Merchant phishing
Posted by Dave Yadallee onEnvelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 12 Jul 2023 17:43:02 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96 (FreeBSD))
(envelope-from
id 1qJjSx-000LyM-27
for dave@doctor.nl2k.ab.ca;
Wed, 12 Jul 2023 17:41:51 -0600
Resent-From: The Doctor
Resent-Date: Wed, 12 Jul 2023 17:41:51 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-yw1-f173.google.com ([209.85.128.173]:55659)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.96 (FreeBSD))
(envelope-from
id 1qJgqR-000GBO-1R
for root@nl2k.ab.ca;
Wed, 12 Jul 2023 14:53:58 -0600
Received: by mail-yw1-f173.google.com with SMTP id 00721157ae682-57eb0df5265so10018097b3.3
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20221208; t=1689195130; x=1691787130;
h=date:organization:mime-version:to:subject:from:message-id:from:to
:cc:subject:date:message-id:reply-to;
bh=KYa3bICtOR+hhrsAnarw/QcqzS6IzlMcRbvw1xhH83Q=;
b=hVU91Knyo8rJyI9aPxohrmqCTY9EK+ESLgKD/I84KUMMAMvqMdrCxUDEuboWideuPV
D47ot9fQvhKlzGXhUDU+pIdMdC3noAZVMpTJbyTNH3Lb5o2Qi/3cLHhYQnmYL0df9T9h
ylYlUzGfAofAIFGQPhB9PoG2pZn0bHGbyZ7s7mOa2f3pNXcfbkxhWwQKVWZzFWZiJ9VP
WG0gpME3ZA0bSgi2CDkeHLU+bATiFCFJFxyKGbLPP1Ys+cYV5VWc2KoF+pggYtVZcPL0
YQ/bH9CIQY+MM75wc2xJJGdbdbCOVQlAHhmZBBEGQ1yTyKPNs6lR+15DC694y6Es8Lpi
OQDw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20221208; t=1689195130; x=1691787130;
h=date:organization:mime-version:to:subject:from:message-id
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
bh=KYa3bICtOR+hhrsAnarw/QcqzS6IzlMcRbvw1xhH83Q=;
b=AcpL1UVmT2JoUwCX10X2GWbKdOui6eYyf/0G8kr3/RFHzWL/oPphId2gKx65fTSEFP
OX4W43440x9DOoMlnSBGzplaxwCEKrUb1TsP76DFb+FCekqKLwgSHJ9qT1fOPpF+tBrq
OpBiL+6wI8vqpAatQsCnb6u6RLmJZhiF6284tM3zlL8ADVCUjuE7bZhpsA5Vy25q/JWs
LI81S/yJz9/xwbYCqvZsusjgdRfOJkmfgCt+1Cnr7St7TlHbZgrnqQEYFLNxx2W+7vCz
jDhUKTTuGZjpzORd04nDB1GSk0jz5146N4Vh/ZM4C6lev/KZSKdH64DS7B0Jdqcvg8Jr
Kjnw==
X-Gm-Message-State: ABy/qLbpIbW68S0QOLPPpgU8EoSnc7c0wJg1+2VBN3qzxMxa4HCmKzye
0YpzksFNl4AcmGzO8mho7TtfDp8G3n6fPXGtxNU=
X-Google-Smtp-Source: APBJJlHT5CvaLO/I5/gZPQlqNFIjJQbFDI0o/kHCbg7iXhR6SZq630Gk2TyGNx137ZcHHWYijyzlEg==
X-Received: by 2002:a81:4745:0:b0:577:d44:a163 with SMTP id u66-20020a814745000000b005770d44a163mr18830881ywa.6.1689195129740;
Wed, 12 Jul 2023 13:52:09 -0700 (PDT)
Received: from 185.203.218.20 ([185.203.218.20])
by smtp.gmail.com with ESMTPSA id r186-20020a0dcfc3000000b0057a165e6ee1sm1401292ywd.35.2023.07.12.13.52.08
for
(version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);
Wed, 12 Jul 2023 13:52:09 -0700 (PDT)
Message-ID: <64af1279.0d0a0220.4d3b.9ee3@mx.google.com>
From: "Altagracia J. Dicarlo"
Subject: Services Secure Again#690312
To: "root"
Content-Type: multipart/alternative; boundary="2PEaHRsoZjtCAQb=_rgAvG2U8f8lj8bgeu"
MIME-Version: 1.0
Organization: McAfee Billing Team
Date: Thu, 13 Jul 2023 02:22:08 +0530
X-Spam_score: 5.0
X-Spam_score_int: 50
X-Spam_bar: +++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Hello there, root@nl2k.ab.ca Thank you again for subscribing
to us! We are glad to see you choosing MCAfee Total as your preferred Network
shield and PC Security service provider.
Content analysis details: (5.0 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.128.173 listed in list.dnswl.org]
-0.0 SPF_PASS SPF: sender matches SPF record
0.6 HK_RANDOM_ENVFROM Envelope sender username looks random
0.5 FROM_LOCAL_NOVOWEL From: localpart has series of non-vowel letters
1.0 HK_RANDOM_FROM From username looks random
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit
[tdtdgdvxvx643(at)gmail.com]
0.9 RCVD_NUMERIC_HELO Received: contains an IP address used for HELO
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[tdtdgdvxvx643(at)gmail.com]
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.128.173 listed in wl.mailspike.net]
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
-0.0 T_SCC_BODY_TEXT_LINE No description available.
2.0 FSL_HELO_BARE_IP_2 No description available.
Subject: {SPAM?} Services Secure Again#690312
This is a multi-part message in MIME format
--2PEaHRsoZjtCAQb=_rgAvG2U8f8lj8bgeu
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
Hello there, root@nl2k.ab.ca
Thank you again for subscribing to us!
We are glad to see you choosing MCAfee Total as your preferred Network=
shield and PC Security service provider.
Your subscription plan was reactivated on July 11, 2023 (auto-renewal)=
, and it will remain active until July 10, 2023, unless you choose to =
cancel.
The annual total amount of $ 379.89 has been successfully processed fr=
om the updated payment method; this charge will reflect on the stateme=
nt shortly.
Order and Transaction Details:
Reference ID: 7734662938
Seller's name: MCAfee Total Corp.
Payment mode: Auto debit
Subscription fee: $ 379.89
As you opted for auto-debit, the recurring fee will be debited again n=
ext year on July 10, 2024, unless you choose to cancel the subscriptio=
n or stop auto-debit payments.
If you wish to opt out or drop all charges and want the full amount re=
funded back to the original payment source, please contact us at +1 (8=
88) 713-5736.
=20
With gratitude
Hope Capriati
McAfee Billing Team
Toll-free Number: +1 (888) 713-5736.
--2PEaHRsoZjtCAQb=_rgAvG2U8f8lj8bgeu
Content-Type: text/html; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
Hello the=
re, root@nl2k.ab.ca
le=3D"color: rgb(0, 0, 0);">Thank you again for subscribing to us!
an>
We are gl=
ad to see you choosing MCAfee Total as your preferred Network shield a=
nd PC Security service provider.
Your subs=
cription plan was reactivated on July 11, 2023 (auto-renewal), and it =
will remain active until July 10, 2023, unless you choose to cancel.
p>
The annua=
l total amount of $ 379.89 has been successfully processed from the up=
dated payment method; this charge will reflect on the statement shortl=
y.
tyle=3D"color: rgb(37, 37, 37);">=
Order and Transaction Details:
Reference=
ID: 3570115379
Seller's name:
pan style=3D"color: rgb(44, 130, 201);">MCAfee Total Corp.
tyle=3D"color: rgb(37, 37, 37);">Payment mode:
gb(44, 130, 201);">Auto debit
pan>Subscription fee: $ 379.=
89
As you op=
ted for auto-debit, the recurring fee will be debited again next year =
on July 10, 2024, unless you choose to cancel the subscription or stop=
auto-debit payments.
If you wi=
sh to opt out or drop all charges and want the full amount refunded ba=
ck to the original payment source, please contact us at
"color: rgb(44, 130, 201);">+1 (888) 713-5736.=
>
With appr=
eciation
Serena Vo=
llmer
McAfee Billing Team
e=3D"color: rgb(37, 37, 37);">Toll-free Number:
"color: rgb(44, 130, 201);">+1
rgb(37, 37, 37);"> (888=
) 713-5736.
--2PEaHRsoZjtCAQb=_rgAvG2U8f8lj8bgeu--
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments