McAfee Phish from Google Gmail
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 06 Dec 2023 11:30:02 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97 (FreeBSD))
(envelope-from)
id 1rAweY-00000000Geg-1W1r
for dave@doctor.nl2k.ab.ca;
Wed, 06 Dec 2023 11:29:46 -0700
Resent-From: The Doctor
Resent-Date: Wed, 6 Dec 2023 11:29:46 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-oo1-f53.google.com ([209.85.161.53]:47236)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.97 (FreeBSD))
(envelope-from)
id 1rAvSb-000000009vm-3t7n
for doctor@doctor.nl2k.ab.ca;
Wed, 06 Dec 2023 10:13:27 -0700
Received: by mail-oo1-f53.google.com with SMTP id 006d021491bc7-58d18c224c7so4314225eaf.2
for; Wed, 06 Dec 2023 09:11:19 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20230601; t=1701882673; x=1702487473; darn=doctor.nl2k.ab.ca;
h=date:mime-version:to:subject:from:message-id:from:to:cc:subject
:date:message-id:reply-to;
bh=B8IAageFzefGBJXDtw3AANAR0tY22YAT09YW1ZbGJss=;
b=fV/7E2ti6A0GP7hu0qB6hVpOKVyceKLw7s5gxEb1kiPUGD7EAfNyE0yD86uDDFecRj
Etgu4aaqvrGz+wPv+vV5/jPvsML7EMlMR6JkQSW35yz0nVV+NdeL3QKmlj4mtvu8mBP4
ezCZNZUvUfdiiAtMw0xh8sCsMFRoswccWzPDairZQJky2Tsy9LoUM/dSUoc6TFL9pnZA
IFQ/SQyUqQOYobSUR9mNivehYdOb5O+DcHC58goLch2bbk/pYNb7hFPToCgNsgXdG1T4
iVn7vKVfq+clek7p/ObzJslf4kyVlm80ONLTdXap1of0/pBqnfRpbBTSqRlQw4SPCu6f
hoEQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20230601; t=1701882673; x=1702487473;
h=date:mime-version:to:subject:from:message-id:x-gm-message-state
:from:to:cc:subject:date:message-id:reply-to;
bh=B8IAageFzefGBJXDtw3AANAR0tY22YAT09YW1ZbGJss=;
b=eBlJRByzORkgzsAytt+Y72bFXjVmOeiVFEu0UITZpug+NkZZtz5AGCChmDie9Lur32
3iV6cYMOZ1Pl64hIatKiRZqkvwYMFsn4/a3tph+c9dKjmnaOq4BNbFtJUczKOT9T9/NF
PPtVlZzh3aqIwdJiSs12hecxcj4oYjPn29xTlKy74PfCKAf2BmDJHLVwgB1TFgHzOTbl
k+y6SawTD5iN2pPIFtcIx5ONwCHMXtL1ekB1mr1lvHDy4uTH1u76jQhFkWa1z/6QKQoC
mbX7pLlJRJtp7Wc4TQHN7k5X7bpn/bYQ049zOWBYcmw8D0tz1rb1nWdZpK6eaHivXmzb
BstA==
X-Gm-Message-State: AOJu0YxtPK7uzhY2OXY6SlnzBLzq7WHKcGicnWbdIh+US8+Oujm+rgUv
W25mrnrWMmuhVViuhCo0yRhAsAVISA/VcGAP
X-Google-Smtp-Source: AGHT+IE0k4h20eEwXHLlyfC7HDQcM91SjCod1aGHeuXKQ6egec5IPyiNjUlFoVQQdZXyHlEYMh2HOQ==
X-Received: by 2002:a05:6820:1ac7:b0:58e:2815:6156 with SMTP id bu7-20020a0568201ac700b0058e28156156mr1081824oob.1.1701882301811;
Wed, 06 Dec 2023 09:05:01 -0800 (PST)
Received: from 172.56.53.210 ([172.56.14.182])
by smtp.gmail.com with ESMTPSA id p29-20020a4a3c5d000000b0058d76e8ce0dsm52611oof.36.2023.12.06.09.04.59
for
(version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);
Wed, 06 Dec 2023 09:05:01 -0800 (PST)
Message-ID: <6570a9bd.4a0a0220.e4b95.0d96@mx.google.com>
From: "Charles P Brown"
Subject: Celebrating Success: Your Renewal and Payment Completed #ZPP25
To: "doctor"
Content-Type: multipart/alternative; boundary="ZWKAlOzYutKHIuoQOAVQu=_NKAix1Re2XQ"
MIME-Version: 1.0
Date: Wed, 6 Dec 2023 22:34:48 +0530
X-Spam_score: 7.6
X-Spam_score_int: 76
X-Spam_bar: +++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: A Toast to Renewed Connections Sir/Madam DOCTOR@DOCTOR.NL2K.AB.CA,
Your choice to renew your subscription fills us with pride. This marks the
beginning of another exciting chapter in our journey together.
Content analysis details: (7.6 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS
[172.56.14.182 listed in zen.spamhaus.org]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.161.53 listed in list.dnswl.org]
-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)
[209.85.161.53 listed in wl.mailspike.net]
-0.0 SPF_PASS SPF: sender matches SPF record
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit
[ts7069687(at)gmail.com]
1.2 RCVD_HELO_IP_MISMATCH Received: HELO and IP do not match, but should
0.9 RCVD_NUMERIC_HELO Received: contains an IP address used for HELO
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[ts7069687(at)gmail.com]
0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to
background
0.0 HTML_MESSAGE BODY: HTML included in message
-0.0 T_SCC_BODY_TEXT_LINE No description available.
2.0 FSL_HELO_BARE_IP_2 No description available.
Subject: {SPAM?} Celebrating Success: Your Renewal and Payment Completed #ZPP25
X-Antivirus: AVG (VPS 231206-14, 12/6/2023), Inbound message
X-Antivirus-Status: Clean
This is a multi-part message in MIME format
--ZWKAlOzYutKHIuoQOAVQu=_NKAix1Re2XQ
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
A Toast to Renewed Connections=20
Sir/Madam DOCTOR@DOCTOR.NL2K.AB.CA,
Your choice to renew your subscription fills us with pride. This marks=
the beginning of another exciting chapter in our journey together.
Renewal Date: 06-12-2023
Invoice ID: ZUKVX3C9EG
Service Details:
Product Name: McAfee's Corporate Protection
Number of Units: 1
Total Cost: $559.59
Payment Status: Complete
Our team is dedicated to ensuring your satisfaction. For any assistanc=
e or further details, please contact us directly.
Phone: +1 [888] 223 0994
For inquiries regarding subscription modifications or refund options, =
our customer service team is always ready to help.
We cherish your trust and look forward to delivering excellence in all=
our services.
With Appreciation,
Charles P Brown
McAfee's Corporate Protection
McAfee, Inc.
+1 [888] 223 0994
=C2=A9 2023 McAfee, Inc. | Learn More About Our Policies
--ZWKAlOzYutKHIuoQOAVQu=_NKAix1Re2XQ
Content-Type: text/html; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
Subscription Renewal: A New Chapter Begins
A Toast to Renewed Connections
=20
--ZWKAlOzYutKHIuoQOAVQu=_NKAix1Re2XQ--
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 06 Dec 2023 11:30:02 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97 (FreeBSD))
(envelope-from
id 1rAweY-00000000Geg-1W1r
for dave@doctor.nl2k.ab.ca;
Wed, 06 Dec 2023 11:29:46 -0700
Resent-From: The Doctor
Resent-Date: Wed, 6 Dec 2023 11:29:46 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-oo1-f53.google.com ([209.85.161.53]:47236)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.97 (FreeBSD))
(envelope-from
id 1rAvSb-000000009vm-3t7n
for doctor@doctor.nl2k.ab.ca;
Wed, 06 Dec 2023 10:13:27 -0700
Received: by mail-oo1-f53.google.com with SMTP id 006d021491bc7-58d18c224c7so4314225eaf.2
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20230601; t=1701882673; x=1702487473; darn=doctor.nl2k.ab.ca;
h=date:mime-version:to:subject:from:message-id:from:to:cc:subject
:date:message-id:reply-to;
bh=B8IAageFzefGBJXDtw3AANAR0tY22YAT09YW1ZbGJss=;
b=fV/7E2ti6A0GP7hu0qB6hVpOKVyceKLw7s5gxEb1kiPUGD7EAfNyE0yD86uDDFecRj
Etgu4aaqvrGz+wPv+vV5/jPvsML7EMlMR6JkQSW35yz0nVV+NdeL3QKmlj4mtvu8mBP4
ezCZNZUvUfdiiAtMw0xh8sCsMFRoswccWzPDairZQJky2Tsy9LoUM/dSUoc6TFL9pnZA
IFQ/SQyUqQOYobSUR9mNivehYdOb5O+DcHC58goLch2bbk/pYNb7hFPToCgNsgXdG1T4
iVn7vKVfq+clek7p/ObzJslf4kyVlm80ONLTdXap1of0/pBqnfRpbBTSqRlQw4SPCu6f
hoEQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20230601; t=1701882673; x=1702487473;
h=date:mime-version:to:subject:from:message-id:x-gm-message-state
:from:to:cc:subject:date:message-id:reply-to;
bh=B8IAageFzefGBJXDtw3AANAR0tY22YAT09YW1ZbGJss=;
b=eBlJRByzORkgzsAytt+Y72bFXjVmOeiVFEu0UITZpug+NkZZtz5AGCChmDie9Lur32
3iV6cYMOZ1Pl64hIatKiRZqkvwYMFsn4/a3tph+c9dKjmnaOq4BNbFtJUczKOT9T9/NF
PPtVlZzh3aqIwdJiSs12hecxcj4oYjPn29xTlKy74PfCKAf2BmDJHLVwgB1TFgHzOTbl
k+y6SawTD5iN2pPIFtcIx5ONwCHMXtL1ekB1mr1lvHDy4uTH1u76jQhFkWa1z/6QKQoC
mbX7pLlJRJtp7Wc4TQHN7k5X7bpn/bYQ049zOWBYcmw8D0tz1rb1nWdZpK6eaHivXmzb
BstA==
X-Gm-Message-State: AOJu0YxtPK7uzhY2OXY6SlnzBLzq7WHKcGicnWbdIh+US8+Oujm+rgUv
W25mrnrWMmuhVViuhCo0yRhAsAVISA/VcGAP
X-Google-Smtp-Source: AGHT+IE0k4h20eEwXHLlyfC7HDQcM91SjCod1aGHeuXKQ6egec5IPyiNjUlFoVQQdZXyHlEYMh2HOQ==
X-Received: by 2002:a05:6820:1ac7:b0:58e:2815:6156 with SMTP id bu7-20020a0568201ac700b0058e28156156mr1081824oob.1.1701882301811;
Wed, 06 Dec 2023 09:05:01 -0800 (PST)
Received: from 172.56.53.210 ([172.56.14.182])
by smtp.gmail.com with ESMTPSA id p29-20020a4a3c5d000000b0058d76e8ce0dsm52611oof.36.2023.12.06.09.04.59
for
(version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);
Wed, 06 Dec 2023 09:05:01 -0800 (PST)
Message-ID: <6570a9bd.4a0a0220.e4b95.0d96@mx.google.com>
From: "Charles P Brown"
Subject: Celebrating Success: Your Renewal and Payment Completed #ZPP25
To: "doctor"
Content-Type: multipart/alternative; boundary="ZWKAlOzYutKHIuoQOAVQu=_NKAix1Re2XQ"
MIME-Version: 1.0
Date: Wed, 6 Dec 2023 22:34:48 +0530
X-Spam_score: 7.6
X-Spam_score_int: 76
X-Spam_bar: +++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: A Toast to Renewed Connections Sir/Madam DOCTOR@DOCTOR.NL2K.AB.CA,
Your choice to renew your subscription fills us with pride. This marks the
beginning of another exciting chapter in our journey together.
Content analysis details: (7.6 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS
[172.56.14.182 listed in zen.spamhaus.org]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.161.53 listed in list.dnswl.org]
-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)
[209.85.161.53 listed in wl.mailspike.net]
-0.0 SPF_PASS SPF: sender matches SPF record
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit
[ts7069687(at)gmail.com]
1.2 RCVD_HELO_IP_MISMATCH Received: HELO and IP do not match, but should
0.9 RCVD_NUMERIC_HELO Received: contains an IP address used for HELO
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[ts7069687(at)gmail.com]
0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to
background
0.0 HTML_MESSAGE BODY: HTML included in message
-0.0 T_SCC_BODY_TEXT_LINE No description available.
2.0 FSL_HELO_BARE_IP_2 No description available.
Subject: {SPAM?} Celebrating Success: Your Renewal and Payment Completed #ZPP25
X-Antivirus: AVG (VPS 231206-14, 12/6/2023), Inbound message
X-Antivirus-Status: Clean
This is a multi-part message in MIME format
--ZWKAlOzYutKHIuoQOAVQu=_NKAix1Re2XQ
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
A Toast to Renewed Connections=20
Sir/Madam DOCTOR@DOCTOR.NL2K.AB.CA,
Your choice to renew your subscription fills us with pride. This marks=
the beginning of another exciting chapter in our journey together.
Renewal Date: 06-12-2023
Invoice ID: ZUKVX3C9EG
Service Details:
Product Name: McAfee's Corporate Protection
Number of Units: 1
Total Cost: $559.59
Payment Status: Complete
Our team is dedicated to ensuring your satisfaction. For any assistanc=
e or further details, please contact us directly.
Phone: +1 [888] 223 0994
For inquiries regarding subscription modifications or refund options, =
our customer service team is always ready to help.
We cherish your trust and look forward to delivering excellence in all=
our services.
With Appreciation,
Charles P Brown
McAfee's Corporate Protection
McAfee, Inc.
+1 [888] 223 0994
=C2=A9 2023 McAfee, Inc. | Learn More About Our Policies
--ZWKAlOzYutKHIuoQOAVQu=_NKAix1Re2XQ
Content-Type: text/html; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
A Toast to Renewed Connections
Sir/Madam DOCTOR@DOCTOR.NL2K.AB.CA,
Your choice to renew your subscription fills us with pr=
ide. This marks the beginning of another exciting chapter in our journ=
ey together.
Renewal Date: 06-12-2023
Invoice ID: NT4QT7H7TM
Service Details:
Product Name: McAfee Digital Bastion Corp.
Number of Units: 1
Total Cost: $770.70
Payment Status: Complete
Our team is dedicated to ensuring your satisfaction. Fo=
r any assistance or further details, please contact us directly.
Phone: +1 [888] 223 0994
For inquiries regarding subscription modifications or r=
efund options, our customer service team is always ready to help.
We cherish your trust and look forward to delivering ex=
cellence in all our services.
=20
With Appreciation,
Charles P Brown
McAfee Digital Bastion Corp.
McAfee, Inc.
+1 [888] 223 0994
--ZWKAlOzYutKHIuoQOAVQu=_NKAix1Re2XQ--
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments