Suspicious email

[MartinF13]

How do I submit a suspicious email to you?

 

Here is the text - I very nearly fell for it.

Edited April 8, 2022 by AdvancedSetup
Removed data for privacy

[David H. Lipman]

There is not enough information to tell if that was a Real Email or a Scam Email.  Chances are though it is legitimate.

The way to corroborate the message is to examine the Full Headers and Body of that email.  That will indicate if it is Real or not.

Please extract the RAW Full Header and Body of the suspect email into a TXT file and attach it or extract it as an EML file and place it in a ZIP file and attach it in your reply.  Either one can help determine its legitimacy.

[MartinF13]

I don't know how to do this: "Please extract the RAW Full Header and Body of the suspect email into a TXT file"

Is there an email address I can forward it to please?

It can't be real... it's asking for payment in 30 days for something that the same email says expires in October 2022

[David H. Lipman]

Forwarding email obfuscates the Headers and won't help.

Who is the email provider you use ?

[MartinF13]

Apple (me.com) on a Virgin ISP

[MartinF13]

Apple Mail is the email programme 

[David H. Lipman]

Please reference:  https://www.lifewire.com/view-message-source-os-x-mail-1172799

Then copy the contents, place it is a TXT file and attach that TXT file in your reply.

[MartinF13]

Thank you Dave 

 

Edited April 8, 2022 by AdvancedSetup
Removed data for privacy

[David H. Lipman]

Thank you.

That's incomplete.

Below is a redacted email header sample.  Compare the contents of your TXT file with the below and you will clearly see a big difference

Spoiler

Return-Path: <gmaxaf76tp-z497qy-ab4bk47103w2gkvkawb0@email.conservativenews.com>
Delivered-To: REDACTED@comcast.net
Received: from dovdir1-asa-06o.email.comcast.net ([96.103.145.215])
	by dovback1-asa-22o.email.comcast.net with LMTP
	id CBGzH8YeRmLKegAAZIXjgg
	(envelope-from <gmaxaf76tp-z497qy-ab4bk47103w2gkvkawb0@email.conservativenews.com>)
	for <REDACTED@comcast.net>; Thu, 31 Mar 2022 21:36:06 +0000
Received: from dovpxy-hoc-08o.email.comcast.net ([96.103.145.215])
	by dovdir1-asa-06o.email.comcast.net with LMTP
	id MKrPHsYeRmL9NwAAMr3IMA
	(envelope-from <gmaxaf76tp-z497qy-ab4bk47103w2gkvkawb0@email.conservativenews.com>)
	for <REDACTED@comcast.net>; Thu, 31 Mar 2022 21:36:06 +0000
Received: from resimta-a1p-087404.sys.comcast.net ([96.103.145.215])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	by dovpxy-hoc-08o.email.comcast.net with LMTPS
	id GCOtK8UeRmKMHwAA5hpKTg
	(envelope-from <gmaxaf76tp-z497qy-ab4bk47103w2gkvkawb0@email.conservativenews.com>)
	for <REDACTED@comcast.net>; Thu, 31 Mar 2022 21:36:05 +0000
Received: from mail050.on.mlsend.com ([2.58.125.187])
	by resimta-a1p-087404.sys.comcast.net with ESMTP
	id a2SBnU2myQzWGa2SCnVw3t; Thu, 31 Mar 2022 21:35:41 +0000
X-CAA-SPAM: F00000
X-Xfinity-VAAS: gggruggvucftvghtrhhoucdtuddrgedvvddrudeigedgudeivdcutefuodetggdotefrodftvfcurfhrohhfihhlvgemucevohhmtggrshhtqdftvghsihenuceurghilhhouhhtmecufedtudenucenucfjughrpefuhfhrvfffkffjtgggsegrtderredttdejnecuhfhrohhmpefluffknfgggfftpgfouffvoehonhhlihhnvggsihguughinhhgsehqnhhggihllhgrjhgtghgsthgrhhhhrdgtohhmqeenucggtffrrghtthgvrhhnpeekkeejkefgleekgeeiudduffefgfetteelteehhffhkeduteevudejueefudefhfenucfkphepvddrheekrdduvdehrddukeejnecuvehluhhsthgvrhfuihiivgeptdenucfrrghrrghmpehhvghlohepmhgrihhltdehtddrohhnrdhmlhhsvghnugdrtghomhdpihhnvghtpedvrdehkedruddvhedrudekjedpmhgrihhlfhhrohhmpehgmhgrgigrfhejiehtphdqiiegleejqhihqdgrsgegsghkgeejuddtfeifvdhgkhhvkhgrfigstdesvghmrghilhdrtghonhhsvghrvhgrthhivhgvnhgvfihsrdgtohhmpdhnsggprhgtphhtthhopedupdhrtghpthhtohepjhhsihhlvhgvrhgpmhhsthestghomhgtrghsthdrnhgvth
X-Xfinity-VMeta: sc=0.00;st=legit
X-Xfinity-Message-Heuristics: IPv6:N;TLS=0;SPF=2;DMARC=
Subject: IMPORTANT MESSAGE
From: REDACTED<onlinebidding@qngxllajcgbtahh.com>
Reply-To: =?utf-8?Q?Inglis=20Online=20Bidding?= <onlinebidding@qngxllajcgbtahh.com>
To: <REDACTED@comcast.net>
Date: Thu, 31 Mar 2022 17:35:39 -0400
Message-ID: <05bxciy5dbhhwtfbyqxy3wgxt.qm1wp07fbh.20220330220005.0773210992.vd38z027@mail239.wdc02.mcdlv.net>
Feedback-ID: 23949751:23949751.304656:us3:mc
X-Accounttype: pd
List-Unsubscribe: <https://qngxllajcgbtahh.us3.list-manage.com/unsubscribe?u=05bxciy5dbhhwtfbyqxy3wgxt&id=a9878cb437&e=qm1wp07fbh&c=0773210992>, <mailto:unsubscribe-mc.us3_05bxciy5dbhhwtfbyqxy3wgxt.0773210992-qm1wp07fbh@unsubscribe.mailchimpapp.net?subject=unsubscribe>
List-Unsubscribe-Post: List-Unsubscribe=One-Click
Content-Type: multipart/alternative; boundary="_----------=_MCPart_51821476"
MIME-Version: 1.0

 

Edited April 8, 2022 by David H. Lipman
Edited for content, clarity, spelling and/or grammar

[MartinF13]

Thank you again Dave for your help with this

 

Edited April 8, 2022 by AdvancedSetup
Removed data for privacy

[David H. Lipman]

Thank You.

This is a Legitimate Malwarebytes' Subscription renewal notification.

EDIT:

I have requested your PII be redacted from this thread.

Edited April 8, 2022 by David H. Lipman
Edited for content, clarity, spelling and/or grammar