Yet Another Geek Squad phish from gmail

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 25 Apr 2023 08:52:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1prK07-000N5M-SQ

for dave@doctor.nl2k.ab.ca;

Tue, 25 Apr 2023 08:50:39 -0600

Resent-From: The Doctor

Resent-Date: Tue, 25 Apr 2023 08:50:39 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pf1-f174.google.com ([209.85.210.174]:60627)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1prJXg-000AGg-My

for doctor@nl2k.ca;

Tue, 25 Apr 2023 08:21:22 -0600

Received: by mail-pf1-f174.google.com with SMTP id d2e1a72fcca58-63b87d23729so4705861b3a.0

for ; Tue, 25 Apr 2023 07:19:18 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20221208; t=1682432352; x=1685024352;

h=date:mime-version:to:subject:from:message-id:from:to:cc:subject

:date:message-id:reply-to;

bh=HRA5u/rmixSC/CrrUIeVkmq7iYbP0HZbuluh0gzvOVU=;

b=U6FpvDhoBdytshP1bgOLYza8yDGtvtszhabGW0rTKklHqtZMtsGdCnLvZsWxXomQBk

sowmQaRZSBClZCz+xmNQ3LNQRyK4DFbcJXxWmZufQIA7d9EZD7DkDIcwu1GkXQntV080

DwDBWarhg5L/a0oaFM8u7uAUu+BBlufAzLdrylR+wN1HJfJc4H80cmv8YIQ0xP0FkwVN

TzoQ8PDXLqz9nRDJ0nb51lKUOT/yOAodNU30Y1+qVeICgbl/PEHHT80cmO4ts+9J4i1h

H17Fa2bkRQ89RqOW5KNKgnBrLEEAZfLIWd8W8k7R5Kh16OvoTC9yybqyBCCuZ+3P1wBm

rRWg==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20221208; t=1682432352; x=1685024352;

h=date:mime-version:to:subject:from:message-id:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=HRA5u/rmixSC/CrrUIeVkmq7iYbP0HZbuluh0gzvOVU=;

b=WBxxdYhXJNu7/99EVlVgHNnboj5vZFQ3gKyfWs++Ub3DxR5X7KLnZWHe5+W/s4R6R6

q7sOhXt3EJ9QBBPp8CjMkJLks8aWsXcjWYRJFjjudfqEJeCjuC1zP4/ejQlK7M/bSktQ

YbZvuZW5asULWlWYtC4kpxCYVyoBPt8JM/RXM4uU/MWc3xZoB3WCez4aaR00U4kAcSpJ

rhOHk3k1vczYMDxM55rOukhmweaV6Qje/yigpFQ5Nxr9w7x380JUXQmPL3nVap4bReFi

1jGu2zuVAcWE7Sa9rUw1m8V9q37UWm71+b87HORUyy5QM9b6F11pUwe3WIoaNKXy4bie

e3fQ==

X-Gm-Message-State: AAQBX9fN3LPqYrs0RjT4QN8kdMNrUTwZrc/xn3mSpSJQKVrvl4csLKqW

m1W3msFK0Okd2+KdhADWOcKk62g7ibo8pQ==

X-Google-Smtp-Source: AKy350bjVqnhZKE/eaEJPQZobQ4+mP7WMmIRdyL82j2mc3uaakWVcV6YMRIH+qA1HyhyKvw9CJHc5w==

X-Received: by 2002:a05:6a20:12cb:b0:ee:8450:a3c9 with SMTP id v11-20020a056a2012cb00b000ee8450a3c9mr24493134pzg.2.1682432352489;

Tue, 25 Apr 2023 07:19:12 -0700 (PDT)

Received: from 86.48.14.202 ([122.161.78.110])

by smtp.gmail.com with ESMTPSA id fa23-20020a056a002d1700b006259e883ee9sm7637750pfb.189.2023.04.25.07.19.11

for

(version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);

Tue, 25 Apr 2023 07:19:11 -0700 (PDT)

Message-ID: <6447e15f.050a0220.96f0f.df8e@mx.google.com>

From: "Darin P. Larsen"

Subject: Transaction Alert Notice#659021

To: "doctor"

Content-Type: multipart/alternative; boundary="HkG1a27L7PAcb0wLkEuOnN3Pef1KtbVw=_"

MIME-Version: 1.0

Date: Tue, 25 Apr 2023 19:49:11 +0530



This is a multi-part message in MIME format



--HkG1a27L7PAcb0wLkEuOnN3Pef1KtbVw=_

Content-Type: text/plain; charset="utf-8"

Content-Transfer-Encoding: quoted-printable

Content-Disposition: inline



Hello User , doctor@nl2k.ca



Annual Transaction Successful!



We are glad to see you again for reactivating your annual PC subscript=

ion plan with us.



You have received this email because you subscribed for PC and Network=

Protection services last year which expired yesterday.



So as you have opted for direct debit, we have debited your bank accou=

nt with ($ 379.99) and resumed the services again for one year.



This annual subscription will remain active until (April, 24, 2024) un=

less you contact us to cancel the subscription or void all the charges=

=2E



Contact Customer Service Helpdesk # +1 (844) 777 9199



Order Information :-



Customer Unique ID : 983-5462-69103

Seller's Name : Mcafee Total Tech

Advanced PC and Network Shield

Subscription Fee : $ 379.99



If you find an error in this transaction or you wish to unsubscribe an=

d get the full amount refunded back to the original payment source, pl=

ease contact us.









Yours cordially,



Darin P. Larsen

Accounts Team (Manager)

Tollfree # +1 (844) 777 9199





--HkG1a27L7PAcb0wLkEuOnN3Pef1KtbVw=_

Content-Type: text/html; charset="utf-8"

Content-Transfer-Encoding: quoted-printable

Content-Disposition: inline



Dear Custome=

r, doctor@nl2k.ca



Annual Transaction 
ong>Successful!



We are glad to see you again for reac=

tivating your annual PC subscription plan with us.



You have received this email because =

you subscribed for PC and Network Protection services last year which =

expired yesterday.



So as you have opted for direct debit=

, we have debited your bank account with ($ 379.99) and resumed the se=

rvices again for one year.



This annual subscription will remain =

active until (April, 24, 2024) unless you contact us to cancel the sub=

scription or void all the charges.



For instant queries or support - Cont=

act # +1 (844) 777 9199



Order Information :-=



Customer Unique ID : 983-5462-69103
r>Seller's Name : Mcafee Total Tech
Advanced PC and Network Shield<=

br>
nt: 0px; letter-spacing: normal; font-family: "Times New Roman"; font-=

size: medium; font-style: normal; font-weight: 400; word-spacing: 0px;=

float: none; display: inline !important; white-space: normal; orphans=

: 2; widows: 2; background-color: rgb(255, 255, 255); font-variant-lig=

atures: normal; font-variant-caps: normal; -webkit-text-stroke-width: =

0px; text-decoration-thickness: initial; text-decoration-style: initia=

l; text-decoration-color: initial;'>Subscription Fee : $ 379.99=



If you find an error in this transact=

ion or you wish to unsubscribe and get the full amount refunded back t=

o the original payment source, please contact us.






Kind wishes,



Darin P. Larsen
Service Activation=

Dept.
Tollfree # +1 (844) 777 9199


ml>





--HkG1a27L7PAcb0wLkEuOnN3Pef1KtbVw=_--



Trackbacks

Trackback specific URI for this entry

This link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.

No Trackbacks

Comments

Display comments as Linear | Threaded

No comments

Add Comment

Enclosing asterisks marks text as bold (*word*), underscore are made via _word_.
Standard emoticons like :-) and ;-) are converted to images.

To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.
CAPTCHA

Enclosing asterisks marks text as bold (*word*), underscore are made via _word_.
Standard emoticons like :-) and ;-) are converted to images.

To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.
CAPTCHA