Antivirus phish
Posted by Dave Yadallee on
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-path: <>
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Sat, 24 Oct 2026 19:39:59 -0600
Received: from [130.49.219.81] (port=49265 helo=stonehaven.com)
by doctor.nl2k.ab.ca with esmtp (Exim 4.100.1 (FreeBSD))
id 1xKnCt-000000009cW-1Njv
for dave@doctor.nl2k.ab.ca;
Sat, 24 Oct 2026 19:39:33 -0600
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=smtp; d=doctor.nl2k.ab.ca;
h=Date:From:To:Cc:Subject:MIME-Version:Content-Type; i=dave@doctor.nl2k.ab.ca;
bh=t5Mte3Q0WUeWJ4PoiuRWPUpGxAw=;
b=FF7P7q9ZGrZr9Ndy/O4jSuWkR6cCn4iVsoG+ZtTcemPC2yeG2/ShAr+trPC7Li7y6zk42bQgeUb2
+/ndJ5p5MfUoGTyZRRmsb4Gw/z540ZI6S9oLn45w66vRDVQ+FWFws23xdvJ19Q1tMzXgzJvsxZc7
z2GNqWt+Xysa5CWNEQk=
DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=smtp; d=doctor.nl2k.ab.ca;
b=Y33tym69sct4MkmWbO5EcAGZnR4OFpFwZimyoZhBT5pvl3YHXadxkwbIkYeqCkorKwit1u8dvbga
in6b6D2KToOMqRDhq3/riRYXH5hVtc8QnutTwUqzvgehFg847R1ASafe2n+VXeNaQnvo9/LWhCGj
9F3twUlJFjku855Teg0=;
Date: 10-25-2026
From: McAfee Protection
To: dave@doctor.nl2k.ab.ca
Cc: dave@doctor.nl2k.ab.ca
Subject: Your antivirus protection has expired!
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
X-Spam_score: 14.9
X-Spam_score_int: 149
X-Spam_bar: ++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: McAfee Subscription Expired McAfeeâ„¢
Content analysis details: (14.9 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.1 MISSING_MID Missing Message-Id: header
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[130.49.219.81 listed in will-spam-for-food.eu.org]
[130.49.219.81 listed in will-spam-for-food.eu.org]
[130.49.219.81 listed in will-spam-for-food.eu.org]
[130.49.219.81 listed in will-spam-for-food.eu.org]
[130.49.219.81 listed in will-spam-for-food.eu.org]
[130.49.219.81 listed in will-spam-for-food.eu.org]
[130.49.219.81 listed in will-spam-for-food.eu.org]
[130.49.219.81 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[130.49.219.81 listed in dnsbl.ahbl.org]
[130.49.219.81 listed in dnsbl.ahbl.org]
[130.49.219.81 listed in dnsbl.ahbl.org]
[130.49.219.81 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[130.49.219.81 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[130.49.219.81 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[130.49.219.81 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[130.49.219.81 listed in dnsbl.ahbl.org]
1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist
[URI: keymart.net]
1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist
[URI: keymart.net]
2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist
[URI: keymart.net]
0.6 INVALID_DATE_TZ_ABSURD Invalid Date: header (timezone does not exist)
1.4 BUG6152_INVALID_DATE_TZ_ABSURD No description available.
0.4 INVALID_DATE Invalid Date: header (not RFC 2822)
1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist
[URI: keymart.net]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |]
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |]
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[130.49.219.81 listed in bl.score.senderscore.com]
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
1.3 RDNS_NONE Delivered to internal network by a host with no rDNS
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.0 TO_EQ_FM_HTML_DIRECT To == From and HTML only, direct-to-MX
0.4 TO_EQ_FM_DIRECT_MX To == From and direct-to-MX
Subject: {SPAM?} Your antivirus protection has expired!
X-Antivirus: AVG (VPS 261024-6, 10/24/2026), Inbound message
X-Antivirus-Status: Clean
McAfee Subscription Expired
McAfeeâ„¢
X-Mozilla-Status2: 00000000
Return-path: <>
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Sat, 24 Oct 2026 19:39:59 -0600
Received: from [130.49.219.81] (port=49265 helo=stonehaven.com)
by doctor.nl2k.ab.ca with esmtp (Exim 4.100.1 (FreeBSD))
id 1xKnCt-000000009cW-1Njv
for dave@doctor.nl2k.ab.ca;
Sat, 24 Oct 2026 19:39:33 -0600
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=smtp; d=doctor.nl2k.ab.ca;
h=Date:From:To:Cc:Subject:MIME-Version:Content-Type; i=dave@doctor.nl2k.ab.ca;
bh=t5Mte3Q0WUeWJ4PoiuRWPUpGxAw=;
b=FF7P7q9ZGrZr9Ndy/O4jSuWkR6cCn4iVsoG+ZtTcemPC2yeG2/ShAr+trPC7Li7y6zk42bQgeUb2
+/ndJ5p5MfUoGTyZRRmsb4Gw/z540ZI6S9oLn45w66vRDVQ+FWFws23xdvJ19Q1tMzXgzJvsxZc7
z2GNqWt+Xysa5CWNEQk=
DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=smtp; d=doctor.nl2k.ab.ca;
b=Y33tym69sct4MkmWbO5EcAGZnR4OFpFwZimyoZhBT5pvl3YHXadxkwbIkYeqCkorKwit1u8dvbga
in6b6D2KToOMqRDhq3/riRYXH5hVtc8QnutTwUqzvgehFg847R1ASafe2n+VXeNaQnvo9/LWhCGj
9F3twUlJFjku855Teg0=;
Date: 10-25-2026
From: McAfee Protection
To: dave@doctor.nl2k.ab.ca
Cc: dave@doctor.nl2k.ab.ca
Subject: Your antivirus protection has expired!
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
X-Spam_score: 14.9
X-Spam_score_int: 149
X-Spam_bar: ++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: McAfee Subscription Expired McAfeeâ„¢
Content analysis details: (14.9 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.1 MISSING_MID Missing Message-Id: header
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[130.49.219.81 listed in will-spam-for-food.eu.org]
[130.49.219.81 listed in will-spam-for-food.eu.org]
[130.49.219.81 listed in will-spam-for-food.eu.org]
[130.49.219.81 listed in will-spam-for-food.eu.org]
[130.49.219.81 listed in will-spam-for-food.eu.org]
[130.49.219.81 listed in will-spam-for-food.eu.org]
[130.49.219.81 listed in will-spam-for-food.eu.org]
[130.49.219.81 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[130.49.219.81 listed in dnsbl.ahbl.org]
[130.49.219.81 listed in dnsbl.ahbl.org]
[130.49.219.81 listed in dnsbl.ahbl.org]
[130.49.219.81 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[130.49.219.81 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[130.49.219.81 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[130.49.219.81 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[130.49.219.81 listed in dnsbl.ahbl.org]
1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist
[URI: keymart.net]
1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist
[URI: keymart.net]
2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist
[URI: keymart.net]
0.6 INVALID_DATE_TZ_ABSURD Invalid Date: header (timezone does not exist)
1.4 BUG6152_INVALID_DATE_TZ_ABSURD No description available.
0.4 INVALID_DATE Invalid Date: header (not RFC 2822)
1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist
[URI: keymart.net]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[130.49.219.81 listed in bl.score.senderscore.com]
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
1.3 RDNS_NONE Delivered to internal network by a host with no rDNS
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.0 TO_EQ_FM_HTML_DIRECT To == From and HTML only, direct-to-MX
0.4 TO_EQ_FM_DIRECT_MX To == From and direct-to-MX
Subject: {SPAM?} Your antivirus protection has expired!
X-Antivirus: AVG (VPS 261024-6, 10/24/2026), Inbound message
X-Antivirus-Status: Clean
McAfeeâ„¢
Together is power.
Your McAfee subscription expired on Oct 20, 2026.
After the expiry date Your Device will become susceptible to many different virus threats.
Your Device might be unprotected, it can be exposed to viruses and other malware...
You are eligible for discount: 62% 1yr Renewal Discount
Offer will expire at: 10-27-2026 23:59
