SUSPECTED SCAM!

Phishing
packagetracking@v29-05.firebaseapp.com

Date12/18/2025
Fraudulent emailpackagetracking@v29-05.firebaseapp.com
Scam contentsReceived: from 10.197.36.75
by atlas112.free.mail.bf1.yahoo.com pod-id NONE with HTTPS; Wed, 17 Dec 2025 09:38:33 +0000
Return-Path:
X-Originating-Ip: [209.85.217.72]
Received-SPF: pass (domain of v29-05.firebaseapp.com designates 209.85.217.72 as permitted sender)
Authentication-Results: atlas112.free.mail.bf1.yahoo.com;
dkim=pass header.i=@firebaseapp.com header.s=20230601 arc_overridden_status=NOT_OVERRIDDEN;
spf=pass smtp.mailfrom=v29-05.firebaseapp.com arc_overridden_status=NOT_OVERRIDDEN;
dmarc=unknown header.from=v29-05.firebaseapp.com arc_overridden_status=NOT_OVERRIDDEN;
X-Apparently-To: @yahoo.com; Wed, 17 Dec 2025 09:38:33 +0000
X-YMailISG: B8g_ui8WLDuueufFIUCF7SkvKD_XXTawCWLQ4WxX942SDbTB
38XiVR2YSyTsEHBl3IiLGziDctEEtEW0dGqOblCsOwKUtYGUD3me1m4kNbcK
cJA8rmuWcj.c5S.C7Mr7_HqqgV_VO.2cUoGb6Yt6hjyCV9D3AWhBgqT16eu.
j0v13m6JUxYsUpBQpRkRMUNZDDYCw_fW5f1jSXwF2ZDXcl1t0tgpk.EhppPE
DEdamEM7TB0CrrfwinxvzQcvYs3ODiu4Mq4qKyrBB3dDkJZc92fH4l2D6.ge
VoeSGw6Y.d5rsJvVjCfxm9_a9uN2eVqiqr9qj5bzDvTDeRX6AmGnGjM6jYzP
CyoavnVH7WbcJ1egUWjnSL7HYE7aqDTtX_b1x8Y_fCgnIsePFQE3yY5SzsO0
s14rewp_20WuWK6eRUCLOMXLiJIAkeNi5knfmMRQXGwnCZ5BgxdjWLejDHdw
0w086BcmrMbceyLdvt3WJZJWvkZST1ZMVKfPMbbXT6ktx98zhHPmlrwI4hf_
fackVJjpTpde0tLTvCxEXCiyDoFlTH1GZ0VMzhiY7Kk.riHG0KLFAu8Z2LsI
7eFsJIYNIt8nvhyIQWy5SPsnYHxLQrUnX_Co7ltaP_QOPD6xeELqYKywMJhX
pEIbQY3aiKRD73TecUjahieCtWxc45lKU3o0HgaISSNdgKSC1LuT5TWT1sI_
CuIU0Q_fObFA2CcUVSG6b5.fkQD48djabruTm98js0pOKxlRkYlnlpSfUsdC
F8GNmwFKpctR..7q8DtbsgA3XcsCIdiAqmoczVuQSSuusykiZXjDKsNLLzMV
qF3vWDurBGPtlu_kCri4CTQg1CdSLpGIT3TOnRMHv1CjuHHzTFo5hi4OHHKL
tb8PVB9brW4Lta8VmumpacDOqpRE5RR8BpTvzyUjUcbWldGCazABMMywbjgt
E3s6SJxHhH3m4pbHzmzQK_JPyJ92qG5bp629otmuUT__IxLgZy2WFlnKOPTu
rund3kFbfpV5o_eWse9MWPxdGPhAHPcwi.Pr5dLBOLG_Co0mo_gJfO8hdwvl
dex8sl8raBMxMRCeTgdWEuPzdlgNl33J1q3f6nVh0j63obiSBjqUVrNsjfTA
XwmpNIwi6cPO0ir40XApKvgizgujaPAEsLiQkczOQuZb17qW4F1QqWreAtjb
yKHpbJYzAZmcmKfc8C74Kt.Pe3bZX7Os
Received: from 209.85.217.72 (EHLO mail-vs1-f72.google.com)
by 10.197.36.75 with SMTPs
(version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256);
Wed, 17 Dec 2025 09:38:33 +0000
Received: by mail-vs1-f72.google.com with SMTP id ada2fe7eead31-5e5632c20easo3939443137.2
for <@yahoo.com>; Wed, 17 Dec 2025 01:38:33 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=firebaseapp.com; s=20230601; t=1765964312; x=1766569112; darn=yahoo.com;
h=to:from:subject:date:message-id:mime-version:from:to:cc:subject
:date:message-id:reply-to;
bh=QgXQh+EYJ2hR0nrDY3omOt7fW6nyu9L1ZMiCG1wF9B8=;
b=VLj7BuhFox+qm4SkQsDGyXkoGDpXaS/VZGZtHVYIJdMwIwbzJxtbQWjVsV8D+KuGPF
/QWL4RyvshN4ZELDdjsMDZQOR2MUaaDuXs+utzogP0iePnFoK5CQXFTYKxZhWFuX4X4d
XtLrsxqXAExRF73/59jCROvexrjYvKWVAJxi8QIHCjFiFfKcAi5soqImuPrnrVx2gW0b
yehyj0BHKeDcN8CxsLIvuUkCnLxI1gUGN/f7VkeEGBjkvKJc+nQPygujG4k0LnYydhyb
zV2ddAViyMt9NK2/POi/l1QFaVt7OSWi9FrARgDqz3KWUKkLevgvk5nVIwy9KfvUMFQV
92KA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20230601; t=1765964312; x=1766569112;
h=to:from:subject:date:message-id:mime-version:x-gm-message-state
:from:to:cc:subject:date:message-id:reply-to;
bh=QgXQh+EYJ2hR0nrDY3omOt7fW6nyu9L1ZMiCG1wF9B8=;
b=quKJ5JbMsNkmYwcFSd4Adpbhuo9CKh+t+vF3noCsLk0MGdzhBPZ6iz2huHNEGfdBi7
3xPVt85C0JGAcnO+0aoL6UEAYF/kl7vpdORC9U79Ow+vFavspP3ETW/Jqf4kHocV0Js2
Myx0t4D9h+viLvAWe4FrnAInX505mdBLzejBv4nSC9hwhWOZy0kDaLhdiJAX/6kcgiQz
xgfF/Yek6en3C7K4IyiR7cAxjZL5H7Sk55dE0S9latXPPOF+LuSh6DawP/5Pr1a1oOmG
WS3ZwbU72Ul3y76JyZjSveSAatT+03xrK2cI8y9IvWG8cfSGit6RYHcMyakGkk3+3XFf
2yWw==
X-Gm-Message-State: AOJu0YzuE4R/ANknPTdSLls3Z30/1Y1v3Lwt36kaQxaePP6t1w+gWJ7O
R8/xT7tcPGixSghh40/8cWhx5IpcZJGvePDWfp58bMtae4ZA8OmHvWrZ81t0w5xmrZOn5aLdnMH
mwJyFh2Ejrg==
X-Google-Smtp-Source: AGHT+IFLYe+3Uiwg646/hIJFF/8Qd4rFpyyngAiK/8nrLQmXV6eCQGfxYKzqbphFtFWkbUKF7ZOLdzrmIZ23/SI=
MIME-Version: 1.0
X-Received: by 2002:a05:6102:644d:b0:5dd:b288:61af with SMTP id
ada2fe7eead31-5e82729e0dfmr5025577137.0.1765964312812; Wed, 17 Dec 2025
01:38:32 -0800 (PST)
Message-ID: <0000000000008d1d4e0646229b0b@google.com>
Date: Wed, 17 Dec 2025 09:38:32 +0000
Subject: =?UTF-8?B?8J+TpiBEZWxpdmVyeSBEZXRhaWxz?=
From: Package Tracking
To: @yahoo.com
Content-Type: multipart/alternative; boundary="0000000000008d1d3d0646229b08"
Content-Length: 4997

--0000000000008d1d3d0646229b08
Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes
Content-Transfer-Encoding: base64

WW91ciBPcmRlciBpcyBvbiB0aGUgTW92ZSEg8J+amg0KDQoNCkhlbGxvIHBvaWJhYnkyQHlhaG9v
LmNvbSwNCg0KV2UndmUgZ290IGdyZWF0IG5ld3Mg4oCUIHlvdXIgb3JkZXIgaGFzIHNoaXBwZWQg
YW5kIGlzIG9uIGl0cyB3YXkgdG8geW91IQ0KDQpDbGljayBiZWxvdyB0byBmb2xsb3cgeW91ciBw
YWNrYWdlIGluIHJlYWwtdGltZToNCg0KVHJhY2sgTXkgT3JkZXIg4p6h77iPDQoNCg0KT3JkZXIg
TnVtYmVyOiBDbGljayB0byB2aWV3DQoNCkVzdGltYXRlZCBEZWxpdmVyeSBEYXRlOiBDbGljayB0
byB2aWV3DQoNCg0KUXVlc3Rpb25zIG9yIG5lZWQgaGVscD8gT3VyIHN1cHBvcnQgdGVhbSBpcyBo
ZXJlIDI0LzcuIENvbnRhY3QgdXMuDQoNCg0KVGhhbmtzIGZvciBzaG9wcGluZyB3aXRoIHVzLiBX
ZSBob3BlIHlvdSBsb3ZlIHlvdXIgcHVyY2hhc2UhDQoNCg0K
--0000000000008d1d3d0646229b08
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Track You.r Order

body {
margin: 0;
padding: 0;
background-color: #f4f4f7;
font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;
color: #333;
}
.email-wrapper {
max-width: 600px;
margin: 30px auto;
background-color: #ffffff;
border-radius: 12px;
box-shadow: 0 2px 8px rgba(0,0,0,0.05);
overflow: hidden;
}
.email-header {
background-color: #343a40;
color: #ffffff;
text-align: center;
padding: 30px 20px;
}
.email-header h1 {
margin: 0;
font-size: 26px;
font-weight: normal;
}
.email-body {
padding: 25px 30px;
font-size: 16px;
line-height: 1.6;
}
.email-body p {
margin: 0 0 15px;
}
.cta-button {
display: inline-block;
background-color: #28a745;
color: #ffffff !important;
padding: 14px 28px;
border-radius: 6px;
font-weight: bold;
font-size: 16px;
text-decoration: none;
margin: 20px 0;
}
.info-box {
background-color: #f8f9fa;
padding: 20px;
border-radius: 8px;
margin: 20px 0;
border: 1px solid #e2e6ea;
}
.info-box p {
margin: 10px 0;
}
.info-box a {
color: #007bff;
text-decoration: none;
}
.email-footer {
background-color: #f1f3f5;
padding: 15px 20px;
text-align: center;
font-size: 13px;
color: #666;
}
.email-footer p {
margin: 0;
}

Your Order is on the Move! =F0=9F=9A=9A

Hello @yahoo.com,
We=E2=80=99ve got great news =E2=80=94 your order has shipped and =
is on its way to you!
Click below to follow your package in real-time:

com&disp=3DconcealedF_viet29_17/12/2025 09:25:08_3630001&idc=3D1&am=
p;mode=3DresetPassword&oobCode=3DlGf67AMb2TDJ_NlOwHeFTcUEwQvY5RV0BX-YHw=
ch7k0AAAGbK6zwJA&apiKey=3DAIzaSyB5_6u7H4wWSfMWGlDAfwDjjzNbF8Ak0kI&l=
ang=3Den&tenantId=3Dtv29-05-04-mtyeu" class=3D"cta-button" target=3D"_b=
lank">Track My Order =E2=9E=A1=EF=B8=8F

Order Number: elp/ss.php?email=3D@yahoo.com&disp=3DconcealedF_viet29_17/12/20=
25 09:25:08_3630001&idc=3D1&mode=3DresetPassword&oobCode=3DlGf6=
7AMb2TDJ_NlOwHeFTcUEwQvY5RV0BX-YHwch7k0AAAGbK6zwJA&apiKey=3DAIzaSyB5_6u=
7H4wWSfMWGlDAfwDjjzNbF8Ak0kI&lang=3Den&tenantId=3Dtv29-05-04-mtyeu"=
target=3D"_blank">Click to view
Estimated Delivery Date: ine-check.help/ss.php?email=3D@yahoo.com&disp=3DconcealedF_viet=
29_17/12/2025 09:25:08_3630001&idc=3D1&mode=3DresetPassword&oob=
Code=3DlGf67AMb2TDJ_NlOwHeFTcUEwQvY5RV0BX-YHwch7k0AAAGbK6zwJA&apiKey=3D=
AIzaSyB5_6u7H4wWSfMWGlDAfwDjjzNbF8Ak0kI&lang=3Den&tenantId=3Dtv29-0=
5-04-mtyeu" target=3D"_blank">Click to view

Questions or need help? Our support team is here 24/7. https://online-check.help/ss.php?email=3D@yahoo.com&disp=3Dconc=
ealedF_viet29_17/12/2025 09:25:08_3630001&idc=3D1&mode=3DresetPassw=
ord&oobCode=3DlGf67AMb2TDJ_NlOwHeFTcUEwQvY5RV0BX-YHwch7k0AAAGbK6zwJA&am=
p;apiKey=3DAIzaSyB5_6u7H4wWSfMWGlDAfwDjjzNbF8Ak0kI&lang=3Den&tenant=
Id=3Dtv29-05-04-mtyeu">Contact us.

Thanks for shopping with us. We hope you love your purchase!

--0000000000008d1d3d0646229b08--
Comment / ReviewEmail header of a 'Package Tracking' phishing email

Related search(es)
Premium services