This Phishmas, be sure you know how to spot all the signs of a bad email.

This email claims to come from a address--although in this case, it's a clear spoof of the domain. 

That's the only thing that ties to shipping. Everything else is a really poor spoof of a McAfee subscription. There are spelling errors everywhere--it would be a good idea to spell McAfee right in the spoof.

The URL is a clear credential harvesting scheme. 

When you see an email like this, even if the sender address appears legitimate, look at the rest of the email. That will alert you that the sender address is actually a spoof.