SUSPECTED SCAM!

Phishing
packagetracking@v40-03.firebaseapp.com

Date01/19/2026
Fraudulent emailpackagetracking@v40-03.firebaseapp.com
Scam contentsReceived: from 127.0.0.1
by atlas-production.v2-mail-prod1-gq1.omega.yahoo.com pod-id atlas--production-gq1-7cfc79d6f-gxc5x.gq1.yahoo.com with HTTP; Mon, 19 Jan 2026 01:54:33 +0000
Return-Path:
X-Originating-Ip: [209.85.222.72]
Received-SPF: pass (domain of v40-03.firebaseapp.com designates 209.85.222.72 as permitted sender)
Authentication-Results: atlas-production.v2-mail-prod1-gq1.omega.yahoo.com;
dkim=pass header.i=@firebaseapp.com header.s=20230601 arc_overridden_status=NOT_OVERRIDDEN;
spf=pass smtp.mailfrom=v40-03.firebaseapp.com arc_overridden_status=NOT_OVERRIDDEN;
dmarc=unknown header.from=v40-03.firebaseapp.com arc_overridden_status=NOT_OVERRIDDEN;
X-Apparently-To: @yahoo.com; Mon, 19 Jan 2026 01:54:34 +0000
X-YMailISG: aQISVAUWLDta5j1Punl6urgqDqFEx5XZ6NZD51qxP1L1XaIn
Xtb0qyCNTIneNgmshelddY68d6vceMTCPaoJ_nH5Z9X7Av.5OSlKE_bGwLx_
lx.d37yfVoKujfFyd0wvgi8NWG80oYrheqsX2Cv.P.Q_xMJaDl92g7NFcAwg
336wGkIqw8yrk5IBcfgg6BQre1g8eTUvMEpSx5XfhqNziwGE0ARIAdMIpt93
s0J_qJSsDIBReYo_4FLhmTF8h6H1GSefAgR15g1S1XZoFq.fVI9IBm5AN8ty
eWaea00IaFZmS9d9Bm97LiudjK4rb6wMnnIKAumclBkq4AwcVLFCUuDsVNPn
CXOSBsaIyreI9X6RADH9LmtOZOxex97KmSkFQZEW3Q8DOgOPn_bW8QLlgLHw
I11Fu3iJKbJBoRfSfoazC4r_FzJFt9ptCHA0qfcrLXvaVTinkkVrdj2bmlyD
BYIinuKX.IFnwuwj_sD9.WK.b.JqPBuA82HreNRpT22TkHxs8ypzULJnUdyP
vrR1XrFxsYRQ.9kadoyOeHSIVpu4H9Y4HAGVg_M9QvKwzH38v0Z_GGMWMmGC
PYEzixi18KUWrJTPL8mXxxKGlN4ecqqFNskadr1rjTi1HiXtO.k1biM90H7E
FrdfqfJ342g1qL_sY3AsyECozrGk94_IGLtqKwBztXW.6dJ4qoF5LnSL8hz_
CaEUrxh23UqlwvhpDM96aEPODTz0kvfEpoPVDOQg.ysmSH6HOfbO0ek83nnX
3k5Wj2Rs807_1BliwiX6.dOBbHwe5s4k2M2oPeS7S4dEfVSRU_p77VZwQpnA
xPOrpdWCYC01OKZz0qR8kN4DXpciXuCd_5pNI.uFznDGxonXhg7n_84arQ4o
.KTeA3iFJSLg4YtcgoUbn5xiH7DR1Y6eY0cafWI06Ne39P77vVx_iaobSAeT
JlgqfIteZZOVglAwViVeEkxhgFqmoAvSpgKaZc2kLIKBpqMyDlHU4At8f862
AFqeJ3i_JH3RjWf7fceIZmUnBqdOvYB9VDNqzzfNuwudCbNX3O1aJ.Cd3o5W
McNyvDnZ1vFZf8V.iL179EfluWCwKLsA4sdQfhc3RQDwGsr_fwFrSX384tFb
zcoiR8H8X6IBC_4n0GptK7Lh1H3y2afFFcA_ZtSX24NtPKZ4aZyoks_3tHX6
cgvOjckPS0l0Snc6yE2yGXDfi6u_GZy2h0xj1JIlHHflSReYJtgrfC9i
Received: from 209.85.222.72 (EHLO mail-ua1-f72.google.com)
by 10.253.35.48 with SMTPs
(version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256);
Mon, 19 Jan 2026 01:54:33 +0000
Received: by mail-ua1-f72.google.com with SMTP id a1e0cc1a2514c-93f5d18f105so5412002241.0
for <@yahoo.com>; Sun, 18 Jan 2026 17:54:33 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=firebaseapp.com; s=20230601; t=1768787673; x=1769392473; darn=yahoo.com;
h=to:from:subject:date:message-id:mime-version:from:to:cc:subject
:date:message-id:reply-to;
bh=JxABenBXYzZd3xdthpqmcI1kZMHWMmakxVjwJXqkZhs=;
b=hEw/uuQ5/9hFQt+7ALzUTOBD3D+uTif0MUmCY2wxcLAcdU1RhlFJfaqSpXhPCWeNFF
oUrZHa6v8fVq3uAw0y4ygX0qUCb3A6XqrEqk9sO/SFnNDOe8+dY6NJApjAgmhecvPVPJ
aeKS8JB/Vr2dlSnptoI4BLOAdqMq3UaDek7w5tUp2mzhSMv7AicEYM4q1pqC5dONGK6J
o6dCxvUHpkTVWfy0Q1b+kTYFJ580OsbaaGpyDlGw4WL/il3XVKKEdQV7dL95LKDOS6Dq
Pl5tbpfnHxs+BXhFAhto/H4rltVmlwV9XY9VYxhXNxWWagfoKVwnBnNH/vyn0dk5198X
ZPMA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20230601; t=1768787673; x=1769392473;
h=to:from:subject:date:message-id:mime-version:x-gm-message-state
:from:to:cc:subject:date:message-id:reply-to;
bh=JxABenBXYzZd3xdthpqmcI1kZMHWMmakxVjwJXqkZhs=;
b=LIzsG6rmN6RrMUlIWPdpgQq8YQZfRiBbZNt2Jbt21c8crpSO0Xkghjnlr1tIj10bll
y7NAylEWkBUOF5ynNADxJQ4lcyetUJzbUFROYoMZUAyGOWVezg3Fu1hdO/Zta8/slgK6
GHGBM1awNKT1Yk1xWLGmTq8OQ8zNjGjK1Cqhqcf3flKG5/yG7gHPcIn476vhDUGi9qu2
hg5VONhMxNg5/2tPwObS/SjLvudwy2VuY9Reo6cybgB3VL3oeHSQOxzThs86/vlvjJ56
f1GBrGR8mTaak1mgW2Qy0AFL6BoKQr9vXRUAZxtPfKLaIENks63HGwnwA+FGuzviHYpf
DQOA==
X-Gm-Message-State: AOJu0YxUDBDBtWcUgl3WG2iTESvEhzIesXl6N/5ZI3iYJtS6heTgbtFQ
j5Dj59wSqRYJc+L1vZStHTCydFywjgQZbogtxzx4tFsYXT57PMn1hk3qvwP86nhjE+Y4jqMBj2k
j+3790qgtbA==
MIME-Version: 1.0
X-Received: by 2002:a05:6102:8191:20b0:5ef:a78d:8095 with SMTP id
ada2fe7eead31-5f1a7131e50mr1799423137.26.1768787672970; Sun, 18 Jan 2026
17:54:32 -0800 (PST)
Message-ID: <000000000000ee34ac0648b3f848@google.com>
Date: Mon, 19 Jan 2026 01:54:32 +0000
Subject: =?UTF-8?B?8J+amiBEZWxpdmVyeSBEZXRhaWxz?=
From: Package Tracking
To: @yahoo.com
Content-Type: multipart/alternative; boundary="000000000000ee34a00648b3f845"
Content-Length: 5045

--000000000000ee34a00648b3f845
Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes
Content-Transfer-Encoding: base64

WW91ciBPcmRlciBpcyBvbiB0aGUgTW92ZSEg8J+amg0KDQoNCkhlbGxvIHBvaWJhYnkyQHlhaG9v
LmNvbSwNCg0KV2UndmUgZ290IGdyZWF0IG5ld3Mg4oCUIHlvdXIgb3JkZXIgaGFzIHNoaXBwZWQg
YW5kIGlzIG9uIGl0cyB3YXkgdG8geW91IQ0KDQpDbGljayBiZWxvdyB0byBmb2xsb3cgeW91ciBw
YWNrYWdlIGluIHJlYWwtdGltZToNCg0KVHJhY2sgTXkgT3JkZXIg4p6h77iPDQoNCg0KT3JkZXIg
TnVtYmVyOiBDbGljayB0byB2aWV3DQoNCkVzdGltYXRlZCBEZWxpdmVyeSBEYXRlOiBDbGljayB0
byB2aWV3DQoNCg0KUXVlc3Rpb25zIG9yIG5lZWQgaGVscD8gT3VyIHN1cHBvcnQgdGVhbSBpcyBo
ZXJlIDI0LzcuIENvbnRhY3QgdXMuDQoNCg0KVGhhbmtzIGZvciBzaG9wcGluZyB3aXRoIHVzLiBX
ZSBob3BlIHlvdSBsb3ZlIHlvdXIgcHVyY2hhc2UhDQoNCg0K
--000000000000ee34a00648b3f845
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Track You.r Order

body {
margin: 0;
padding: 0;
background-color: #f4f4f7;
font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;
color: #333;
}
.email-wrapper {
max-width: 600px;
margin: 30px auto;
background-color: #ffffff;
border-radius: 12px;
box-shadow: 0 2px 8px rgba(0,0,0,0.05);
overflow: hidden;
}
.email-header {
background-color: #343a40;
color: #ffffff;
text-align: center;
padding: 30px 20px;
}
.email-header h1 {
margin: 0;
font-size: 26px;
font-weight: normal;
}
.email-body {
padding: 25px 30px;
font-size: 16px;
line-height: 1.6;
}
.email-body p {
margin: 0 0 15px;
}
.cta-button {
display: inline-block;
background-color: #28a745;
color: #ffffff !important;
padding: 14px 28px;
border-radius: 6px;
font-weight: bold;
font-size: 16px;
text-decoration: none;
margin: 20px 0;
}
.info-box {
background-color: #f8f9fa;
padding: 20px;
border-radius: 8px;
margin: 20px 0;
border: 1px solid #e2e6ea;
}
.info-box p {
margin: 10px 0;
}
.info-box a {
color: #007bff;
text-decoration: none;
}
.email-footer {
background-color: #f1f3f5;
padding: 15px 20px;
text-align: center;
font-size: 13px;
color: #666;
}
.email-footer p {
margin: 0;
}

Your Order is on the Move! =F0=9F=9A=9A

Hello @yahoo.com,
We=E2=80=99ve got great news =E2=80=94 your order has shipped and =
is on its way to you!
Click below to follow your package in real-time:

viet40_19/01/2026 02:19:27_240001_243220&email=3D@yahoo.com&amp=
;idc=3D1&?mode=3DresetPassword&oobCode=3DDHz6f_dH0o-EjSFsFCzyWExq54=
trH0uAlC2M8wlfQdcAAAGb0_X-mg&apiKey=3DAIzaSyBrL8d8GGzpLkplZOA01IBWF5naH=
RMe0Zo&lang=3Den&tenantId=3Dtv40-03-05-jiqse" class=3D"cta-button" =
target=3D"_blank">Track My Order =E2=9E=A1=EF=B8=8F

Order Number: e.shop/tt01d243220.php?disp=3D01d_viet40_19/01/2026 02:19:27_240001_243220&=
amp;email=3D@yahoo.com&idc=3D1&?mode=3DresetPassword&oo=
bCode=3DDHz6f_dH0o-EjSFsFCzyWExq54trH0uAlC2M8wlfQdcAAAGb0_X-mg&apiKey=
=3DAIzaSyBrL8d8GGzpLkplZOA01IBWF5naHRMe0Zo&lang=3Den&tenantId=3Dtv4=
0-03-05-jiqse" target=3D"_blank">Click to view
Estimated Delivery Date: cels-analyze.shop/tt01d243220.php?disp=3D01d_viet40_19/01/2026 02:19:27_240=
001_243220&email=3D@yahoo.com&idc=3D1&?mode=3DresetPass=
word&oobCode=3DDHz6f_dH0o-EjSFsFCzyWExq54trH0uAlC2M8wlfQdcAAAGb0_X-mg&a=
mp;apiKey=3DAIzaSyBrL8d8GGzpLkplZOA01IBWF5naHRMe0Zo&lang=3Den&tenan=
tId=3Dtv40-03-05-jiqse" target=3D"_blank">Click to view

Questions or need help? Our support team is here 24/7. https://parcels-analyze.shop/tt01d243220.php?disp=3D01d_viet40_19/01/2026 0=
2:19:27_240001_243220&email=3D@yahoo.com&idc=3D1&?mode=
=3DresetPassword&oobCode=3DDHz6f_dH0o-EjSFsFCzyWExq54trH0uAlC2M8wlfQdcA=
AAGb0_X-mg&apiKey=3DAIzaSyBrL8d8GGzpLkplZOA01IBWF5naHRMe0Zo&lang=3D=
en&tenantId=3Dtv40-03-05-jiqse">Contact us.

Thanks for shopping with us. We hope you love your purchase!

--000000000000ee34a00648b3f845--
Comment / ReviewI am reporting a 'Package Tracking' phishing email

Related search(es)

  • Reviews and comments left by Internet users are sorted in chronological order and are not checked a priori

    • Joseph Public 01/19/2026 at 05:46 AM

      The sender is an old-style BOT and not the newer type AI chap?
      The Bot changes the lettering or numbers prior to the @ to bypass Gmail security
      Try *.* @ then the email
      This will block all emails from that domain "fraud or not" ;-)
      alternative reply sending the original changing to Abuse @ their domain
      It can bounce and they will get your email

      "So set up a temp email"
      Then delete that email

      Reply
      Leave a reply

  • Group created on - 0 Members

    To view the contents of this private group or request to join it, you must create an account or login.