Reporting a Phishing attempt

MisterH
MisterH Quicken Mac Subscription Member ✭✭
edited April 9 in Signing in, Passwords, and Activation (Windows)

I am running MacOS 14.4 (23E214). I received the attached email. My account renews in seven months so this must be a phishing attempt.

Screenshot 2024-03-09 at 12.23.10 PM.png

Here are all headers:

X-Dmarc-Policy: v=DMARC1; p=none

X-Proofpoint-Orig-Guid: kx7K7NqWDtzRXBx8ZopTQCnBgXxSzwp5

X-Antivirus: avast (VPS 24030804)

X-Antivirus-Status: Clean

Authentication-Results: bimi.icloud.com; bimi=skipped reason="insufficient dmarc"

Authentication-Results: arc.icloud.com; arc=fail

Authentication-Results: dmarc.icloud.com; dmarc=pass header.from=quicken.helpqb.com

Authentication-Results: dkim-verifier.icloud.com; dkim=pass (2048-bit key) header.d=quicken.helpqb.com header.i=@quicken.helpqb.com header.b=gcul/K+M

Authentication-Results: spf.icloud.com; spf=pass (spf.icloud.com: domain of billing@quicken.helpqb.com designates 23.83.212.50 as permitted sender) smtp.mailfrom=billing@quicken.helpqb.com

X-Icl-Score: 3.333033230044

Return-Path: <billing@quicken.helpqb.com>

X-Mc-Relay: Neutral

X-Proofpoint-Guid: kx7K7NqWDtzRXBx8ZopTQCnBgXxSzwp5

X-Mc-Loop-Signature: 1709834548424:2387169436

X-Apple-Action: MOVE_TO_FOLDER/INBOX

X-Mc-Ingress-Time: 1709834548424

X-Mailchannels-Senderid: hostingeremail|x-authuser|billing@quicken.helpqb.com

X-Cm-Envelope: MS4xfFdxAgfoDaao0lG5zH0ZQ0rGpU32SKH0Gg7RO4kDN9eESz1Q8t+AdkhycQrIb5iYp/GnbWg0y/Xqnfc5e38ePkmPU+0RfiwSD5L/a/b8pwqD0A7fYM4f NAK9xDak3kBzfjsGMei0ptlALDbz9Skd5oEaiBZ1TYBHC9m79YRqYp8rCwY7AGpwj9mLmCsOfibLgQ==

Original-Recipient: rfc822;mrherring@me.com

X-Apple-Uuid: 9e38f5c6-5118-48cd-9af3-8503be10d0b2

Arc-Seal: i=1; s=arc-2022; d=mailchannels.net; t=1709834548; a=rsa-sha256; cv=none; b=QreIMyWNpAoDZPHwXzJHxNXD74A1CU+R398uoDSagBVqvCtye7lci1uFEB66jrdJmc1dvL ASIXc2c6IS/byRp+fC5z2KbSFgjNB/qYjpSZdIc14IVzCoCctj9m1Fn/SYGz2GAIcHDf3G MNXrV35V5U1UQsR6+2thOBYbmhfB6poGacrTf37TcTS+I6aNMC7fesTCJvKlgFmgpm/Xs+ f6b+C4dvAMR3mtNlPhWXU53yxxbElVJwbbzy6wNg6B7KO8l5me83YAvwSSklyRZGe0nAJF 9bq/uBmfQDnNQ0UJByBg1M+d+wFbTPoAI1g4SwnjAxVS6EcedtXbNm5XtnepaQ==

Thread-Index: AdpwuVAznIIgSOQYSQe4HtBzsRwyvQ==

<019c01da70b9$9b48ef80$d1dace80$@quicken.helpqb.com>

X-Dmarc-Info: pass=pass; dmarc-policy=none; s=r1; d=r1; pdomain=quicken.helpqb.com

Content-Language: en-us

X-Arc-Info: policy=fail; arc=fail; id=rspamd-55b4bfd7cb-f42ng

Arc-Authentication-Results: i=1; rspamd-55b4bfd7cb-f42ng; auth=pass smtp.auth=hostingeremail smtp.mailfrom=billing@quicken.helpqb.com

X-Mailer: Microsoft Outlook 16.0

Mime-Version: 1.0

X-Clx-Shades: None

Received: from ci74p00im-qukt09070101.me.com by p149-mailgateway-smtp-b7f658464-vxdbm (mailgateway 2411B129) with SMTP id 9e38f5c6-5118-48cd-9af3-8503be10d0b2  for <mrherring@me.com>; Thu, 7 Mar 2024 18:02:35 GMT

Received: from dormouse.elm.relay.mailchannels.net (dormouse.elm.relay.mailchannels.net [23.83.212.50]) by ci74p00im-qukt09070101.me.com (Postfix) with SMTP id 6D6C71200316 for <mrherring@me.com>; Thu,  7 Mar 2024 18:02:29 +0000 (UTC)

Received: from relay.mailchannels.net (localhost [127.0.0.1]) by relay.mailchannels.net (Postfix) with ESMTP id 814397A1842 for <MrHerring@me.com>; Thu,  7 Mar 2024 18:02:28 +0000 (UTC)

Received: from nl-srv-smtpout2.hostinger.io (unknown [127.0.0.6]) (Authenticated sender: hostingeremail) by relay.mailchannels.net (Postfix) with ESMTPA id C43447A3646 for <MrHerring@me.com>; Thu,  7 Mar 2024 18:02:27 +0000 (UTC)

Received: from nl-srv-smtpout2.hostinger.io (nl-srv-smtpout2.hostinger.io [145.14.150.88]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384) by 100.114.53.101 (trex/6.9.2); Thu, 07 Mar 2024 18:02:28 +0000

Content-Type: multipart/alternative; boundary="----=_NextPart_000_019D_01DA70E7.B5039C80"

X-Cm-Analysis: v=2.4 cv=SNJEVvvH c=1 sm=1 tr=0 ts=65ea012f a=k2KoSHZH4Y1WR1f34ads2w==:117 a=k2KoSHZH4Y1WR1f34ads2w==:17 a=DAwyPP_o2Byb1YXLmDAA:9 a=f4rSQM5qAAAA:20 a=HHGDD-5mAAAA:8 a=3j4BkbkPAAAA:8 a=vnREMb7VAAAA:8 a=JqEG_dyiAAAA:8 a=UqCG9HQmAAAA:8 a=F-eguOH6AAAA:8 a=_cIwHBu-JBqPZTQSlN8A:9 a=QEXdDO2ut3YA:10 a=0PNm6CjM8k4A:10 a=X-aAQs0CHs0A:10 a=RVmHIydaz68A:10 a=yMhMjlubAAAA:8 a=SSmOFEACAAAA:8 a=-_pRISMeAAAA:20 a=Kg1-nEya9dyT4R3xZVQA:9 a=i58rfEZUpIuUWBl0:21 a=UiCQ7L4-1S4A:10 a=hTZeC7Yk6K0A:10 a=frz4AuCg-hUA:10 a=lqcHg5cX4UMA:10 a=6fUgGkdn3oDUj-9J_Aa7:22 a=bA3UWDv6hWIuX7UZL3qL:22 a=t2nFXs-JeQ3f8WPuOrDY:22

X-Plucky-Quick: 6a58b937389d6a1b_1709834548425_962983262

X-Mailchannels-Auth-Id: hostingeremail

Received-Spf: pass (spf.icloud.com: domain of billing@quicken.helpqb.com designates 23.83.212.50 as permitted sender) receiver=spf.icloud.com; client-ip=23.83.212.50; helo=dormouse.elm.relay.mailchannels.net; envelope-from=billing@quicken.helpqb.com

X-Apple-Movetofolder: INBOX 

X-Authuser: billing@quicken.helpqb.com

X-Icl-Info: GAtbVUseBVFGSVVESgMGUkFNRFcUWUIPAApbVRYSFhEAREQZF15TQFUcAkpaUl8OGRAIEDhBQwsW EgMZVlhTDgUIBFkbX1tAVR8CSlpBQwsWEgMZVlhTDgUIBFkbX1tAVQoPB0USBFFbQVVZSgEETEBJ RFcQVVoNSFsCGApdWRcGHEgSFF0YEBAVBw5WXVcLGRoOFhZeUw4GVwgSDBIWEgELW1UcX0QPGgwV ElZVWg9bCwMbGUkYDxQQChQQUVgMEBUVWRZVQkBVHQJKWkFDCxYSAxlWWFMOBQgEWRtfW0BVFA8T RRIKUkRABUdJVFdVRRtfU0FSAloQH15HXFQHBhQaA09IFHYTABAFHB1eGAoQFRYGGh5VDRhHRFcK UwtAOAsuEgpCXwwSOQsSVlNZD1c=

X-Mantsh: 1TFkXGx4cEQpZRBdkH2JzU2xmY2FgcxEKWU0XZEVETxEKWUkXGB5xGwYeEncGGRo GGgYaBhMYBhpxGhAadwYaBhoGGgYaBhoGGnEaEBp3BhoRClleF2xseREKQ04XQVIdYR1kW31uX lB4cmhSEnBFWn57aURoTXJSeVBdWh8RClhcFxkEGgQfGgUbGhoEHRoEGxMSBBseEBseGh8aEQp eWRdOYhxyeREKTVwXGxIeEQpMWhdgQ0VvaxEKTEYXTWsRCkNaFxgZBBIZBBgbGAQfGhEKQl4XG xEKQlwXGxEKQksXZUdCGWV5WGBIHkQRCkJJF3p7Wxx9ZhJhUmxJEQpCRRdsWFxdWkhlAVAFGxE KQk4XentbHH1mEmFSbEkRCkJMF2B8ZlJbR3p9fhxGEQpCbBdgfGZSW0d6fX4cRhEKQkAXZkRPb EBgQn9tQEYRCkJYF21aH3Bafl1DY39eEQpCeBduYlhPXFlmXXNpGREKWlgXGxIRCnBnF2hEWXp TZk0YfEYZEAccGBEKcGgXa2RFGm5iYFxublIQGhEKcGgXbllTcHJaBWQdRHkQGhEKcGgXYEVFT U8aGUh6TnkQGhEKcGgXb0Z8WmlCeG96YlIQGhEKcGgXaWlmbBx/f11CTXwQGhEKcGgXZU9MWEB NXQUfUloQGhEKcGgXZ0BEb0tLREsaTBkQGhEKcGgXYR5jT1hBY1BLExkQGhEKcH8XZUVZBUJeY HtHWR4QBxsbEhEKcF8XbEROW2tyeF9YHnAQGhEKcH0XYklYeVBvXhhrTVAQGhEKcH0XYklYeVB vXhhrTVAQGhEKcH8XYU8fGXlJaVx5GmYQBxMdEQpwXxdseWYfQ2xNWXAYbRAHExoRCnB9F2VJf n58XWtzcxl/EBoRCnB/F21kaU5tAU1Fe0xAEAcbGh4RCnBfF24cRGxnBXxjWXxSEBoRCnB9F2x pQF8BS2FIXl9oEBoRCnB/F28bQWh6Y2YeSGYTEAcbGhwRCnBfF2RDaxxgYHNBWwVyEAcdHBEKc H0XYht8clJuQnBaHhkQBxseHxEKcH8XbFpgZRN/Z2RgEkQQBxgEGREKcF8XehpyG29SAUcSTmU QGxwRCnB9F2ccQmEZEn1uf0VpEBoRCnB9F2JJWHlQb14Ya01QEBoRCnB9F2JJWHlQb14Ya01QE BoRCnB9F2VJfn58XWtzcxl/EBoRCnB/F29uAW97exkYZhNNEAcSGBEKcF8XYmxkQhsFHWtSYkM QBx0cEQpwfRdhcgVcTGkcRxJfaRAHHRoRCnB9F2xpQF8BS2FIXl9oEBoRCnB9F2dDQU1kY3sBQ EJgEAcSEhEKcGcXZ1hPR1oaQnJIeGwQBx0ZEQpwfRdiG3xyUm5CcFoeGRAHGx4fEQpwfRdvYE5 ZbXtdS31LGRAHHR8RCnBnF2hMcFhreXhcbRtfEAccHxEKcH0XaF9TeE8BXBJFHmEQGhEKcEMXb EN9blpsE0NfQ2MQBxgcEQptfhcaEQpYTRdLEQ==

X-Sender-Id: hostingeremail|x-authuser|billing@quicken.helpqb.com

X-Sender-Id: hostingeremail|x-authuser|billing@quicken.helpqb.com

Arc-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=mailchannels.net; s=arc-2022; t=1709834548; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: dkim-signature; bh=yeIuZS+AIMlFJLCn+yOFDj3KLz2L16xwajXgzPMLO4M=; b=ALwJ6VsHP9U/y+OIQOmdOvf87soLsQoMmLHtRmSOqwdiYgRiRqUiKc6XKAIxHQLFPTNMiw stKY8SCtIEg4SCtDHwHiu+TEl58qqfnp6N6ASrvN8lCvkxm0XUs2hKpRYqyVnei8D9GXGB TEQI6AnBJMRjOWTp+jIFhhGSpmr2P4W6EyfaopWEq3Q/ZALSGX9IpnQRpSgkocTIxnrBvh +B9s+alhzD1VBrB+1AordKJ7wfoNMPMKGrtoBd1LaMDj2GgSVGO/BUs7LyYoF1yfvsk3d+ pGlibKDgl94LXYdw4xFLum2DNCaW1xkRHvle/b8A12sYIy0pzLEULePTLpQYqQ==

Dkim-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=quicken.helpqb.com; s=hostingermail-a; t=1709834543; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type; bh=5/Vri/fmvSiITg6RS4tZVLcFqy7a7FiTauLDQezZPDg=; b=gcul/K+M+6OWVG+nQ8iFu+1aBuzOMlsgNLRSc4X186zYlddny/Kra8We6BnzNRQ3u6tzmc QPKYqprCnvp9/kQKVoQwpRSjMYeY62ktEeGAQ9aRZNqKp+x6b99EaTynHAqi2t+XIU7lpp xxHHJSbPx3ApuP4OCyoSOh0XLs1l1u+wJfEKVh1X3orFZg9WtjGRcj2r7f1/vxkSkeZBo7 CVx064m1sODsHHpUPVwDDg5ismzlkmvz80lZeF0jrqV86PPWi3LjHbhmUgQz6jwDO4e9JA E8cXPJkq98RXp/LO9MiRrrEZj3H6++I5bbRdxV1TcYN9AX17cSmK9aWv077f9w==

Comments

  • QuickUserPSP
    QuickUserPSP Member, Windows Beta Beta

    @MisterH this information should be sent to spoof@quicken.com so Quicken's fraud investigation team can investigate this phishing attempt.

  • Chris_QPW
    Chris_QPW Quicken Windows Subscription Member ✭✭✭✭

    Definitely phishing

    image.png

    Signature:
    This is my website: http://www.quicknperlwiz.com/
  • QuickUserPSP
    QuickUserPSP Member, Windows Beta Beta

    The other giveaway is the orphaned footnote with the stale date and stating for new subscribers only.

    image.png

This discussion has been closed.

Categories