Phishing for Norton Lifelock renewals

Sorry, if there is a better way to report this...

 

Slimeaction:

===================================================================
From: Norton-LifeLock <contact@alzalaska.org> [Add to Address Book]
To:  
Subject: Your Norton-subscription has expired ! Please respond!
Date: Oct 11, 2020 9:01 AM

===================================================================
Comments:

If you click on Renew, you go to this:
http://   cgi.yvminsurance.com   /1705782tF2604456RR203670631ee8230FE38YXr96682KW
 

I removed some of the interstitial active text so the email scans a little.

Your Norton Subscription keeps you protected with automatic updates, gives
you access to technical support, and lets you reinstall your products any time.
One subscription license projects one PC with Norton Software. HoIDvRJtSPwever,
you can have multiWkmwB6kHple liceOPV8vND3nses in your subscrippymvKDpktion to prDahEwN6Qotect more than one
PC or decCWmqzvdice. Learn more

12 daHPIM1Lw7ys at riKFpNYNm0sk

ExpixeEdj8Myred on: 01/11/2020
LicenOxMdL9fpces: 3


RenQsIJAkjKew
Actions:
RenSCLP05G6ew subscrBwjNK7T9iption
Edit profile
Edit biDtbqKfFNling infoGRa8ySHKrmation
Mange subscript9w7sb3piions
 

 

 Headers

Return-Path: <AxWjDqOlIQMyrbDgIJD3S5g==_1114049354876_M/RxwK9fEeWGutSuUnVLeA==@in.constantcontact.com>
Received: from noehlo.host ([209.86.89.132])
	by mdl-serene.atl.sa.earthlink.net (EarthLink SMTP Server) with SMTP id 1KrCRpoH3Nl34S1; Sun, 11 Oct 2020 11:02:07 -0400 (EDT)
Received: from nmtai204.oxsus-vadesecure.net ([147.135.97.27])
	by ibscan-ranger.atl.sa.earthlink.net (EarthLink SMTP Server) with SMTP id 1KrCRoqH3PGoUk0
	for <braj@ix.netcom.com>; Sun, 11 Oct 2020 11:02:06 -0400 (EDT)
Received: from cgi.yvminsurance.com ([185.140.34.123])
 by oxsus2nmtai04p.internal.vadesecure.com with ngmta
 id 5f7bc085-163cf841051d7731; Sun, 11 Oct 2020 15:02:06 +0000
Authentication-Results: mail52c28.carrierzone.com; dkim=pass (1024-bit key) header.d=auth.ccsend.com header.i=@auth.ccsend.com header.b="dpt8GsOL"
Date: Sun, 11 Oct 2020 11:01:55 -0400
Dkim-Signature: v=1; q=dns/txt; a=rsa-sha256; c=relaxed/relaxed; s=1000073432; d=auth.ccsend.com; h=date:mime-version:subject:X-Feedback-ID:message-id:from:reply-to:list-unsubscribe:list-unsubscribe-post:to; bh=7TiW7sXiaeY+CGWNdeAVxD5hqo9qYt/xO4aZ0k75MhU=; b=dpt8GsOLWI+Ab7wb/FUks7zQckmQo5hSkKxITW3wauGJDMWa6SxymATnFJfs+ST8H0qgdJ+42oQ7BQuRFSXjSqeZWrvZrq0fXHWe+TTzgV72xMBK0Nt/cmV81J10Jf0MGH3w/ZIgd6zu8cSnXwIjatcBSudNBnL6He6lMxRwAcY=
From: Norton-LifeLock <contact@alzalaska.org>
List-Unsubscribe: <https://visitor.constantcontact.com/do?p=un&m=001eTDpG2lgWw31Yn41erl1wA%3D%3D&se=001g3mOpLPozGO5MYRKpN_h2Q%3D%3D&t=001EkZLEx15CcE%3D&llr=7dhiirnab>
List-Unsubscribe-Post: List-Unsubscribe=One-Click
Message-ID: <1133737814012.1114049354876.1369167213.0.211300JL.2002@scheduler.constantcontact.com>
Mime-Version: 1.0
Received: from  ( helo=p2-jbemailsyndicator24.ctct.net) by 10.249.247.10 (envelope-from <AxWjDqOlIQMyrbDgIJD3S5g==_1114049354876_M/RxwK9fEeWGutSuUnVLeA==@in.constantcontact.com>) (ecelerity 4.2.1.52273 r(Core:4.2.1.11)) with ESMTP id D2/C2-59170-F3EDC0E5; Wed, 01 Jan 2020 13:00:31 -0500
Received-Spf: pass (mail52c28.carrierzone.com: domain of AxWjDqOlIQMyrbDgIJD3S5g==_1114049354876_M/RxwK9fEeWGutSuUnVLeA==@in.constantcontact.com designates 208.75.123.233 as permitted sender) receiver=mail52c28.carrierzone.com; client-ip=208.75.123.233; helo=ccm233.constantcontact.com; envelope-from=AxWjDqOlIQMyrbDgIJD3S5g==_1114049354876_M/RxwK9fEeWGutSuUnVLeA==@in.constantcontact.com; x-software=spfmilter 2.001 http://www.acme.com/software/spfmilter/ with libspf2-1.2.10;
Reply-To: contact@alzalaska.org
Subject: Your Norton-subscription has expired ! Please respond!
To: braj@ix.netcom.com
X-Campaign-Activity-Id: c568c3a8-e948-40cc-ab6c-3808243dd2e6
X-Cha: v=2.3 cv=fcjTNHYF c=1 sm=1 tr=0 b=1 a=6EA29uO5ISUy7IYGfCpGaQ==:117 a=6EA29uO5ISUy7IYGfCpGaQ==:17 a=KGjhK52YXX0A:10 a=Jdjhy38mL1oA:10 a=d9B2TaBE80UA:10 a=9n8eEJDQAAAA:8 a=tcgjaGXTAAAA:8 a=fKSg-SFqZ5Z4pmhPewAA:9 a=QEXdDO2ut3YA:10 a=D30QI44enCoA:10 a=-6QB9QM8QUMA:10 a=UqCG9HQmAAAA:8 a=QXhRXOM3AAAA:8 a=3KUoxB9FAAAA:8 a=Uf2GWQ3yVs1A5gaKFz8A:9 a=jmOqjFKOD8_WNq0s:21 a=_W_S_7VecoQA:10 a=hoRzMbyvsqHV5lt2pD9t:22 a=0if3LG9OT7eM9ouWkUU_:22 a=PLULhHS3xM9y_cBD06OH:22
X-Channel-Id: 33f471c0-af5f-11e5-86ba-d4ae52754b78
X-Csc: 0
X-Ctch-Refid: str=0001.0A090215.5E0CDE47.0079:SCFMA13084411,ss=1,re=-4.000,recu=0.000,reip=0.000,cl=1,cld=1,fgs=0
X-Ctch-Spam: Unknown
X-Ctch-Vod: Unknown
X-Ctct-Id: 33cc7760-af5f-11e5-86ad-d4ae52754b78
X-Envelope-From: AxWjDqOlIQMyrbDgIJD3S5g==_1114049354876_M/RxwK9fEeWGutSuUnVLeA==@in.constantcontact.com
X-Feedback-Id: 33f471c0-af5f-11e5-86ba-d4ae52754b78:c568c3a8-e948-40cc-ab6c-3808243dd2e6:1114049354876:CTCT
X-Mailer: Roving Constant Contact 2012 (http://www.constantcontact.com)
X-Return-Path-Hint: AxWjDqOlIQMyrbDgIJD3S5g==_1114049354876_M/RxwK9fEeWGutSuUnVLeA==@in.constantcontact.com
X-Roving-Campaignid: 1133737814012
X-Roving-Id: 1114049354876.1369167213
X-Spam-Flag: NO
X-Whl: LR
Content-Type: multipart/alternative; boundary="=_34f03201a5f7c9f5ab55f3199b7c9043"
X-VadeSecure-Score: 190
X-VadeSecure-Cause: gggruggvucftvghtrhhoucdtuddrgedujedrheehgdekhecutefuodetggdotefrodftvfcurfhroh
 hfihhlvgemucfgteftvffjnffkpffmpdggtfgfnhhsuhgsshgtrhhisggvnecuuegrihhlohhuthem
 uceftddtnecuogfuphgrmhfkugculddutddtmdenhdfknhhvihhsihgslhgvucifohhrughsucdlhe
 dtmdenogeurggujfhtmhhlqddqufhushhpvggtthdqfghntghlohhsvgguvfgrghdqsfculdehtddm
 nefjrghmjfgvrgguvghrhfhivghlugcujfgvrgguvghrucfutghorhhinhhgucdlqddutddmnecujf
 gurhepfffhjffkgghruffvofgtsegrtderreertdejnecuhfhrohhmpefpohhrthhonhdqnfhifhgv
 nfhotghkuceotghonhhtrggtthesrghliigrlhgrshhkrgdrohhrgheqnecuggftrfgrthhtvghrnh
 epjeejgfekjedtheejgedvgefggfefieelffffhefgudejvdfgtdektddtgeffuedtnecuffhomhgr
 ihhnpeihvhhmihhnshhurhgrnhgtvgdrtghomhenucfkphepudekhedrudegtddrfeegrdduvdefne
 cuuegrugftvghpuhhtkfhppedukeehrddugedtrdefgedruddvfeenuceurggutfgvphhuthffohhm
 rghinhephihvmhhinhhsuhhrrghntggvrdgtohhmnecuuegrugftvghpuhhtgfhmrghilheptghonh
 htrggtthesrghliigrlhgrshhkrgdrohhrghenucevlhhushhtvghrufhiiigvpeehnecurfgrrhgr
 mhepihhnvghtpedukeehrddugedtrdefgedruddvfedphhgvlhhopegtghhirdihvhhmihhnshhurh
 grnhgtvgdrtghomhdpmhgrihhlfhhrohhmpeetgighjhffqhfqlhfksffohihrsgffghfklffffefu
 hehgpeeppgduuddugedtgeelfeehgeekjeeipgfosdftgiifmfelfhfgvgghifhuthfuuhgfnhggnf
 gvteeppeesihhnrdgtohhnshhtrghnthgtohhnthgrtghtrdgtohhmpdhrtghpthhtohepsghrrghj
 sehigidrnhgvthgtohhmrdgtohhmpdhmohguvgepshhmthhppdhgvghtqdfurghfvggfnhhsuhgssh
 gtrhhisggvpdhsphhfpefuohhfthhfrghilhdpughkihhmpefhrghilhdpggftfghnshhusghstghr
 ihgsvg
X-VadeSecure-Status: Spam
X-VadeSecure-Verdict: spam:low
X-VadeSecure-Malware: Clean
X-VadeSecure-Originating-IP: 185.140.34.123
Received-SPF: Softfail
Received-DKIM: Fail
X-ELNK-AV: 0
X-ELNK-Info: sbv=0; sbrc=.0; sbf=0b; sbw=000;

[Edit: Removed the hyperlink to conform with the Participation Guidelines and Terms of Service]