1 (833) 505-2616

We obliged to you

Pamela Williams

Membership Plan Details#840149=09

--kbtD6oG4=_auS2heATOAcb8DNLkBb364gs

Content-Type: text/html; charset="utf-8"

Content-Transfer-Encoding: quoted-printable

Content-Disposition: inline

Re=

ceipt from : 13 July, 2023

New Roman", Times, serif; font-size: 15px;'>Hello there, root@nl2k.ab.=

ca

We are delighted that you have rene=

wed your PC Security yearly membership with =C3=B9s.

The services will be restored withi=

n 04 to 24 hours, and the plan will be in =C3=A8ffect until July 12=

, 2024.

New Roman", Times, serif; font-size: 16px;'>As authorized by you, we h=

ave debited your account with ($ 398.00) , this amount will be visible=

on the statement shortly.

New Roman", Times, serif; font-size: 16px;'>
184, 49, 47);">For assistance, reach out our support team at # =

+1 (833) 505-2616
gb(184, 49, 47);">(Toll-free)

New Roman", Times, serif; font-size: 16px;'>Order Renewal D=

etails: -

Customer ID- 794-0361-77365
Prod=

uct Name- Ge=C3=A9k-Squ=C3=A5d PC and Network Protection Shield
Ren=

ewal Date- July 13, 2023
Annual Charge- $ 398.00

Please be aware that because you ha=

ve chosen auto debit, your subscription will be =C3=A2utomatically ren=

ewed every year, and the same recurring amount will be paid.

However, if you don't wish to con=

tinue with our services or you would like drop all the charges and get=

the full =C3=A0mount refunded back, please contact us immediately.
iv>

47);">For Cancellation, Contact Support at # +1 (833=

) 505-2616

New Roman", Times, serif; font-size: 16px;'>

font-size: 15px;">
, serif;'>Sincerely,

pan style=3D'font-family: "Times New Roman", Times, serif;'>Nga Onl=

y
s, serif; font-size: 15px;'>

">Subscr=

iption Renewed Again#921045

--kbtD6oG4=_auS2heATOAcb8DNLkBb364gs--

Merchant phishing

Posted by Dave Yadallee on Thursday, July 13. 2023

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 12 Jul 2023 17:43:02 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96 (FreeBSD))

(envelope-from )

id 1qJjSx-000LyM-27

for dave@doctor.nl2k.ab.ca;

Wed, 12 Jul 2023 17:41:51 -0600

Resent-From: The Doctor

Resent-Date: Wed, 12 Jul 2023 17:41:51 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-yw1-f173.google.com ([209.85.128.173]:55659)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.96 (FreeBSD))

(envelope-from )

id 1qJgqR-000GBO-1R

for root@nl2k.ab.ca;

Wed, 12 Jul 2023 14:53:58 -0600

Received: by mail-yw1-f173.google.com with SMTP id 00721157ae682-57eb0df5265so10018097b3.3

for ; Wed, 12 Jul 2023 13:52:16 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20221208; t=1689195130; x=1691787130;

h=date:organization:mime-version:to:subject:from:message-id:from:to

:cc:subject:date:message-id:reply-to;

bh=KYa3bICtOR+hhrsAnarw/QcqzS6IzlMcRbvw1xhH83Q=;

b=hVU91Knyo8rJyI9aPxohrmqCTY9EK+ESLgKD/I84KUMMAMvqMdrCxUDEuboWideuPV

D47ot9fQvhKlzGXhUDU+pIdMdC3noAZVMpTJbyTNH3Lb5o2Qi/3cLHhYQnmYL0df9T9h

ylYlUzGfAofAIFGQPhB9PoG2pZn0bHGbyZ7s7mOa2f3pNXcfbkxhWwQKVWZzFWZiJ9VP

WG0gpME3ZA0bSgi2CDkeHLU+bATiFCFJFxyKGbLPP1Ys+cYV5VWc2KoF+pggYtVZcPL0

YQ/bH9CIQY+MM75wc2xJJGdbdbCOVQlAHhmZBBEGQ1yTyKPNs6lR+15DC694y6Es8Lpi

OQDw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20221208; t=1689195130; x=1691787130;

h=date:organization:mime-version:to:subject:from:message-id

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=KYa3bICtOR+hhrsAnarw/QcqzS6IzlMcRbvw1xhH83Q=;

b=AcpL1UVmT2JoUwCX10X2GWbKdOui6eYyf/0G8kr3/RFHzWL/oPphId2gKx65fTSEFP

OX4W43440x9DOoMlnSBGzplaxwCEKrUb1TsP76DFb+FCekqKLwgSHJ9qT1fOPpF+tBrq

OpBiL+6wI8vqpAatQsCnb6u6RLmJZhiF6284tM3zlL8ADVCUjuE7bZhpsA5Vy25q/JWs

LI81S/yJz9/xwbYCqvZsusjgdRfOJkmfgCt+1Cnr7St7TlHbZgrnqQEYFLNxx2W+7vCz

jDhUKTTuGZjpzORd04nDB1GSk0jz5146N4Vh/ZM4C6lev/KZSKdH64DS7B0Jdqcvg8Jr

Kjnw==

X-Gm-Message-State: ABy/qLbpIbW68S0QOLPPpgU8EoSnc7c0wJg1+2VBN3qzxMxa4HCmKzye

0YpzksFNl4AcmGzO8mho7TtfDp8G3n6fPXGtxNU=

X-Google-Smtp-Source: APBJJlHT5CvaLO/I5/gZPQlqNFIjJQbFDI0o/kHCbg7iXhR6SZq630Gk2TyGNx137ZcHHWYijyzlEg==

X-Received: by 2002:a81:4745:0:b0:577:d44:a163 with SMTP id u66-20020a814745000000b005770d44a163mr18830881ywa.6.1689195129740;

Wed, 12 Jul 2023 13:52:09 -0700 (PDT)

Received: from 185.203.218.20 ([185.203.218.20])

by smtp.gmail.com with ESMTPSA id r186-20020a0dcfc3000000b0057a165e6ee1sm1401292ywd.35.2023.07.12.13.52.08

for

(version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);

Wed, 12 Jul 2023 13:52:09 -0700 (PDT)

Message-ID: <64af1279.0d0a0220.4d3b.9ee3@mx.google.com>

From: "Altagracia J. Dicarlo"

Subject: Services Secure Again#690312

To: "root"

Content-Type: multipart/alternative; boundary="2PEaHRsoZjtCAQb=_rgAvG2U8f8lj8bgeu"

MIME-Version: 1.0

Organization: McAfee Billing Team

Date: Thu, 13 Jul 2023 02:22:08 +0530

X-Spam_score: 5.0

X-Spam_score_int: 50

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Hello there, root@nl2k.ab.ca Thank you again for subscribing

to us! We are glad to see you choosing MCAfee Total as your preferred Network

shield and PC Security service provider.

Content analysis details: (5.0 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.128.173 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

0.6 HK_RANDOM_ENVFROM Envelope sender username looks random

0.5 FROM_LOCAL_NOVOWEL From: localpart has series of non-vowel letters

1.0 HK_RANDOM_FROM From username looks random

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[tdtdgdvxvx643(at)gmail.com]

0.9 RCVD_NUMERIC_HELO Received: contains an IP address used for HELO

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[tdtdgdvxvx643(at)gmail.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.128.173 listed in wl.mailspike.net]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

-0.0 T_SCC_BODY_TEXT_LINE No description available.

2.0 FSL_HELO_BARE_IP_2 No description available.

Subject: {SPAM?} Services Secure Again#690312

This is a multi-part message in MIME format

--2PEaHRsoZjtCAQb=_rgAvG2U8f8lj8bgeu

Content-Type: text/plain; charset="utf-8"

Content-Transfer-Encoding: quoted-printable

Content-Disposition: inline

Hello there, root@nl2k.ab.ca

Thank you again for subscribing to us!

We are glad to see you choosing MCAfee Total as your preferred Network=

shield and PC Security service provider.

Your subscription plan was reactivated on July 11, 2023 (auto-renewal)=

, and it will remain active until July 10, 2023, unless you choose to =

cancel.

The annual total amount of $ 379.89 has been successfully processed fr=

om the updated payment method; this charge will reflect on the stateme=

nt shortly.

Order and Transaction Details:

Reference ID: 7734662938

Seller's name: MCAfee Total Corp.

Payment mode: Auto debit

Subscription fee: $ 379.89

As you opted for auto-debit, the recurring fee will be debited again n=

ext year on July 10, 2024, unless you choose to cancel the subscriptio=

n or stop auto-debit payments.

If you wish to opt out or drop all charges and want the full amount re=

funded back to the original payment source, please contact us at +1 (8=

88) 713-5736.

=20

With gratitude

Hope Capriati

McAfee Billing Team

Toll-free Number: +1 (888) 713-5736.

--2PEaHRsoZjtCAQb=_rgAvG2U8f8lj8bgeu

Content-Type: text/html; charset="utf-8"

Content-Transfer-Encoding: quoted-printable

Content-Disposition: inline

Hello the=

re, root@nl2k.ab.ca

le=3D"color: rgb(0, 0, 0);">Thank you again for subscribing to us!
an>

We are gl=

ad to see you choosing MCAfee Total as your preferred Network shield a=

nd PC Security service provider.

Your subs=

cription plan was reactivated on July 11, 2023 (auto-renewal), and it =

will remain active until July 10, 2023, unless you choose to cancel.
p>

The annua=

l total amount of $ 379.89 has been successfully processed from the up=

dated payment method; this charge will reflect on the statement shortl=

y.

tyle=3D"color: rgb(37, 37, 37);">=

Order and Transaction Details:

Reference=

ID: 3570115379
Seller's name:
pan style=3D"color: rgb(44, 130, 201);">MCAfee Total Corp.

tyle=3D"color: rgb(37, 37, 37);">Payment mode:
gb(44, 130, 201);">Auto debit

pan>Subscription fee: $ 379.=

89

As you op=

ted for auto-debit, the recurring fee will be debited again next year =

on July 10, 2024, unless you choose to cancel the subscription or stop=

auto-debit payments.

If you wi=

sh to opt out or drop all charges and want the full amount refunded ba=

ck to the original payment source, please contact us at
"color: rgb(44, 130, 201);">+1 (888) 713-5736.=

>

With appr=

eciation

Serena Vo=

llmer
McAfee Billing Team

e=3D"color: rgb(37, 37, 37);">Toll-free Number:
"color: rgb(44, 130, 201);">+1
rgb(37, 37, 37);"> (888=

) 713-5736.

--2PEaHRsoZjtCAQb=_rgAvG2U8f8lj8bgeu--

Mcafee phish from google