McAfee Phish
Posted by Dave Yadallee onX-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@nl2k.ab.ca
Delivery-date: Sat, 24 Oct 2026 11:09:00 -0600
Received: from potugalis.xyz ([185.161.251.135]:35981)
by doctor.nl2k.ab.ca with esmtp (Exim 4.100.1 (FreeBSD))
(envelope-from
id 1xKfE2-00000000KhT-1P0c
for dave@nl2k.ab.ca;
Sat, 24 Oct 2026 11:08:15 -0600
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=smtp; d=potugalis.xyz;
h=Date:From:To:Cc:Subject:MIME-Version:Content-Type:Content-Transfer-Encoding:List-Unsubscribe:Message-ID; i=admin@potugalis.xyz;
bh=XEj6KhyoY+Ldovn8bsiIAOP/muQ=;
b=ja/yiGkle+AA9t2On6T4CGMrnEbQbRaWxCN9zue78Au6gmHL9H8eDFk+mKSh0ZUikKMbyU0xU4bg
3uAcZWrA0f5QvG/0AwCXi0UsnkIsqd+003KSnjbdt95DPoCs6Z1u0YBHKa8+CZXDeluRqI4Ce14c
XKDx1pBRblQeIFBK+T0r7+yVXp0hNgaC5LJ5MwGS13GFEFABQogkEJ25j+ouh8zFFNCWoc/pgmz1
WmkyzyV+++j1a43n+sgPwx1yeKqlBpR58niNeJH1SbPkP6C6Gy1bmAbg4KMG25vmbNM/6Lt4bgIB
yW+aU1PG+CIO+QIOM9xS948WGFZxk8WM6nPumA==
DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=smtp; d=potugalis.xyz;
b=fBbjSsf6Da3BZbRPBJkUNjCJRKaJAZuGZvhghqlsD5yn18ZfzH580m+bo35OzKQZFl/V22mdw7qV
K7VB1gwxpqr3n0+8jV7as/wuDHD1VFG5KNKGAVWLIv01RGCCb7tgqgOEyiU2/lG9/Z+TfwZt9Bei
LL3e3iye43AWSo/2n3cZhORdrY3HH/69cP6Yh7Va6CR9rFz0/4Nh9MfgpZ5r/QKgYVPH7z0gUTS1
Nk0ii9l4zc+geBLkFek9NbkrWsBZ7V30w32n9FGgUwA0Kpb0i5Z2UXzllYfSQMNlj4An848cpFsv
2WvWjisrRgR+2nWdkYxMUwhOS3Btptk9f/ZE6A==;
Date: 10-24-2026
From: McAfee Protection
To: dave@nl2k.ab.ca
Cc: dave@nl2k.ab.ca
Subject: dave, Your antivirus protection has expired!!
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
List-Unsubscribe-Post: List-Unsubscribe=One-Click
List-Unsubscribe:
Message-ID: <0100018cbff5f80e-358cfa4d-48ec-4851-b8e8-6fba450ccf1a-000000@email.amazonses.com>
Feedback-ID: ::1.us-east-1.Z66o7be85LNljN8JtXY0Tr/N3zGCoTPem8L/XbSgE7E=:AmazonSES
X-SES-Outgoing: 2026.03.05-54.240.11.18
X-Spam_score: 20.9
X-Spam_score_int: 209
X-Spam_bar: ++++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: McAfee Subscription Expired McAfeeâ„¢
Content analysis details: (20.9 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[185.161.251.135 listed in bl.score.senderscore.com]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[185.161.251.135 listed in will-spam-for-food.eu.org]
[185.161.251.135 listed in will-spam-for-food.eu.org]
[185.161.251.135 listed in will-spam-for-food.eu.org]
[185.161.251.135 listed in will-spam-for-food.eu.org]
[185.161.251.135 listed in will-spam-for-food.eu.org]
[185.161.251.135 listed in will-spam-for-food.eu.org]
[185.161.251.135 listed in will-spam-for-food.eu.org]
[185.161.251.135 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[185.161.251.135 listed in dnsbl.ahbl.org]
[185.161.251.135 listed in dnsbl.ahbl.org]
[185.161.251.135 listed in dnsbl.ahbl.org]
[185.161.251.135 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[185.161.251.135 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[185.161.251.135 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[185.161.251.135 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[185.161.251.135 listed in dnsbl.ahbl.org]
1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist
[URI: keymart.net]
[URI: potugalis.xyz]
1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist
[URI: keymart.net]
1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist
[URI: keymart.net]
2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist
[URI: keymart.net]
2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist
[URI: potugalis.xyz]
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
-0.0 SPF_PASS SPF: sender matches SPF record
0.6 INVALID_DATE_TZ_ABSURD Invalid Date: header (timezone does not exist)
1.4 BUG6152_INVALID_DATE_TZ_ABSURD No description available.
0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in
headers
0.4 INVALID_DATE Invalid Date: header (not RFC 2822)
-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay
domain
0.0 T_PDS_OTHER_BAD_TLD Untrustworthy TLDs
[URI: potugalis.xyz (xyz)]
0.7 LOCALPART_IN_SUBJECT Local part of To: address appears in Subject
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars
2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars
2.0 FROM_SUSPICIOUS_NTLD_FP From abused NTLD
0.5 FROM_SUSPICIOUS_NTLD From abused NTLD
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
Subject: {SPAM?} dave, Your antivirus protection has expired!!
X-Antivirus: AVG (VPS 261024-4, 10/24/2026), Inbound message
X-Antivirus-Status: Clean
McAfeeâ„¢
Your McAfee subscription expired on Oct 20, 2026.
After the expiry date Your Device will become susceptible to many different virus threats.
Your Device might be unprotected, it can be exposed to viruses and other malware...
You are eligible for discount: 62% 1yr Renewal Discount
Offer will expire at: 10-25-2026 23:59