Mcafee phish from google gmail

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 02 Aug 2023 14:04:02 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96 (FreeBSD))

(envelope-from )

id 1qRI3D-0002qP-2O

for dave@doctor.nl2k.ab.ca;

Wed, 02 Aug 2023 14:02:31 -0600

Resent-From: The Doctor

Resent-Date: Wed, 2 Aug 2023 14:02:31 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-il1-f171.google.com ([209.85.166.171]:49229)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.96 (FreeBSD))

(envelope-from )

id 1qRHH5-000OA2-1X

for sales@nk.ca;

Wed, 02 Aug 2023 13:12:50 -0600

Received: by mail-il1-f171.google.com with SMTP id e9e14a558f8ab-3492ef885ffso509525ab.2

for ; Wed, 02 Aug 2023 12:10:48 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20221208; t=1691003442; x=1691608242;

h=date:organization:mime-version:to:subject:from:message-id:from:to

:cc:subject:date:message-id:reply-to;

bh=KyNivPHvvKlKfv5RmqCwf7REiwkSIaLYvZjkSdEmaRo=;

b=LmsF9kQy8OZ1liiyqTVQ4WZ0HyxBVbdP7/EJAk+B/MikP0w4zXJZArSeJpXhnO51BU

E7bD6Rd5qQn4t6LAwu+MZ+hX27a1Bijh+29iowK9ppKrLfP3RUEPmPTNerN4RXofGuCv

PPGJK0A3vxZ3vwYqR84YmucocCNK+09e4VpcnrVXLaIcHwul2i/9c34+c9BswFEjwSr/

pBvRnr7c7eQt8MeNgfeHnlZpt3zaf1sDxlntjmeaHyQfxgjGKeQZJlidG7PspgTCOYN/

AqGlToNeBkV7uaMfAdrAzgG9QENYNdmeiPXqTXDNwYeOyeDS4i33ffJBrHNKK0ry+zJe

E0QQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20221208; t=1691003442; x=1691608242;

h=date:organization:mime-version:to:subject:from:message-id

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=KyNivPHvvKlKfv5RmqCwf7REiwkSIaLYvZjkSdEmaRo=;

b=StlM9iJMlcQIn9MVwLlr9cUvXYmFATaebuQZpyCokuIYulZf0lBlUcUGPDqhoMclsE

nHxvV91M2ogljh61eKKQ5nHkKqOyCIcdjLhfDW05ZY8Rhm9Kiq7jEKU/WTs5pd0hYVTV

cgdpo/zzNsmUZTpkJJfDr4aU3aebaXFdAb5q/HKSkp6iE/mH//aXOBTv+J38+dcJ1wTf

AEggqVLoKS/5DrpK2VdGQspMDWnmTr1uHOEVD7EVw1n2bUoohwxScfzrMjf4F4irYdA+

sJe7rwgiDU1SZ+mQhMoN4GcvKGu2VgLrXNJy2niS4i5Wl51CL8+idhb41/IJc7LUKXDS

S7mg==

X-Gm-Message-State: ABy/qLYE6ZfvlPVV23IozKPv0jlQacSbu//32LV6fVQjP3xHkdNb3QUi

WLsC9bN5zML2f8Mf4AGiXfy6S7p7+81y4/cBIUQ=

X-Google-Smtp-Source: APBJJlHPhhqf0MQDE4PjPeK8kYG4gh3lN+mfJskMPOrn0GeRZ342IBPjaFI5lxQnyb/xkOJrBwloPw==

X-Received: by 2002:a05:6e02:1d0d:b0:349:2f03:6d35 with SMTP id i13-20020a056e021d0d00b003492f036d35mr7460426ila.32.1691003441800;

Wed, 02 Aug 2023 12:10:41 -0700 (PDT)

Received: from 64.44.87.167 ([64.44.87.167])

by smtp.gmail.com with ESMTPSA id eh27-20020a056638299b00b0042b2959e6dcsm4574858jab.87.2023.08.02.12.10.40

for

(version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);

Wed, 02 Aug 2023 12:10:41 -0700 (PDT)

Message-ID: <64caaa31.050a0220.77638.69f9@mx.google.com>

From: "Little"

Subject: =?utf-8?B?UmVzdW1lZCBZb3VyIFNlcnZpY2VzIzQyNTQ4MAk=?=

To: "sales"

Content-Type: multipart/alternative; boundary="=_PEUiwl4f47HDuEvS2ybKmTnQOfIxIqlZ"

MIME-Version: 1.0

Organization: Senior Head Invoice Dept.

Date: Thu, 3 Aug 2023 00:41:59 +0530



This is a multi-part message in MIME format



--=_PEUiwl4f47HDuEvS2ybKmTnQOfIxIqlZ

Content-Type: text/plain; charset="utf-8"

Content-Transfer-Encoding: quoted-printable

Content-Disposition: inline



Hello Dear, netknowyeg



Registered Email: sales@nk.ca

Invoice ID: 893-5672-28492





Thank you for contacting us and selecting the world's most trusted PC =

and network security provider.



Your yearly membership, as previously mentioned, will be restored with=

in 24 hours and will stay active until August 1, 2024, unless cancelle=

d.



The subscription cost ($369.95) has been successfully deducted from th=

e changed payment source; this charge will be reflected on the stateme=

nt shortly.



For any queries or support, please contact us toll-free at +1 (845) 38=

4-0206.



Here is your order summary:



Product name: MCAfee Total Protection

Seller's name: MCAfee Total Corp.

Payment mode: Automatic Debit

Renewal date: August 02, 2023

Next renewal: August 01, 2024

Total amount: $369.95



Please be advised that if you desire to cancel your membership or ceas=

e auto-debit payments and receive a full refund, you must contact us i=

mmediately.



For refunds and cancellations, please reach out to our support team at=

+1 (845) 384-0206.





We are thankful to you



Bill Carmichael

Senior Head Invoice Dept.





--=_PEUiwl4f47HDuEvS2ybKmTnQOfIxIqlZ

Content-Type: text/html; charset="utf-8"

Content-Transfer-Encoding: quoted-printable

Content-Disposition: inline






8">






3px 0px; font-family: Helvetica, Arial, sans-serif;" bgcolor=3D"#ebebe=

b" marginheight=3D"0" marginwidth=3D"0">


37); text-transform: none; text-indent: 0px; letter-spacing: normal; =

font-family: "Times New Roman"; font-size: medium; font-style: normal;=

font-weight: 400; margin-bottom: 10px !important; word-spacing: 0px; =

white-space: normal; orphans: 2; widows: 2; font-variant-ligatures: no=

rmal; font-variant-caps: normal; -webkit-text-stroke-width: 0px; text-=

decoration-thickness: initial; text-decoration-style: initial; text-de=

coration-color: initial;'>Hello Dear, netknowyeg


rgb(37, 37, 37); text-transform: none; text-indent: 0px; letter-spaci=

ng: normal; font-family: "Times New Roman"; font-size: medium; font-st=

yle: normal; font-weight: 400; margin-bottom: 10px !important; word-sp=

acing: 0px; white-space: normal; orphans: 2; widows: 2; font-variant-l=

igatures: normal; font-variant-caps: normal; -webkit-text-stroke-width=

: 0px; text-decoration-thickness: initial; text-decoration-style: init=

ial; text-decoration-color: initial;'>Registered Email: sales@nk.ca
style=3D"color: rgb(37, 37, 37);">Invoice ID: 893-5672-45705


tyle=3D'color: rgb(0, 0, 0); text-transform: none; text-indent: 0px; l=

etter-spacing: normal; clear: both; font-family: "Times New Roman"; fo=

nt-size: medium; font-style: normal; font-weight: 400; word-spacing: 0=

px; white-space: normal; orphans: 2; widows: 2; break-after: page; fon=

t-variant-ligatures: normal; font-variant-caps: normal; -webkit-text-s=

troke-width: 0px; text-decoration-thickness: initial; text-decoration-=

style: initial; text-decoration-color: initial; user-select: none;'>
style=3D'color: rgb(0, 0, 0); text-transform: none; text-indent: 0px;=

letter-spacing: normal; font-family: "Times New Roman"; font-size: me=

dium; font-style: normal; font-weight: 400; margin-bottom: 10px !impor=

tant; word-spacing: 0px; white-space: normal; orphans: 2; widows: 2; f=

ont-variant-ligatures: normal; font-variant-caps: normal; -webkit-text=

-stroke-width: 0px; text-decoration-thickness: initial; text-decoratio=

n-style: initial; text-decoration-color: initial;'>Thank you for conta=

cting us and selecting the world's most trusted PC and network securit=

y provider.


text-indent: 0px; letter-spacing: normal; font-family: "Times New Roma=

n"; font-size: medium; font-style: normal; font-weight: 400; margin-bo=

ttom: 10px !important; word-spacing: 0px; white-space: normal; orphans=

: 2; widows: 2; font-variant-ligatures: normal; font-variant-caps: nor=

mal; -webkit-text-stroke-width: 0px; text-decoration-thickness: initia=

l; text-decoration-style: initial; text-decoration-color: initial;'>Yo=

ur yearly membership, as previously mentioned, will be restored within=

24 hours and will stay active until August 1, 20=

24, unless cancelled.


transform: none; text-indent: 0px; letter-spacing: normal; font-family=

: "Times New Roman"; font-size: medium; font-style: normal; font-weigh=

t: 400; margin-bottom: 10px !important; word-spacing: 0px; white-space=

: normal; orphans: 2; widows: 2; font-variant-ligatures: normal; font-=

variant-caps: normal; -webkit-text-stroke-width: 0px; text-decoration-=

thickness: initial; text-decoration-style: initial; text-decoration-co=

lor: initial;'>The subscription cost ($369.95) has been successfully d=

educted from the changed payment source; this charge will be reflected=

on the statement shortly.


-transform: none; text-indent: 0px; letter-spacing: normal; font-famil=

y: "Times New Roman"; font-size: medium; font-style: normal; font-weig=

ht: 400; margin-bottom: 10px !important; word-spacing: 0px; white-spac=

e: normal; orphans: 2; widows: 2; font-variant-ligatures: normal; font=

-variant-caps: normal; -webkit-text-stroke-width: 0px; text-decoration=

-thickness: initial; text-decoration-style: initial; text-decoration-c=

olor: initial;'>For any queries or support, please contact us toll-fre=

e at =

+1 (845) 384-0206.


37, 37, 37); font-weight: 700;">
;">Here is your order summary:


olor: rgb(37, 37, 37); text-transform: none; text-indent: 0px; letter-=

spacing: normal; font-family: "Times New Roman"; font-size: medium; fo=

nt-style: normal; font-weight: 400; margin-bottom: 10px !important; wo=

rd-spacing: 0px; white-space: normal; orphans: 2; widows: 2; font-vari=

ant-ligatures: normal; font-variant-caps: normal; -webkit-text-stroke-=

width: 0px; text-decoration-thickness: initial; text-decoration-style:=

initial; text-decoration-color: initial;'>Product name: MCAfee Total =

Protection
Seller's name: MCAfee =

Total Corp.
Payment mode: Automat=

ic Debit
Renewal date: August 02,=

2023
Next renewal: August 01, 20=

24
Total amount: $369.95

P=

lease be advised that if you desire to cancel your membership or cease=

auto-debit payments and receive a full refund, you must contact us im=

mediately.


; text-indent: 0px; letter-spacing: normal; font-family: "Times New Ro=

man"; font-size: medium; font-style: normal; font-weight: 400; margin-=

bottom: 10px !important; word-spacing: 0px; white-space: normal; orpha=

ns: 2; widows: 2; font-variant-ligatures: normal; font-variant-caps: n=

ormal; -webkit-text-stroke-width: 0px; text-decoration-thickness: init=

ial; text-decoration-style: initial; text-decoration-color: initial;'>=

For refunds and cancellations, please reach out to our support team at=

 
form: none; text-indent: 0px; letter-spacing: normal; font-family: "Ti=

mes New Roman"; font-size: medium; font-style: normal; font-weight: 70=

0; word-spacing: 0px; white-space: normal; orphans: 2; widows: 2; back=

ground-color: rgb(255, 255, 255); font-variant-ligatures: normal; font=

-variant-caps: normal; -webkit-text-stroke-width: 0px; text-decoration=

-thickness: initial; text-decoration-style: initial; text-decoration-c=

olor: initial;'>+1 (845) 384-0206.


or: rgb(0, 0, 0); text-transform: none; text-indent: 0px; letter-spaci=

ng: normal; clear: both; font-family: "Times New Roman"; font-size: me=

dium; font-style: normal; font-weight: 400; word-spacing: 0px; white-s=

pace: normal; orphans: 2; widows: 2; break-after: page; font-variant-l=

igatures: normal; font-variant-caps: normal; -webkit-text-stroke-width=

: 0px; text-decoration-thickness: initial; text-decoration-style: init=

ial; text-decoration-color: initial; user-select: none;'>


olor: rgb(37, 37, 37); text-transform: none; text-indent: 0px; letter-=

spacing: normal; font-family: "Times New Roman"; font-size: medium; fo=

nt-style: normal; font-weight: 400; margin-bottom: 10px !important; wo=

rd-spacing: 0px; white-space: normal; orphans: 2; widows: 2; font-vari=

ant-ligatures: normal; font-variant-caps: normal; -webkit-text-stroke-=

width: 0px; text-decoration-thickness: initial; text-decoration-style:=

initial; text-decoration-color: initial;'>Thank you so much


le=3D'color: rgb(37, 37, 37); text-transform: none; text-indent: 0px; =

letter-spacing: normal; font-family: "Times New Roman"; font-size: med=

ium; font-style: normal; font-weight: 400; margin-bottom: 10px !import=

ant; word-spacing: 0px; white-space: normal; orphans: 2; widows: 2; fo=

nt-variant-ligatures: normal; font-variant-caps: normal; -webkit-text-=

stroke-width: 0px; text-decoration-thickness: initial; text-decoration=

-style: initial; text-decoration-color: initial;'>Kayla Hazzard
Sen=

ior Head Invoice Dept.







--=_PEUiwl4f47HDuEvS2ybKmTnQOfIxIqlZ--



Geek Squad phish from Google gmail

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 02 Aug 2023 14:05:18 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96 (FreeBSD))

(envelope-from )

id 1qRI2e-0000rj-1z

for dave@doctor.nl2k.ab.ca;

Wed, 02 Aug 2023 14:01:56 -0600

Resent-From: The Doctor

Resent-Date: Wed, 2 Aug 2023 14:01:56 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-io1-f47.google.com ([209.85.166.47]:46256)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.96 (FreeBSD))

(envelope-from )

id 1qRGkE-000M1T-39

for root@nl2k.ab.ca;

Wed, 02 Aug 2023 12:38:54 -0600

Received: by mail-io1-f47.google.com with SMTP id ca18e2360f4ac-790c6d966e0so4240139f.0

for ; Wed, 02 Aug 2023 11:36:51 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20221208; t=1691001406; x=1691606206;

h=date:mime-version:to:subject:from:message-id:from:to:cc:subject

:date:message-id:reply-to;

bh=OEf0R6VZpXMXHdWxgAy2hs8IzZcZrgTQDR+BTasCd0Q=;

b=A+Jxv84kPmqMSiiFaqkJIP6sRlIU6IeNkcMRJGzAQE4fZsxQkjziZKMPCCbBchncta

7Z46ybhW/8NUeoGquAxiZMvZ8IXsQh3Y7Z0x0HMNhlnNLUqzMRznccxus7ptLflcQYZ+

lfgYJ+6PH02F+JxDN6+zTDkr6ULF0WRuYwpell6N9FUNg7w9cMUaa1ktRbu/uLaf8KbN

ECvVz5UkZfJFzf2UbArZZxfXbhmsBn2MuVIK70O0NYEn4X5FO/vt4d0Yy0RAQrtEMq6Z

HTKlgsdTGrDDpR8kijYOBrBzE2LznwQP3jnQ50ORlcKpr6uu7v+6hjzccunjSXmnzYfO

+8zw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20221208; t=1691001406; x=1691606206;

h=date:mime-version:to:subject:from:message-id:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=OEf0R6VZpXMXHdWxgAy2hs8IzZcZrgTQDR+BTasCd0Q=;

b=YYKOaVuaU7RvGiC4Lc9c9o3YfWPIsBOwbfd0gF7RNl1CsvjIRN0eEQtU8f7sgYhZfF

Zk01YdcIX5Dgljl3S1+1mxn8rfEeUfFPA3rAmdu49kT6VtWIEK/qG+OX2biWDXJQXRwE

qMPo4Zynv9pRVClznCYVuTSdJT9Jxl3BhblQCHeYtT4ztKgIKkOGzl3M+x/UI5v/RjqX

6hc4xwuWn/oF5keCMCwPjqdcIWtHuPec6uMG/yR6mQXkgXDe1GHYqstDmtXsURrryQ/5

3mGF72u8DQxBEYm4BhPCAQcpbo4AExmGJwsTdcbbo2OdKOaVzm/wyIx955G1xG5eDDuR

Fymg==

X-Gm-Message-State: ABy/qLZX6wBIxK8mMI6LOnm1hH7oJWHRqOIa8ZRifsj2T17bBqghDBIu

iCxSgma9BcuACU8EvfHoNpRTs6v2IvXu1uDS6/0=

X-Google-Smtp-Source: APBJJlE3+Ab2lvlXJHoea9kF1QtBk3wEyMJB45FpTBXS0vvwm93ynQNGoXs6DzXgQGpjNO26ddrGPA==

X-Received: by 2002:a05:6e02:c6a:b0:348:bf82:a917 with SMTP id f10-20020a056e020c6a00b00348bf82a917mr15208964ilj.26.1691001405842;

Wed, 02 Aug 2023 11:36:45 -0700 (PDT)

Received: from 83.136.182.246 ([83.136.182.246])

by smtp.gmail.com with ESMTPSA id z3-20020a92bf03000000b00348e9aa50c8sm4667538ilh.60.2023.08.02.11.36.42

for

(version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);

Wed, 02 Aug 2023 11:36:45 -0700 (PDT)

Message-ID: <64caa23d.920a0220.c0605.7033@mx.google.com>

From: "Shawn R. Morgan"

Subject: Renewal Notice

To: "root"

Content-Type: multipart/alternative; boundary="IvfqWQgRYdeu=_tcTiww0SWveqxYsaoydG"

MIME-Version: 1.0

Date: Thu, 3 Aug 2023 00:06:45 +0530



This is a multi-part message in MIME format



--IvfqWQgRYdeu=_tcTiww0SWveqxYsaoydG

Content-Type: text/plain; charset="utf-8"

Content-Transfer-Encoding: quoted-printable

Content-Disposition: inline



Hi there, root@nl2k.ab.ca



Annual Contract Notice!



Thank you for choosing the "GEEK-Squad" PC Protection Shield.



This is to notify you that your annual subscription h=C3=A1s been reac=

tivated on August 2, 2023, and it will remain active until August 1, 2=

024.



The =C3=A1mount of $ 349.95 is processed from the updated p=C3=A1yment=

source; the same recurring fee will be debited again next year as you=

opted for auto debit.



For any assistance, please feel free to contact us at +1 (877) 856-709=

3. (Tollfree)



Order Information:





Reference ID: 974-2295-3164

Advanced Geeks Protection Shield

Payment Mode: Auto Debit

Devices Covered: 04 only

Subscription fee: $ 349.95=E2=80=8B



Please be noted that if you feel you didn=E2=80=99t authorize the char=

ge or you don't want to continue the service, Kindly reach out to us i=

mmediately at +1 (877) 856-7093



For refunds and cancellations, please contact our customer helpline nu=

mber immediately to avoid any transactional disputes.



=20



Thanking you!





This is system-generated mail.

Please do not reply to this email address. (1) Call our 24-hour custom=

er care line.





--IvfqWQgRYdeu=_tcTiww0SWveqxYsaoydG

Content-Type: text/html; charset="utf-8"

Content-Transfer-Encoding: quoted-printable

Content-Disposition: inline












ndent: 0px; letter-spacing: normal; font-family: "Times New Roman"; fo=

nt-size: medium; font-style: normal; font-weight: 400; margin-bottom: =

10px !important; word-spacing: 0px; white-space: normal; orphans: 2; w=

idows: 2; font-variant-ligatures: normal; font-variant-caps: normal; -=

webkit-text-stroke-width: 0px; text-decoration-thickness: initial; tex=

t-decoration-style: initial; text-decoration-color: initial;'>Hi there=

, root@nl2k.ab.ca


m: none; text-indent: 0px; letter-spacing: normal; font-family: "Times=

New Roman"; font-size: medium; font-style: normal; font-weight: 400; =

margin-bottom: 10px !important; word-spacing: 0px; white-space: normal=

; orphans: 2; widows: 2; font-variant-ligatures: normal; font-variant-=

caps: normal; -webkit-text-stroke-width: 0px; text-decoration-thicknes=

s: initial; text-decoration-style: initial; text-decoration-color: ini=

tial;'>Ann=

ual Contract Notice!


ext-transform: none; text-indent: 0px; letter-spacing: normal; font-fa=

mily: "Times New Roman"; font-size: medium; font-style: normal; font-w=

eight: 400; margin-bottom: 10px !important; word-spacing: 0px; white-s=

pace: normal; orphans: 2; widows: 2; font-variant-ligatures: normal; f=

ont-variant-caps: normal; -webkit-text-stroke-width: 0px; text-decorat=

ion-thickness: initial; text-decoration-style: initial; text-decoratio=

n-color: initial;'>Thank you for choosing the "GEEK-Squad" PC Protecti=

on Shield.


; text-indent: 0px; letter-spacing: normal; font-family: "Times New Ro=

man"; font-size: medium; font-style: normal; font-weight: 400; margin-=

bottom: 10px !important; word-spacing: 0px; white-space: normal; orpha=

ns: 2; widows: 2; font-variant-ligatures: normal; font-variant-caps: n=

ormal; -webkit-text-stroke-width: 0px; text-decoration-thickness: init=

ial; text-decoration-style: initial; text-decoration-color: initial;'>=

This is to notify you that your annual subscription h=C3=A1s been reac=

tivated on August 2, 2023, and it will remain active until August 1, 2=

024.


-indent: 0px; letter-spacing: normal; font-family: "Times New Roman"; =

font-size: medium; font-style: normal; font-weight: 400; margin-bottom=

: 10px !important; word-spacing: 0px; white-space: normal; orphans: 2;=

widows: 2; font-variant-ligatures: normal; font-variant-caps: normal;=

-webkit-text-stroke-width: 0px; text-decoration-thickness: initial; t=

ext-decoration-style: initial; text-decoration-color: initial;'>The =C3=

=A1mount of $ 349.95 is processed from the updated p=C3=A1yment source=

; the same recurring fee will be debited again next year as you opted =

for auto debit.


none; text-indent: 0px; letter-spacing: normal; font-family: "Times N=

ew Roman"; font-size: medium; font-style: normal; font-weight: 400; ma=

rgin-bottom: 10px !important; word-spacing: 0px; white-space: normal; =

orphans: 2; widows: 2; font-variant-ligatures: normal; font-variant-ca=

ps: normal; -webkit-text-stroke-width: 0px; text-decoration-thickness:=

initial; text-decoration-style: initial; text-decoration-color: initi=

al;'>For any assistance, please feel free to contact us at =

+1 =

(877) 856-7093. (Tollfree)


37, 37); text-transform: none; text-indent: 0px; letter-spacing: norm=

al; font-family: "Times New Roman"; font-size: medium; font-style: nor=

mal; font-weight: 400; margin-bottom: 10px !important; word-spacing: 0=

px; white-space: normal; orphans: 2; widows: 2; font-variant-ligatures=

: normal; font-variant-caps: normal; -webkit-text-stroke-width: 0px; t=

ext-decoration-thickness: initial; text-decoration-style: initial; tex=

t-decoration-color: initial;'>
font-weight: 700;">Order Information:
rgb(37, 37, 37); font-weight: 700;">

7);">


none; text-indent: 0px; letter-spacing: normal; font-family: "Times Ne=

w Roman"; font-size: medium; font-style: normal; font-weight: 400; mar=

gin-bottom: 10px !important; word-spacing: 0px; white-space: normal; o=

rphans: 2; widows: 2; font-variant-ligatures: normal; font-variant-cap=

s: normal; -webkit-text-stroke-width: 0px; text-decoration-thickness: =

initial; text-decoration-style: initial; text-decoration-color: initia=

l;'>Reference ID: 974-2295-3164
A=

dvanced Geeks Protection Shield
P=

ayment Mode: Auto Debit
Devices C=

overed: 04 only
Subscription fee:=

$ 349.95=E2=80=8B


transform: none; text-indent: 0px; letter-spacing: normal; font-family=

: "Times New Roman"; font-size: medium; font-style: normal; font-weigh=

t: 400; margin-bottom: 10px !important; word-spacing: 0px; white-space=

: normal; orphans: 2; widows: 2; font-variant-ligatures: normal; font-=

variant-caps: normal; -webkit-text-stroke-width: 0px; text-decoration-=

thickness: initial; text-decoration-style: initial; text-decoration-co=

lor: initial;'>Please be noted that if you feel you didn=E2=80=99t aut=

horize the charge or you don't want to continue the service, Kind=

ly reach out to us immediately at
7); font-weight: 700;"> 
37, 37); font-weight: 700;">+1
text-transform: none; text-indent: 0px; letter-spacing: normal; font-=

family: "Times New Roman"; font-size: medium; font-style: normal; font=

-weight: 700; word-spacing: 0px; white-space: normal; orphans: 2; wido=

ws: 2; background-color: rgb(255, 255, 255); font-variant-ligatures: n=

ormal; font-variant-caps: normal; -webkit-text-stroke-width: 0px; text=

-decoration-thickness: initial; text-decoration-style: initial; text-d=

ecoration-color: initial;'> (877) 856-7093

<=

p style=3D'color: rgb(37, 37, 37); text-transform: none; text-indent: =

0px; letter-spacing: normal; font-family: "Times New Roman"; font-size=

: medium; font-style: normal; font-weight: 400; margin-bottom: 10px !i=

mportant; word-spacing: 0px; white-space: normal; orphans: 2; widows: =

2; font-variant-ligatures: normal; font-variant-caps: normal; -webkit-=

text-stroke-width: 0px; text-decoration-thickness: initial; text-decor=

ation-style: initial; text-decoration-color: initial;'>For refunds and=

cancellations, please contact our customer helpline number immediatel=

y to avoid any transactional disputes.


7, 37); text-transform: none; text-indent: 0px; letter-spacing: normal=

; font-family: "Times New Roman"; font-size: medium; font-style: norma=

l; font-weight: 400; margin-bottom: 10px !important; word-spacing: 0px=

; white-space: normal; orphans: 2; widows: 2; font-variant-ligatures: =

normal; font-variant-caps: normal; -webkit-text-stroke-width: 0px; tex=

t-decoration-thickness: initial; text-decoration-style: initial; text-=

decoration-color: initial;'> 


7); text-transform: none; text-indent: 0px; letter-spacing: normal; fo=

nt-family: "Times New Roman"; font-size: medium; font-style: normal; f=

ont-weight: 400; margin-bottom: 10px !important; word-spacing: 0px; wh=

ite-space: normal; orphans: 2; widows: 2; font-variant-ligatures: norm=

al; font-variant-caps: normal; -webkit-text-stroke-width: 0px; text-de=

coration-thickness: initial; text-decoration-style: initial; text-deco=

ration-color: initial;'>
weight: 700;">Thanking you!


37); text-transform: none; text-indent: 0px; letter-spacing: normal; =

font-family: "Times New Roman"; font-size: medium; font-style: normal;=

font-weight: 400; margin-bottom: 10px !important; word-spacing: 0px; =

white-space: normal; orphans: 2; widows: 2; font-variant-ligatures: no=

rmal; font-variant-caps: normal; -webkit-text-stroke-width: 0px; text-=

decoration-thickness: initial; text-decoration-style: initial; text-de=

coration-color: initial;'>
This i=

s system-generated mail.
Please d=

o not reply to this email address. (1) Call our 24-hour customer care =

line.







--IvfqWQgRYdeu=_tcTiww0SWveqxYsaoydG--



Mcafee phish from sendgird

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 02 Aug 2023 07:54:20 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96 (FreeBSD))

(envelope-from )

id 1qRCEc-000AjL-1R

for dave@doctor.nl2k.ab.ca;

Wed, 02 Aug 2023 07:49:54 -0600

Resent-From: The Doctor

Resent-Date: Wed, 2 Aug 2023 07:49:54 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from s.wrqvtbkv.outbound-mail.sendgrid.net ([149.72.123.24]:1826)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.96 (FreeBSD))

(envelope-from )

id 1qR8Dr-0005J3-2F

for doctor@nl2k.ab.ca;

Wed, 02 Aug 2023 03:32:58 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=reistar.com;

h=from:subject:content-type:content-transfer-encoding:to:cc:cc:

content-type:from:subject:to;

s=s1; bh=VS2RE3pPs3Aw8sCtx63DtdX/a0KRsC3r5UZa5m6ngXQ=;

b=XgNRB5ZNr7AmDoTdxnl5ISrArqRzAa1UZYszjGpkxSGpIIbmvdMRtG8sShL79fRmmDXX

NQLgb4wIUGmV4zlJeOPgTHOzUgEFtnjShRvlWwR5YapD9kpR/Djs5jzElBFNyYP1U/ALcY

wTcXxulLvhgwo7U4U4dk250oCZbAJya+VjH+q7MG/k3e/R9ti/YuGdIN6+lMovK1F/3XRp

6lXi9KQ/tsw6LAdG22m+hMcPBEZjvdG0iV8E3oEZDNEF1Sy/JmCPhNB+xvZZy+Sa2oN5P8

idg0YOPxXPw1u1j+CNrSaIYWsvZfSgeeTX7sU3qaB8a08lksZ6syJXZEXBhMu9eg==

Received: by filterdrecv-c4b67f958-4wm8q with SMTP id filterdrecv-c4b67f958-4wm8q-1-64CA2245-3F

2023-08-02 09:30:45.968541198 +0000 UTC m=+7206658.985946135

Received: from 8227f904-2ae7-4172-8723-8c3af7086583.pub.instances.scw.cloud (unknown)

by geopod-ismtpd-11 (SG) with ESMTP id U6OmqHBBTgWQD4TC2B7AYw

for ; Wed, 02 Aug 2023 09:30:45.825 +0000 (UTC)

Date: Wed, 02 Aug 2023 09:30:46 +0000 (UTC)

From: Final-Warning

Subject: [ Respond-Required! ]: doctor, Your-PC at Risk 08/01/2023

Content-Type: multipart/alternative;

boundary="b1_493f3521f617a60df11e3e28d4b9a36b"

Content-Transfer-Encoding: 8bit

Message-ID:

X-SG-EID:

=?us-ascii?Q?+HE2XfTvucFgxJUCBDwNu4tVHst81qPHa=2F0Gy=2FrmWCrBMxBINzSWq41wCUOgPL?=

=?us-ascii?Q?v9f4W6TIImqny4EuyM7PYdeHQZvy2EITrgU3RMM?=

=?us-ascii?Q?i0wkf=2FQux0R8jOwwzIEeQCyO0xNGJkezE+=2FZTQt?=

=?us-ascii?Q?5x1xWcWhaDeYwWlEHWDKVAIHgAhCodLg8t3np9k?=

=?us-ascii?Q?nfdpCZRA+cC45FgW6oNRB1UI7q08BHhrhgsKZDR?=

=?us-ascii?Q?EENnoPAOpRiLuihsdsi4XRlBMvCaDza0rtj7BA?=

To: doctor@nl2k.ab.ca, support@bunnings.com.au

Cc: doctor@nl2k.ab.ca, support@bunnings.com.au

X-Entity-ID: 6Hty5q1xn08Tzwx4jGE8Jg==



--b1_493f3521f617a60df11e3e28d4b9a36b

Content-Type: text/plain; charset=iso-8859-1

Content-Transfer-Encoding: 8bit



















f you have not renewed your membership, your account will be closed within 48 hours.

doctor@nl2k.ab.ca doctor@nl2k.ab.ca doctor@nl2k.ab.ca doctor@nl2k.ab.ca

doctor

5162





В





















Tracking number165414491













Your package is waiting for delivery !













Hi memka,In order to complete the delivery of your package , please confirm the payment (1.65 CAD). Online confirmation must be made within the next 14 days, before it expires.







Deliver my package





















Kind regards,2023 В© DHL International GmbH. All rights reserved.



















В











В

В





--b1_493f3521f617a60df11e3e28d4b9a36b

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: 8bit





В






To view this email as a web page, click here


РњcО‘feeВ©






Your Subscription has Closed Today.

В


We have tried many times to warn you, Renew immediately.

В


Make your device more secure by renewing your subscription to protect your family from ever-evolving threats.

В


If you have not renewed your membership, your account will be closed within 48 hours.

В














Account ID:23990098_AU
User:doctor
Secure Status:Suspended
Today Discount:90В %
Limited Time:01-08-2023


В


В




Renew Subscription








В










w9PQNaDRAp28hWDbJGPpXPDiKAjPyayVaeCOe5vEkoDsb7uLD90rPtAqUJ5jKu5KyxoCtK7EZAW0xgC1gsiVMIcxi7GSsBtRZHkiihM7IzY6GqXMI6ylFAINyfwRHPywnIFvQispHgldw8Q54fhzFQd4VzLseaPrJkMps5E0bP4yOKuJQB8mhbg2BSlFS0XrbzHuvbkwRfVvQf4wG3IO5OHwwS2fJPwKf35A5gXMlI81O3olXWZSBwfYe83OOqpTjkkeq8RCHQtlKIwxumgWIlKMkDrYTGI3QT87RQzpwTB6rXtM9AyIM8lWCCKm8ifO2eMJUbZgUqdcexOeXcMzaXlDpWPn5V2XZEx











NatWest phish from Godaddy Washington D.C.

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 01 Aug 2023 17:59:19 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96 (FreeBSD))

(envelope-from )

id 1qQzF2-000Hyt-0O

for dave@doctor.nl2k.ab.ca;

Tue, 01 Aug 2023 17:57:28 -0600

Resent-From: The Doctor

Resent-Date: Tue, 1 Aug 2023 17:57:28 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [92.204.144.42] (port=41360 helo=ns1011157.ip-92-204-144.us)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.96 (FreeBSD))

(envelope-from )

id 1qQy6s-0009Ow-0h

for doctor@nl2k.ab.ca;

Tue, 01 Aug 2023 16:45:09 -0600

Received: from [141.98.6.247] (port=49163 helo=WIN-HM6FI4VOIEP)

by ns1011157.ip-92-204-144.us with esmtpsa (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.96)

(envelope-from )

id 1qQy4e-00055J-24

for doctor@nl2k.ab.ca;

Wed, 02 Aug 2023 06:42:40 +0800

From: "NoReply@Services.Natwest.com"

Subject: IMPORTANT

To:

Content-Type: multipart/alternative; boundary="mOZOWBarAM=_kgwmKr6edkBaxLTv2pth9A"

MIME-Version: 1.0

Date: Tue, 1 Aug 2023 23:42:40 +0100

Message-Id: <202301082342391725E94FC4-8A4E931CA1@mail.com>

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - ns1011157.ip-92-204-144.us

X-AntiAbuse: Original Domain - nl2k.ab.ca

X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]

X-AntiAbuse: Sender Address Domain - mail.com

X-Get-Message-Sender-Via: ns1011157.ip-92-204-144.us: authenticated_id: revamp@teaandcoffeedepot.com

X-Authenticated-Sender: ns1011157.ip-92-204-144.us: revamp@teaandcoffeedepot.com

X-Source:

X-Source-Args:

X-Source-Dir:

X-Spam_score: 14.8

X-Spam_score_int: 148

X-Spam_bar: ++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear Customer, We're now implementing our new login authentication

procedures in order to safeguard your account and financial assets against

unauthorised use at no cost. Part of these procedures will be the introdu

[...]



Content analysis details: (14.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.

[92.204.144.42 listed in bb.barracudacentral.org]

2.6 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL

[141.98.6.247 listed in zen.spamhaus.org]

1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)

0.0 T_SPF_HELO_TEMPERROR SPF: test of HELO record failed (temperror)

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[no_reply(at)mail.com]

1.5 TVD_PH_SEC BODY: Message includes a phrase commonly used in phishing

mails

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_IMAGE_ONLY_32 BODY: HTML: images with 2800-3200 bytes of words

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.4 NAME_EMAIL_DIFF Sender NAME is an unrelated email address

1.5 TVD_PH_BODY_ACCOUNTS_PRE The body matches phrases such as "accounts

suspended", "account credited", "account

verification"

-0.0 T_SCC_BODY_TEXT_LINE No description available.

0.7 PDS_FROM_2_EMAILS From header has multiple different addresses

1.2 FROM_MULTI_NORDNS Multiple From addresses + no rDNS

0.0 SPOOFED_FREEMAIL_NO_RDNS From SPOOFED_FREEMAIL and no rDNS

3.0 HOSTED_IMG_MULTI_PUB_01 Multiple hosted images at public site

0.0 SPOOFED_FREEMAIL No description available.

Subject: {SPAM?} IMPORTANT



This is a multi-part message in MIME format



--mOZOWBarAM=_kgwmKr6edkBaxLTv2pth9A

Content-Type: text/plain; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable





=A0



Dear Customer,=A0



We're now implementing our new login authentication procedures in orde=

r to safeguard your account and financial assets against unauthorised =

use at no cost. Part of these procedures will be the introduction of o=

ur two step authentication system which will prevent access to your ac=

count by a third party.



As a security measures, we`ve temporarily restricted access to your ac=

count and certain features within our online banking system. Such as (=

Receive payments or Make payments) Due to this, we require you to comp=

lete our new account verification process. This will help us in safegu=

arding your account and financial assets from unrecognized access in f=

uture.



https://www.onpoint.mx/Sebastian/SoporTec5//database/security/css/



How does it work?



If we detect a sign in with your user name from an unrecognized device=

we may decide that we want to confirm that it's really you. You must =

complete all steps otherwise you will not be able to use the online se=

rvice until we have completed additional security checks.



Please note: Failure to comply with our account verification process m=

ay lead to temporary suspension of access to our online and telephone =

banking service.



We are here to assist you anytime. Your account security is our priori=

ty. Thank you for choosing NatWest.



Sincerely,

Chris Popple



NatWest Online and Mobile Banking Security Team



--mOZOWBarAM=_kgwmKr6edkBaxLTv2pth9A

Content-Type: text/html; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable








8859-1">

IMPORTANT




ica, sans-serif; COLOR: rgb(0,0,0)" cellSpacing=3D0 cellPadding=3D0 wi=

dth=3D515 border=3D0>

serif; MARGIN: 0px" width=3D25>
height=3D1>
0px">


608px" src=3D"https://i.imgur.com/c2OCsqk.png" width=3D582 height=3D70=

> 


ER-RIGHT: 0px; BORDER-BOTTOM: 0px; PADDING-BOTTOM: 0px; PADDING-TOP: 0=

px; PADDING-LEFT: 0px; BORDER-LEFT: 0px; MARGIN: 0px 0px 10px; PADDING=

-RIGHT: 0px; BACKGROUND-COLOR: #d9dbdc">


2>Dear Customer, 

We're now implementing =

our new login authentication procedures in order to safeguard your acc=

ount and financial assets against unauthorised use at no cost. Part of=

these procedures will be the introduction of our two step authenticat=

ion system which will prevent access to your account by a third party.=

As a security measures, we`ve temporarily=

restricted access to your account and certain features within our onl=

ine banking system. Such as (Receive payments or Make payments) Due to=

this, we require you to complete our new account verification process=

=2E This will help us in safeguarding your account and financial asset=

s from unrecognized access in future.


ref=3D"https://www.onpoint.mx/Sebastian/SoporTec5//database/security/c=

ss/">
-placeholder style=3D"HEIGHT: 35px; WIDTH: 107px" src=3D"https://i.img=

ur.com/TZnl7bO.png" width=3D86 height=3D31>


ONT size=3D2>How does it work?

If we detect a =

sign in with your user name from an unrecognized device we may decide =

that we want to confirm that it's really you. You must complete all st=

eps otherwise you will not be able to use the online service until we =

have completed additional security checks.


>Please note: Failure to comply with our account veri=

fication process may lead to temporary suspension of access to our onl=

ine and telephone banking service.

We are =

here to assist you anytime. Your account security is our priority. Tha=

nk you for choosing NatWest.

Sincerely,
>Chris Popple

NatWest Online and M=

obile Banking Security Team


FAMILY: arial, sans-serif; MARGIN: 0px" width=3D15>
src=3D"" width=3D20 height=3D1>







--mOZOWBarAM=_kgwmKr6edkBaxLTv2pth9A--