Phish | Entries from Friday, August 18. 2023

CRA Phish from Buffalo , New York

Mcafee phish from google gmail

Posted by Dave Yadallee on Friday, August 18. 2023

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 18 Aug 2023 14:27:01 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96 (FreeBSD))

(envelope-from )

id 1qX60p-000D9f-2n

for dave@doctor.nl2k.ab.ca;

Fri, 18 Aug 2023 14:24:03 -0600

Resent-From: The Doctor

Resent-Date: Fri, 18 Aug 2023 14:24:03 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [191.101.33.177] (port=40052 helo=opencdnv6.syscdn.zjsxlt.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.96 (FreeBSD))

(envelope-from )

id 1qX3Mi-000IDS-1f

for root@nk.ca;

Fri, 18 Aug 2023 11:34:40 -0600

X-Device-Accept : 3366

To: root@nk.ca

From: "Canada Revenue Agency (CRA)"

Reply-To: master@zixun.jia.com

Subject: Good news, we've approved your refund request 177

Message-ID: <60ac1fc46c6683836a9e9acbfc6f3b6f@zixun.jia.com>

X-Mailer: DKIMValidator 12.7.5 (https://github.com/PHPMailer/DKIMValidator)

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="1cb3e47ba267a7fcd8f13f7768cd38d85"

Content-Transfer-Encoding: 8bit

Date: Fri, 18 Aug 2023 19:32:25 +0200 (CEST)

This is a multi-part message in MIME format.

--1cb3e47ba267a7fcd8f13f7768cd38d85

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit

You have trouble to see this ?Â View as web page

Â

Â

We confirm that your request has been processed successfully.

Â

Please view your document securely

Consulter

This is a secure, encrypted message : 05092016

--1cb3e47ba267a7fcd8f13f7768cd38d85

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: quoted-printable

Helvetica, sans-serif; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFO=

RM: none; FONT-WEIGHT: 400; COLOR: rgb(0,0,0); FONT-STYLE: normal; TEXT-ALI=

GN: center; ORPHANS: 2; WIDOWS: 2; LETTER-SPACING: normal; TEXT-INDENT: 0px=

; font-variant-ligatures: normal; font-variant-caps: normal; -webkit-text-s=

troke-width: 0px; text-decoration-thickness: initial; text-decoration-style=

: initial; text-decoration-color: initial'>
ace=3DModern>
, Calibri, Candara, Arial, sans-serif; WHITE-SPACE: normal; WORD-SPACING: 0=

px; TEXT-TRANSFORM: none; FLOAT: none; FONT-WEIGHT: 400; COLOR: rgb(51,51,5=

1); FONT-STYLE: normal; TEXT-ALIGN: left; ORPHANS: 2; WIDOWS: 2; DISPLAY: i=

nline !important; LETTER-SPACING: normal; BACKGROUND-COLOR: rgb(245,245,245=

); TEXT-INDENT: 0px; font-variant-ligatures: normal; font-variant-caps: nor=

mal; -webkit-text-stroke-width: 0px; text-decoration-thickness: initial; te=

xt-decoration-style: initial; text-decoration-color: initial'>
=3D"FONT-SIZE: 12px; FONT-FAMILY: Helvetica, Arial, sans-serif; WHITE-SPACE=

: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; FLOAT: none; FONT-WEIGHT=

: 400; COLOR: rgb(0,0,0); FONT-STYLE: normal; ORPHANS: 2; WIDOWS: 2; DISPLA=

Y: inline !important; LETTER-SPACING: normal; TEXT-INDENT: 0px; font-varian=

t-ligatures: normal; font-variant-caps: normal; -webkit-text-stroke-width: =

0px; text-decoration-thickness: initial; text-decoration-style: initial; te=

xt-decoration-color: initial">
"Source Sans Pro", Calibri, Candara, Arial, sans-serif; WHITE-SPACE: normal=

; WORD-SPACING: 0px; TEXT-TRANSFORM: none; FLOAT: none; FONT-WEIGHT: 400; C=

OLOR: rgb(51,51,51); FONT-STYLE: normal; TEXT-ALIGN: left; ORPHANS: 2; WIDO=

WS: 2; DISPLAY: inline !important; LETTER-SPACING: normal; BACKGROUND-COLOR=

: rgb(245,245,245); TEXT-INDENT: 0px; font-variant-ligatures: normal; font-=

variant-caps: normal; -webkit-text-stroke-width: 0px; text-decoration-thick=

ness: initial; text-decoration-style: initial; text-decoration-color: initi=

al'>
if; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; FLOAT: no=

ne; FONT-WEIGHT: 400; COLOR: rgb(0,0,0); FONT-STYLE: normal; ORPHANS: 2; WI=

DOWS: 2; DISPLAY: inline !important; LETTER-SPACING: normal; TEXT-INDENT: 0=

px; font-variant-ligatures: normal; font-variant-caps: normal; -webkit-text=

-stroke-width: 0px; text-decoration-thickness: initial; text-decoration-sty=

le: initial; text-decoration-color: initial">You have trouble to see this ?=

=C2=A0
ca, arial, sans-serif; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFO=

RM: none; FONT-WEIGHT: 400; FONT-STYLE: normal; ORPHANS: 2; WIDOWS: 2; LETT=

ER-SPACING: normal; LINE-HEIGHT: 20px; TEXT-INDENT: 0px; font-variant-ligat=

ures: normal; font-variant-caps: normal; -webkit-text-stroke-width: 0px" hr=

ef=3D"https://courrielweb.videotron.com/" rel=3D"noopener noreferrer" targe=

t=3D_blank>View as web page

de", Verdana, Arial, Helvetica, sans-serif; WHITE-SPACE: normal; WORD-SPACI=

NG: 0px; TABLE-LAYOUT: fixed; TEXT-TRANSFORM: none; FONT-WEIGHT: 400; COLOR=

: rgb(0,0,0); FONT-STYLE: normal; TEXT-ALIGN: left; ORPHANS: 2; WIDOWS: 2; =

LETTER-SPACING: normal; font-variant-ligatures: normal; font-variant-caps: =

normal; -webkit-text-stroke-width: 0px; text-decoration-thickness: initial;=

text-decoration-style: initial; text-decoration-color: initial' cellSpacin=

g=3D0 cellPadding=3D0 width=3D"100%" border=3D0>

BLE>

NE-HEIGHT: 22px; PADDING-RIGHT: 0px" height=3D"100%" vAlign=3Dtop>

DDING-TOP: 0px">
helvetica, sans-serif; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSF=

ORM: none; FLOAT: none; FONT-WEIGHT: 400; COLOR: rgb(57,61,71); FONT-STYLE:=

normal; TEXT-ALIGN: left; ORPHANS: 2; WIDOWS: 2; DISPLAY: inline; LETTER-S=

PACING: normal; BACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT: 0px; font-=

variant-ligatures: normal; font-variant-caps: normal; -webkit-text-stroke-w=

idth: 0px; text-decoration-thickness: initial; text-decoration-style: initi=

al; text-decoration-color: initial'>
odern>We confirm that your request has been processed successfully.<=

/SPAN>

=3DModern>=C2=A0

-FAMILY: arial, helvetica, sans-serif">Please =

view your document securely

ING-LEFT: 0px; PADDING-RIGHT: 0px" align=3Dcenter>

0 cellPadding=3D0 border=3D0>

r=3D#257bdb>
rgb(51,51,51) 1px solid; BORDER-RIGHT: rgb(51,51,51) 1px solid; BORDER-BOT=

TOM: rgb(51,51,51) 1px solid; FONT-WEIGHT: normal; COLOR: rgb(255,255,255);=

PADDING-BOTTOM: 12px; TEXT-ALIGN: center; PADDING-TOP: 12px; PADDING-LEFT:=

18px; BORDER-LEFT: rgb(51,51,51) 1px solid; DISPLAY: inline-block; LETTER-=

SPACING: 0px; LINE-HEIGHT: normal; PADDING-RIGHT: 18px; BACKGROUND-COLOR: r=

gb(37,123,219); border-radius: 6px" href=3D"https://rebrand.ly/sphq3po" rel=

=3Dnoreferrer target=3D_blank>Consulter=

NE-HEIGHT: 22px; PADDING-RIGHT: 0px" height=3D"100%" vAlign=3Dtop>

=3D'FONT-SIZE: 12px; FONT-FAMILY: "Helvetica Neue", Helvetica, Arial, sans-=

serif; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; FLOAT:=

none; FONT-WEIGHT: 400; COLOR: rgb(51,51,51); FONT-STYLE: normal; ORPHANS:=

2; WIDOWS: 2; DISPLAY: inline !important; LETTER-SPACING: normal; TEXT-IND=

ENT: 0px; font-variant-ligatures: normal; font-variant-caps: normal; -webki=

t-text-stroke-width: 0px; text-decoration-thickness: initial; text-decorati=

on-style: initial; text-decoration-color: initial'>This is a secure, encryp=

ted message : 05092016

--1cb3e47ba267a7fcd8f13f7768cd38d85--

August '23

Posted by Dave Yadallee on Friday, August 18. 2023

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 17 Aug 2023 18:05:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96 (FreeBSD))

(envelope-from )

id 1qWmyx-000DJa-0g

for dave@doctor.nl2k.ab.ca;

Thu, 17 Aug 2023 18:04:51 -0600

Resent-From: The Doctor

Resent-Date: Thu, 17 Aug 2023 18:04:51 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-qt1-f175.google.com ([209.85.160.175]:39100)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.96 (FreeBSD))

(envelope-from )

id 1qWkPy-0009rY-07

for doctor@nk.ca;

Thu, 17 Aug 2023 15:20:37 -0600

Received: by mail-qt1-f175.google.com with SMTP id d75a77b69052e-4106eb061b9so570131cf.0

for ; Thu, 17 Aug 2023 14:18:35 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20221208; t=1692307109; x=1692911909;

h=date:mime-version:to:subject:from:message-id:from:to:cc:subject

:date:message-id:reply-to;

bh=laqHPhYijdKJtq3wxt0TJ+p5s9OM0VQnioUxWPoe7/0=;

b=p7gVrA5oMMCUJ5hGOJhYzSiMuPtkOc5H+PaBvER2v5l9P/T4rwyP2nSe0VOj5MaLXB

b9/TwvlTIxjZE7CEoYpkgRrhzU3kQAGPsrgIPV19/fKKHEYmlE8ZsyROPr435rmQfFtE

JGeP9E0vKnrvUrJASgTVavoc8l2ypWl8QISTyWKoWz0nqKWM5zQf/qKsFky1PAXTYiGL

Dix5kUcf2qgk99AvuA8PuZX4BlgMqxuUTy413QoRlRop0yASaSEK2QGodsBm6Rj7k/ET

/vCG9twqNmfOqqxRMUx7nAsh3HIBJXtHFa+ZzvRdW/JnEn0aAJxYdu0aFob8Eo2jthus

epLw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20221208; t=1692307109; x=1692911909;

h=date:mime-version:to:subject:from:message-id:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=laqHPhYijdKJtq3wxt0TJ+p5s9OM0VQnioUxWPoe7/0=;

b=OK0UY31g6wmulzY+WYaytLjp/bTbpxltIjWmR5RKr4fd4Skbw4EQssdkS6euqA+Pfl

+zgGTV2pLKNKZqnBBtlDwxAjnOQk13DGBePe9oXtkbxUzAOTQSnHo8qUlfelRQGaBLpK

ohDnGrYl2oecdEN/bqX1/t8K2kKcULJTrJ7z5lAWmmra/IAqvGy7vPjcN0yv06BZ9Qe8

69mRRxYmgZaTcV4fyfSnlTNvgFJAQqUQeg89xx3Sg9HHYw/P7xzvG1xnP4KZKNFSSmuD

ib9GjupAihpsvnwtv4i/d2lrTIeo+bl4BwC5UIu0wx8K2h8rXnJ1cnrnet9alPvd/vlI

tR2w==

X-Gm-Message-State: AOJu0YyDjMWcv1IzZX6J4bAxFpsxhmc/TOHTuTLyF8sR9KoJbWVCRbHQ

Ui5UEurWm9RgHjGtMVkq+XFZcgzH9yGmtGP4ssA=

X-Google-Smtp-Source: AGHT+IExDsdBDxQQIP/NjI04Pnm63ancq/NxrTVY99DBoaGo4mnLDVFFWiIEjH9ymT049sMLUgZ1Cg==

X-Received: by 2002:a05:6214:621:b0:63d:2d7e:39f1 with SMTP id a1-20020a056214062100b0063d2d7e39f1mr904628qvx.2.1692307109035;

Thu, 17 Aug 2023 14:18:29 -0700 (PDT)

Received: from 86.48.15.158 ([86.48.15.158])

by smtp.gmail.com with ESMTPSA id p16-20020a0cf550000000b0063d152e5d9asm149350qvm.120.2023.08.17.14.18.27

for

(version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);

Thu, 17 Aug 2023 14:18:28 -0700 (PDT)

Message-ID: <64de8ea4.0c0a0220.5f1c0.13f5@mx.google.com>

From: "Joe F. Kelley"

Subject: Smooth Transition: Your Plan Has Been Automatically Renewed

To: "doctor"

Content-Type: multipart/alternative; boundary="RUY2d4EW4SHUwjnZHhk8jyV=_LDs7K1C1m"

MIME-Version: 1.0

Date: Fri, 18 Aug 2023 02:48:27 +0530

This is a multi-part message in MIME format

--RUY2d4EW4SHUwjnZHhk8jyV=_LDs7K1C1m

Content-Type: text/plain; charset="utf-8"

Content-Transfer-Encoding: quoted-printable

Content-Disposition: inline

Dear client , doctor@nk.ca

Annual Contract Renewal Notice!

Thank you for choosing the "MCAfee-Total" PC Protection Shield.

This is to inform you that, as of August 17, 2023, your yearly subscri=

ption has been revived and will be valid through August 16, 2024.

Since you selected auto debit, the sum of ($349.99) is processed from =

the updated payment source; the same recurring cost will be deducted o=

nce again the following year.

For immediate queries - Contact Helpdesk +1 (818) 214-4094. (Toll-Fre=

e)

Order Information :

Reference ID : 974-2295-3164

Advanced PC Protection Shield

Payment Mode : Auto Debit

Devices Covered : 04 only

Subscription fee : $ 349.99

Please be noted that if you feel you didn=E2=80=99t authorize the char=

ge or you don't want to continue the service, Kindly reach out to us i=

mmediately at +1 (818) 214-4094.

For refunds and cancellations, please contact our customer helpline nu=

mber immediately to avoid any transactional disputes.

=20

With sincere thanks!

Joe F. Kelley=20

Accounts Team (Manager)

This is system-generated email. Please do not reply to this email addr=

ess. (1) Call our 24-hour customer care line.

--RUY2d4EW4SHUwjnZHhk8jyV=_LDs7K1C1m

Content-Type: text/html; charset="utf-8"

Content-Transfer-Encoding: quoted-printable

Content-Disposition: inline

Hi Dear, doctor@nk.ca

7, 37, 37);">Annual Contract Renewal Notice!

Thank you for choosing the "M=

CAfee-Total" PC Protection Shield.

This is to inform you that, as of August 17, 2023, your =

yearly subscription has been revived and will be valid through Augu=

st 16, 2024.

Since you selected auto debit, the sum of ($349.99) is processe=

d from the updated payment source; the same recurring cost will be ded=

ucted once again the following year.

To cancel, modify or reorder =

please feel free to contact us toll-free +1 (818) 214-4094
trong>. (Toll-=

Free)

7, 37, 37);">Order Information :
: rgb(37, 37, 37);">

>

Reference ID : 974-2295-3164<=

br style=3D"color: rgb(37, 37, 37);">Advanced PC Protection Shield

style=3D"color: rgb(37, 37, 37);">Payment Mode : Auto Debit

"color: rgb(37, 37, 37);">Devices Covered : 04 only

rgb(37, 37, 37);">Subscription fee : $ 349.99

Please be noted that if you f=

eel you didn=E2=80=99t authorize the charge or you don't want to conti=

nue the service, Kindly reach out to us immediately at
le=3D"color: rgb(37, 37, 37);"> +1 (818) 214-409=

4.

For refunds and cancellations=

, please contact our customer helpline number immediately to avoid any=

transactional disputes.

Best regards!

Joe F. Kelley
The Bi=

lling Team

7, 37);">T=

his is system-generated email. Please do not reply to this email addre=

ss. (1) Call our 24-hour customer care line.

--RUY2d4EW4SHUwjnZHhk8jyV=_LDs7K1C1m--

Categories: Google Spam, Phish

0 Comments

Page 1 of 1, totaling 2 entries