The email header of the scam email is below:
Received: from 10.217.134.141
by atlas104.free.mail.ne1.yahoo.com pod-id NONE with HTTPS; Sat, 6 Dec 2025 03:05:08 +0000
Return-Path:
X-Originating-Ip: [209.85.221.198]
Received-SPF: pass (domain of v13-24.firebaseapp.com designates 209.85.221.198 as permitted sender)
Authentication-Results: atlas104.free.mail.ne1.yahoo.com;
dkim=pass header.i=@firebaseapp.com header.s=20230601 arc_overridden_status=NOT_OVERRIDDEN;
spf=pass smtp.mailfrom=v13-24.firebaseapp.com arc_overridden_status=NOT_OVERRIDDEN;
dmarc=unknown header.from=v13-24.firebaseapp.com arc_overridden_status=NOT_OVERRIDDEN;
X-Apparently-To: p2@yahoo.com; Sat, 6 Dec 2025 03:05:09 +0000
X-YMailISG: zDHbVEwWLDvLGo0OfHSzUgUKsiqDrQhuHpQCMKvNjYi8tZrC
xrERVSj4qe4I6kdN0.neIkSFK4baRGbzHIWIr2zW9cm6SFO51C2peVaJFFmm
hRqwuzrshe1I50lgolxZQDMYYv75fa2AFbC6Ok09J.O3RX6KLccys9HAcjvD
spEuG5F9_DnDQAcBsE8rFHyGnR7ICltAN6iGR3.sXUgCc96FhtgBvFWQrQyJ
1BdmwgMkcAJeaE3g6aFqInWI6pFIzrLcz4ZmjsUH5Q_nITEZ8_594puvTlF0
ozElXMZwPCO3F3mWLd5rItzi3GQPiJLsNJlayVq9xfI8iPfcJTOtuysKiNHD
KY6WwUq8KOWteAY0j9uH90bSbpaAs474hJDSg_0eNV9YGnTQrgSyr8aVIQ3r
6dbWCPQ0y36oSLeIM7hB3_YY44qZJg7ZMJppbg13jO51LIXW2y5qQakbN5Lg
YxDys4yeytFetUJJmmPonrJeSu0_JK6tWoTSfdg9Sra.W1g6tHd4HmKzHAHO
oKL3Qr6W1A68kRe7JExSxgGnzoKlF9_iy7QFSRo6gM16hZhAMu0pae8HuaeT
gk7zhV1cwsb5ZqoVSgJM5H4hxQVxZS2W6iGu49XV6kZbGM70EN0HS2x4d5Zl
uGAuBfwuKk7fcY8_QR3MVhi3OMKwwsYTa6AOAqLuUj0JBsmUYHtexmX3.5kQ
uEj5rfAgBTBW4s3NJYt0RRs8N3zoIu_lIDw0MM0XTxLDEReRPSm96Pdbs1Uu
wWU0AB6J2A56pHGBAD71iBaJtiU07xnvqJ8CGawZbMhLHQV4gySUwc5rLbgk
1zg3y4IA7gmxgBjVUE9OoUwpjbEvB.82yHtJ1VmVqHF1oJTN_EvrDBP26oeL
Ii5hZLEjzmpJnr1GD74N2.qkFW3JBknQSs0MAZNrpwtmTYPOU1bMDEnNu_2a
WbfQSMWT1k1RPFmnVQYKQ7HUHXpkCiudzXdGcITLt78LLIzdtBeCIDfMHdQr
nMe9YILf3kgScyqV3TzY5A7hWpFWDbmWfVi_uEA7Rbx8ry30mUzNTxRN03_r
YuUqn.r1oLJE.OGnqOkaO8.p4cF6CffTRqTBAA2Wo3YkQ.bBhhd.KpWkSDbW
5ZX0pT6bJKC9boayp6050wizpN7PTh4ff00CdBUj5btPPG0zkW5yC92Ruvtz
nWdIx6Nu_K8FWfWL5mMG
Received: from 209.85.221.198 (EHLO mail-vk1-f198.google.com)
by 10.217.134.141 with SMTPs
(version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256);
Sat, 06 Dec 2025 03:05:08 +0000
Received: by mail-vk1-f198.google.com with SMTP id 71dfb90a1353d-559e87054caso13512e0c.2
for ; Fri, 05 Dec 2025 19:05:08 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=firebaseapp.com; s=20230601; t=1764990308; x=1765595108; darn=yahoo.com;
h=to:from:subject:date:message-id:mime-version:from:to:cc:subject
:date:message-id:reply-to;
bh=zRk0saYQCeOZdtPAwzNT7GlR386VRYna4EeQHIYq7mE=;
b=Jn6LsewYm649gA4lucvPhTJJboMwfpPSXWPNm1aapODbkPU1StNAWxfcjBNtnIVlKI
GylOUqOxZpdk1R2c8msTL/f21v/NxAHg7YFW98prI+OltwWGfCewzBnhtGGW8H5srW1l
34wumICtjiNUpWDLczAt7Ck9xbdF+2aQocfit0m/o6hed64habhplKhsElaSr8lKZDYi
vlbu2EErrgrh2KGZShfPm5NLs1J3htYpyWt/02CRPjLvV2PGIpq8pJMigdXFeO3/h1Um
ZcqUQyH6v4yp+gtzEmV/bjXNFGU/+Z5dtgO5fDRifE/28dr0q5IQ5s27RYoGEfBtS6zs
NAwg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20230601; t=1764990308; x=1765595108;
h=to:from:subject:date:message-id:mime-version:x-gm-message-state
:from:to:cc:subject:date:message-id:reply-to;
bh=zRk0saYQCeOZdtPAwzNT7GlR386VRYna4EeQHIYq7mE=;
b=RUk8IURAHr2CP1WKUIcO5Bkrik88LR41KfzGMfNIGS5MzwNCS5LB7HiCGY9JU12zeo
DuXuVbCjKcsEThF4cmkUw9IHFQGXJRisIMLTilzP8u1kWSXqtV0ajFMRy/mVm7ok6JNT
P/8Y14wtQoDKmkCkA6fGLSAZKxENyZQGV3sJESbrvogSn2dI4n2G/yG7iLeKp2Opa7zS
ToH8N+nhPNNt1JNxzblOOW+pr9dkPm2zfVUPIF7jhqdMSZNEPP4eVvY3fsemgYQX1t0o
2/4DRTtOUiaKWiEMeS4ZzyYSB47LVLXWI+P+rZUV48DUn8gHFrpQYVsKFtwIIGigMdVV
17/Q==
X-Gm-Message-State: AOJu0YwdRdrzKauAJWoh5P54pP0ifyWSrdeciWOPxtqrXHPExyvp/eVw
HbX0iw5GYe+SL4rTTv1aS5IlwEzSZ2+AaPGXcJiHk87ch+Mu6hjwOOIgx1CoF7iigwB/KFkPNTO
8XmGL2S/Dlg==
X-Google-Smtp-Source: AGHT+IHoZwXd+AgSTG4LNqfNv+9IcF5z43gAOP7tdNdiZiTrfeIsPtbBnckUmOSKWY1xyr/ODBOCMQ4pEXhzY6s=
MIME-Version: 1.0
X-Received: by 2002:a05:6122:d02:b0:559:9689:8f4d with SMTP id
71dfb90a1353d-55e84578a68mr281553e0c.1.1764990308207; Fri, 05 Dec 2025
19:05:08 -0800 (PST)
Message-ID: <0000000000005a4cb506453fd4ca@google.com>
Date: Sat, 06 Dec 2025 03:05:08 +0000
Subject: =?UTF-8?B?8J+TpiBEZWxpdmVyeSBEZXRhaWxz?=
From: Package Tracking
To: p2@yahoo.com
Content-Type: multipart/alternative; boundary="0000000000005a4ca406453fd4c7"
Content-Length: 4959
--0000000000005a4ca406453fd4c7
Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes
Content-Transfer-Encoding: base64
WW91ciBPcmRlciBpcyBvbiB0aGUgTW92ZSEg8J+amg0KDQoNCkhlbGxvIHBvaWJhYnkyQHlhaG9v
LmNvbSwNCg0KV2UndmUgZ290IGdyZWF0IG5ld3Mg4oCUIHlvdXIgb3JkZXIgaGFzIHNoaXBwZWQg
YW5kIGlzIG9uIGl0cyB3YXkgdG8geW91IQ0KDQpDbGljayBiZWxvdyB0byBmb2xsb3cgeW91ciBw
YWNrYWdlIGluIHJlYWwtdGltZToNCg0KVHJhY2sgTXkgT3JkZXIg4p6h77iPDQoNCg0KT3JkZXIg
TnVtYmVyOiBDbGljayB0byB2aWV3DQoNCkVzdGltYXRlZCBEZWxpdmVyeSBEYXRlOiBDbGljayB0
byB2aWV3DQoNCg0KUXVlc3Rpb25zIG9yIG5lZWQgaGVscD8gT3VyIHN1cHBvcnQgdGVhbSBpcyBo
ZXJlIDI0LzcuIENvbnRhY3QgdXMuDQoNCg0KVGhhbmtzIGZvciBzaG9wcGluZyB3aXRoIHVzLiBX
ZSBob3BlIHlvdSBsb3ZlIHlvdXIgcHVyY2hhc2UhDQoNCg0K
--0000000000005a4ca406453fd4c7
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Track You.r Order
body {
margin: 0;
padding: 0;
background-color: #f4f4f7;
font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;
color: #333;
}
.email-wrapper {
max-width: 600px;
margin: 30px auto;
background-color: #ffffff;
border-radius: 12px;
box-shadow: 0 2px 8px rgba(0,0,0,0.05);
overflow: hidden;
}
.email-header {
background-color: #343a40;
color: #ffffff;
text-align: center;
padding: 30px 20px;
}
.email-header h1 {
margin: 0;
font-size: 26px;
font-weight: normal;
}
.email-body {
padding: 25px 30px;
font-size: 16px;
line-height: 1.6;
}
.email-body p {
margin: 0 0 15px;
}
.cta-button {
display: inline-block;
background-color: #28a745;
color: #ffffff !important;
padding: 14px 28px;
border-radius: 6px;
font-weight: bold;
font-size: 16px;
text-decoration: none;
margin: 20px 0;
}
.info-box {
background-color: #f8f9fa;
padding: 20px;
border-radius: 8px;
margin: 20px 0;
border: 1px solid #e2e6ea;
}
.info-box p {
margin: 10px 0;
}
.info-box a {
color: #007bff;
text-decoration: none;
}
.email-footer {
background-color: #f1f3f5;
padding: 15px 20px;
text-align: center;
font-size: 13px;
color: #666;
}
.email-footer p {
margin: 0;
}
Your Order is on the Move! =F0=9F=9A=9A
Hello p2@yahoo.com,
We=E2=80=99ve got great news =E2=80=94 your order has shipped and =
is on its way to you!
Click below to follow your package in real-time:
T=
rack My Order =E2=9E=A1=EF=B8=8F
Order Number: Click to view
Estimated Delivery Date: Click to view
Questions or need help? Our support team is here 24/7. Contact us.
Thanks for shopping with us. We hope you love your purchase!
--0000000000005a4ca406453fd4c7--
Segnala una Truffa
