| Scam contents | Email header of a Package Tracking spoof/phishing email:
Received: from 10.217.135.108
by atlas215.free.mail.ne1.yahoo.com pod-id NONE with HTTPS; Sun, 1 Feb 2026 17:46:15 +0000
Return-Path:
X-Originating-Ip: [209.85.222.69]
Received-SPF: pass (domain of v44-03.firebaseapp.com designates 209.85.222.69 as permitted sender)
Authentication-Results: mta.yahoo.com;
dkim=pass header.i=@firebaseapp.com header.s=20230601 arc_overridden_status=NOT_OVERRIDDEN;
spf=pass smtp.mailfrom=v44-03.firebaseapp.com arc_overridden_status=NOT_OVERRIDDEN;
dmarc=unknown header.from=v44-03.firebaseapp.com arc_overridden_status=NOT_OVERRIDDEN;
X-Apparently-To: @yahoo.com; Sun, 1 Feb 2026 17:46:15 +0000
X-YMailISG: wzqytwYWLDuEqKOt4eq9FfZvWrwosZ4OVDKZssgzealFMgeR
7w7jozZwS.kI7tAse2kXK475l9zGCiIwtIEWUgL3LtxO5gVXxmMcAHcOSwRz
UtIcXdBPJ5JLUGqNbwxBDG3fOSI9LMUfW0vfc_Tg6_f7bIFhXjCS4v6t01hi
PfV1z.5Lg.GaL11kxE87Otu7tWYc1LvCjlUvWaKqnub2tZMQ3AQPKuOxU1fD
Tmh1t1K6OilqLqST3uPxy54ho8d0A.CfSiOfaqG2CYvCF4HUdBMJECZswKo6
4EwpCr_QeLrTDk6soim9UJluvcfgl3ulztIj5Oz3wcNi2F2E5T.BUV79K9bp
cdPpuQpBl2xV_pq6q4N1DANUJD7y7h2C.WO4Zea9PWP7VvVqDFa4DxarJVHw
O3puKZMogN9lf7UlEP2yKtD_cpAWWgKRrDZVAjljldRls_JbM2GJnBm_IlZY
bCfwkwGHj7vl.PPq7wsiy.ZKOaA6CSFZDHOXDnd.IVynN6XW7AhWLSx3btW9
nwNfNI3nySwDQJh3YyEqXwJoBltXdzwJZLgTbVCvndD2vgVbemThVDw1UKE9
3wzd5RDX1TlM_Ti3kbpRg8c9BMWA.4Eump0Lc1pSpHcwurC95fhikU7Jj5KB
DNrSoIdNXuIuoEWVQv5ApjjJUn8dGpe25LQFKV8mEwqgLQ4I1Fdc28MrlAB6
vBp943YtEPHUjVg42D30rnQ1WO2dGk4ThNt7RSYmOn7wM2cHWbOT1e0MDaNt
b4CUzhHv7mk1B2c9EO.JpTs03bRlAjR7TU8iqj.EGSDF9tflJrLgG0Z.7sKZ
mUTUbhwEbOPUHccxm5fXDDVfZFiRJUJYm8yqSiozYIZW9T9WIm6bgqiMHQsT
MaeXkbcZeu..2leOkkdEfKHKnjuDdcoFjsKVzyOmV3uVGBfbT72d3.ZrN5h3
QHfjnRnDn6qEGINvPzHvTrX0ilaHW7NDGxEKop17VITqnvrX1WHHgsmZsSYw
hTZEoY7FcrRdEgAU7Ihlmj0zpDLBZrFQqFCDCBK9yKcTFiNyahKAy_DNb2xO
x.rPuuJS7m6NjykIvFejAh5LF9wZGZIZ3pwnEgYyiCTqG_75.hJITjkls5Hx
nS8DV23aN9ua9djLgqig8.emoAlmbvt4aAancp.MCVWAyyMYCSYrwyWFtO0g
0B9c6.s2hNbFyV_By5cO1bxhIX1HVlMNk8A_
Received: from 209.85.222.69 (EHLO mail-ua1-f69.google.com)
by 10.217.135.108 with SMTPs
(version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256);
Sun, 01 Feb 2026 17:46:15 +0000
Received: by mail-ua1-f69.google.com with SMTP id a1e0cc1a2514c-9489e51a487so3114024241.1
for <@yahoo.com>; Sun, 01 Feb 2026 09:46:15 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=firebaseapp.com; s=20230601; t=1769967974; x=1770572774; darn=yahoo.com;
h=to:from:subject:date:message-id:mime-version:from:to:cc:subject
:date:message-id:reply-to;
bh=XB9PFXoboGpmrq2Gqhi96h7Oy0/ivdl/n5LodplqX38=;
b=E70efHTKVUD/5a5VQPQ+cDV9CYol72jytZ4Y7NDlO3HUEEHRkPhRd4mVViM5vcgf/N
6hyaPQe6s+gnrw/RUG+QDG9Q3Q253Q/XHGn38JDQdFAGuIwr/CCTGlIgliV0B4aoVTTm
0X2o/KcbbCOOdbSRIRc5/j7ws+TrPrVDUYEM0LsBSSxzgumb0S/OBJYL8O63gWwNUiD5
CjL8Jcsz5eJFco8XCFVUiDNPeDNC9hWtcqQmoV7wbVQgZ5ejBN66F3KdlHIp/yTkJjP+
6jTnDqWbDu3uUF9OWY98Q8HgM3KKZC1d6wTMoc2aDRK2Kwi/kSKrr0DAt8zQAwIghkU4
P8/g==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20230601; t=1769967974; x=1770572774;
h=to:from:subject:date:message-id:mime-version:x-gm-message-state
:from:to:cc:subject:date:message-id:reply-to;
bh=XB9PFXoboGpmrq2Gqhi96h7Oy0/ivdl/n5LodplqX38=;
b=daN1dzlaJVG6flOgMEG0fnKZnO89mVqiFcOzQgxRf4FancIs+0BpMK784QWEeJBwzN
xc6rQ3bXPZIVne6ziki6z2FFiaQb9MNYdpiH/6Lg0mw9ujJQCSFH9DJjdRUGIm0JEc7c
9P+hxdnEJyhh/6f5hda5AvQyNiKEHggSBp0/Z04hC/rplpJv77KLC7GXO93rxNS6xhGq
781E81IKvodNfcqcsTBtSfTVFs0h0L3bFLleXLnnnMHeFXEn7uT6xX1Ni+G3FNSEDd5S
JUhsarKznWCof69aw5TmdD2cglYfI+8Y09nOUdjpC5EQ1qE4WQW/BmwMrxCzBQNB9dZW
uJwA==
X-Gm-Message-State: AOJu0YxcPjXM3t0VP4b2C/qCpkFUP4er83ootypQGC1dC9Xc5hGPBwN/
LQ0koGx1vChgMphjG7UHW1X5basdmBqFSfXLhBmscTQF0ZjpN60i0qC04B/Qriax6QC2gSBzvM6
wxs0J8lthkg==
MIME-Version: 1.0
X-Received: by 2002:a05:6102:b0d:b0:5f8:d1bb:128 with SMTP id
ada2fe7eead31-5f8e255abe9mr2856562137.27.1769967974756; Sun, 01 Feb 2026
09:46:14 -0800 (PST)
Message-ID: <0000000000006633d90649c6c8b6@google.com>
Date: Sun, 01 Feb 2026 17:46:14 +0000
Subject: =?UTF-8?B?8J+TpiBEZWxpdmVyeSBEZXRhaWxz?=
From: Package Tracking
To: @yahoo.com
Content-Type: multipart/alternative; boundary="0000000000006633c80649c6c8b3"
Content-Length: 5049
--0000000000006633c80649c6c8b3
Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes
Content-Transfer-Encoding: base64
WW91ciBPcmRlciBpcyBvbiB0aGUgTW92ZSEg8J+amg0KDQoNCkhlbGxvIHBvaWJhYnkyQHlhaG9v
LmNvbSwNCg0KV2UndmUgZ290IGdyZWF0IG5ld3Mg4oCUIHlvdXIgb3JkZXIgaGFzIHNoaXBwZWQg
YW5kIGlzIG9uIGl0cyB3YXkgdG8geW91IQ0KDQpDbGljayBiZWxvdyB0byBmb2xsb3cgeW91ciBw
YWNrYWdlIGluIHJlYWwtdGltZToNCg0KVHJhY2sgTXkgT3JkZXIg4p6h77iPDQoNCg0KT3JkZXIg
TnVtYmVyOiBDbGljayB0byB2aWV3DQoNCkVzdGltYXRlZCBEZWxpdmVyeSBEYXRlOiBDbGljayB0
byB2aWV3DQoNCg0KUXVlc3Rpb25zIG9yIG5lZWQgaGVscD8gT3VyIHN1cHBvcnQgdGVhbSBpcyBo
ZXJlIDI0LzcuIENvbnRhY3QgdXMuDQoNCg0KVGhhbmtzIGZvciBzaG9wcGluZyB3aXRoIHVzLiBX
ZSBob3BlIHlvdSBsb3ZlIHlvdXIgcHVyY2hhc2UhDQoNCg0K
--0000000000006633c80649c6c8b3
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Track You.r Order
body {
margin: 0;
padding: 0;
background-color: #f4f4f7;
font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;
color: #333;
}
.email-wrapper {
max-width: 600px;
margin: 30px auto;
background-color: #ffffff;
border-radius: 12px;
box-shadow: 0 2px 8px rgba(0,0,0,0.05);
overflow: hidden;
}
.email-header {
background-color: #343a40;
color: #ffffff;
text-align: center;
padding: 30px 20px;
}
.email-header h1 {
margin: 0;
font-size: 26px;
font-weight: normal;
}
.email-body {
padding: 25px 30px;
font-size: 16px;
line-height: 1.6;
}
.email-body p {
margin: 0 0 15px;
}
.cta-button {
display: inline-block;
background-color: #28a745;
color: #ffffff !important;
padding: 14px 28px;
border-radius: 6px;
font-weight: bold;
font-size: 16px;
text-decoration: none;
margin: 20px 0;
}
.info-box {
background-color: #f8f9fa;
padding: 20px;
border-radius: 8px;
margin: 20px 0;
border: 1px solid #e2e6ea;
}
.info-box p {
margin: 10px 0;
}
.info-box a {
color: #007bff;
text-decoration: none;
}
.email-footer {
background-color: #f1f3f5;
padding: 15px 20px;
text-align: center;
font-size: 13px;
color: #666;
}
.email-footer p {
margin: 0;
}
Your Order is on the Move! =F0=9F=9A=9A
Hello @yahoo.com,
We=E2=80=99ve got great news =E2=80=94 your order has shipped and =
is on its way to you!
Click below to follow your package in real-time:
_viet44_01/02/2026 18:11:06_240001_243220&email=3D@yahoo.com&am=
p;idc=3D1&?mode=3DresetPassword&oobCode=3DHkecHxKPfSSWsMe9fWPevYa-q=
W-Turol4kRJsT6NIAEAAAGcGk_4dQ&apiKey=3DAIzaSyC53zRZe104MNpYLthdatu7atnN=
dpWqR10&lang=3Den&tenantId=3Dtv44-03-05-xjonk" class=3D"cta-button"=
target=3D"_blank">Track My Order =E2=9E=A1=EF=B8=8F
Order Number:
ge.shop/tt01d243220.php?disp=3D01d_viet44_01/02/2026 18:11:06_240001_243220=
&email=3D@yahoo.com&idc=3D1&?mode=3DresetPassword&o=
obCode=3DHkecHxKPfSSWsMe9fWPevYa-qW-Turol4kRJsT6NIAEAAAGcGk_4dQ&apiKey=
=3DAIzaSyC53zRZe104MNpYLthdatu7atnNdpWqR10&lang=3Den&tenantId=3Dtv4=
4-03-05-xjonk" target=3D"_blank">Click to view
Estimated Delivery Date:
lyser-package.shop/tt01d243220.php?disp=3D01d_viet44_01/02/2026 18:11:06_24=
0001_243220&email=3D@yahoo.com&idc=3D1&?mode=3DresetPas=
sword&oobCode=3DHkecHxKPfSSWsMe9fWPevYa-qW-Turol4kRJsT6NIAEAAAGcGk_4dQ&=
amp;apiKey=3DAIzaSyC53zRZe104MNpYLthdatu7atnNdpWqR10&lang=3Den&tena=
ntId=3Dtv44-03-05-xjonk" target=3D"_blank">Click to view
Questions or need help? Our support team is here 24/7.
https://analyser-package.shop/tt01d243220.php?disp=3D01d_viet44_01/02/2026 =
18:11:06_240001_243220&email=3D@yahoo.com&idc=3D1&?mode=
=3DresetPassword&oobCode=3DHkecHxKPfSSWsMe9fWPevYa-qW-Turol4kRJsT6NIAEA=
AAGcGk_4dQ&apiKey=3DAIzaSyC53zRZe104MNpYLthdatu7atnNdpWqR10&lang=3D=
en&tenantId=3Dtv44-03-05-xjonk">Contact us.
Thanks for shopping with us. We hope you love your purchase!
--0000000000006633c80649c6c8b3-- |