Reporting a Phishing attempt

Options
MisterH
MisterH Member ✭✭
edited April 9 in Signing in, Passwords, and Activation (Windows)

I am running MacOS 14.4 (23E214). I received the attached email. My account renews in seven months so this must be a phishing attempt.

Screenshot 2024-03-09 at 12.23.10 PM.png

Here are all headers:

X-Dmarc-Policy: v=DMARC1; p=none

X-Proofpoint-Orig-Guid: kx7K7NqWDtzRXBx8ZopTQCnBgXxSzwp5

X-Antivirus: avast (VPS 24030804)

X-Antivirus-Status: Clean

Authentication-Results: bimi.icloud.com; bimi=skipped reason="insufficient dmarc"

Authentication-Results: arc.icloud.com; arc=fail

Authentication-Results: dmarc.icloud.com; dmarc=pass header.from=quicken.helpqb.com

Authentication-Results: dkim-verifier.icloud.com; dkim=pass (2048-bit key) header.d=quicken.helpqb.com header.i=@quicken.helpqb.com header.b=gcul/K+M

Authentication-Results: spf.icloud.com; spf=pass (spf.icloud.com: domain of billing@quicken.helpqb.com designates 23.83.212.50 as permitted sender) smtp.mailfrom=billing@quicken.helpqb.com

X-Icl-Score: 3.333033230044

Return-Path: <billing@quicken.helpqb.com>

X-Mc-Relay: Neutral

X-Proofpoint-Guid: kx7K7NqWDtzRXBx8ZopTQCnBgXxSzwp5

X-Mc-Loop-Signature: 1709834548424:2387169436

X-Apple-Action: MOVE_TO_FOLDER/INBOX

X-Mc-Ingress-Time: 1709834548424

X-Mailchannels-Senderid: hostingeremail|x-authuser|billing@quicken.helpqb.com

X-Cm-Envelope: MS4xfFdxAgfoDaao0lG5zH0ZQ0rGpU32SKH0Gg7RO4kDN9eESz1Q8t+AdkhycQrIb5iYp/GnbWg0y/Xqnfc5e38ePkmPU+0RfiwSD5L/a/b8pwqD0A7fYM4f NAK9xDak3kBzfjsGMei0ptlALDbz9Skd5oEaiBZ1TYBHC9m79YRqYp8rCwY7AGpwj9mLmCsOfibLgQ==

Original-Recipient: rfc822;mrherring@me.com

X-Apple-Uuid: 9e38f5c6-5118-48cd-9af3-8503be10d0b2

Arc-Seal: i=1; s=arc-2022; d=mailchannels.net; t=1709834548; a=rsa-sha256; cv=none; b=QreIMyWNpAoDZPHwXzJHxNXD74A1CU+R398uoDSagBVqvCtye7lci1uFEB66jrdJmc1dvL ASIXc2c6IS/byRp+fC5z2KbSFgjNB/qYjpSZdIc14IVzCoCctj9m1Fn/SYGz2GAIcHDf3G MNXrV35V5U1UQsR6+2thOBYbmhfB6poGacrTf37TcTS+I6aNMC7fesTCJvKlgFmgpm/Xs+ f6b+C4dvAMR3mtNlPhWXU53yxxbElVJwbbzy6wNg6B7KO8l5me83YAvwSSklyRZGe0nAJF 9bq/uBmfQDnNQ0UJByBg1M+d+wFbTPoAI1g4SwnjAxVS6EcedtXbNm5XtnepaQ==

Thread-Index: AdpwuVAznIIgSOQYSQe4HtBzsRwyvQ==

<019c01da70b9$9b48ef80$d1dace80$@quicken.helpqb.com>

X-Dmarc-Info: pass=pass; dmarc-policy=none; s=r1; d=r1; pdomain=quicken.helpqb.com

Content-Language: en-us

X-Arc-Info: policy=fail; arc=fail; id=rspamd-55b4bfd7cb-f42ng

Arc-Authentication-Results: i=1; rspamd-55b4bfd7cb-f42ng; auth=pass smtp.auth=hostingeremail smtp.mailfrom=billing@quicken.helpqb.com

X-Mailer: Microsoft Outlook 16.0

Mime-Version: 1.0

X-Clx-Shades: None

Received: from ci74p00im-qukt09070101.me.com by p149-mailgateway-smtp-b7f658464-vxdbm (mailgateway 2411B129) with SMTP id 9e38f5c6-5118-48cd-9af3-8503be10d0b2  for <mrherring@me.com>; Thu, 7 Mar 2024 18:02:35 GMT

Received: from dormouse.elm.relay.mailchannels.net (dormouse.elm.relay.mailchannels.net [23.83.212.50]) by ci74p00im-qukt09070101.me.com (Postfix) with SMTP id 6D6C71200316 for <mrherring@me.com>; Thu,  7 Mar 2024 18:02:29 +0000 (UTC)

Received: from relay.mailchannels.net (localhost [127.0.0.1]) by relay.mailchannels.net (Postfix) with ESMTP id 814397A1842 for <MrHerring@me.com>; Thu,  7 Mar 2024 18:02:28 +0000 (UTC)

Received: from nl-srv-smtpout2.hostinger.io (unknown [127.0.0.6]) (Authenticated sender: hostingeremail) by relay.mailchannels.net (Postfix) with ESMTPA id C43447A3646 for <MrHerring@me.com>; Thu,  7 Mar 2024 18:02:27 +0000 (UTC)

Received: from nl-srv-smtpout2.hostinger.io (nl-srv-smtpout2.hostinger.io [145.14.150.88]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384) by 100.114.53.101 (trex/6.9.2); Thu, 07 Mar 2024 18:02:28 +0000

Content-Type: multipart/alternative; boundary="----=_NextPart_000_019D_01DA70E7.B5039C80"

X-Cm-Analysis: v=2.4 cv=SNJEVvvH c=1 sm=1 tr=0 ts=65ea012f a=k2KoSHZH4Y1WR1f34ads2w==:117 a=k2KoSHZH4Y1WR1f34ads2w==:17 a=DAwyPP_o2Byb1YXLmDAA:9 a=f4rSQM5qAAAA:20 a=HHGDD-5mAAAA:8 a=3j4BkbkPAAAA:8 a=vnREMb7VAAAA:8 a=JqEG_dyiAAAA:8 a=UqCG9HQmAAAA:8 a=F-eguOH6AAAA:8 a=_cIwHBu-JBqPZTQSlN8A:9 a=QEXdDO2ut3YA:10 a=0PNm6CjM8k4A:10 a=X-aAQs0CHs0A:10 a=RVmHIydaz68A:10 a=yMhMjlubAAAA:8 a=SSmOFEACAAAA:8 a=-_pRISMeAAAA:20 a=Kg1-nEya9dyT4R3xZVQA:9 a=i58rfEZUpIuUWBl0:21 a=UiCQ7L4-1S4A:10 a=hTZeC7Yk6K0A:10 a=frz4AuCg-hUA:10 a=lqcHg5cX4UMA:10 a=6fUgGkdn3oDUj-9J_Aa7:22 a=bA3UWDv6hWIuX7UZL3qL:22 a=t2nFXs-JeQ3f8WPuOrDY:22

X-Plucky-Quick: 6a58b937389d6a1b_1709834548425_962983262

X-Mailchannels-Auth-Id: hostingeremail

Received-Spf: pass (spf.icloud.com: domain of billing@quicken.helpqb.com designates 23.83.212.50 as permitted sender) receiver=spf.icloud.com; client-ip=23.83.212.50; helo=dormouse.elm.relay.mailchannels.net; envelope-from=billing@quicken.helpqb.com

X-Apple-Movetofolder: INBOX 

X-Authuser: billing@quicken.helpqb.com

X-Icl-Info: GAtbVUseBVFGSVVESgMGUkFNRFcUWUIPAApbVRYSFhEAREQZF15TQFUcAkpaUl8OGRAIEDhBQwsW EgMZVlhTDgUIBFkbX1tAVR8CSlpBQwsWEgMZVlhTDgUIBFkbX1tAVQoPB0USBFFbQVVZSgEETEBJ RFcQVVoNSFsCGApdWRcGHEgSFF0YEBAVBw5WXVcLGRoOFhZeUw4GVwgSDBIWEgELW1UcX0QPGgwV ElZVWg9bCwMbGUkYDxQQChQQUVgMEBUVWRZVQkBVHQJKWkFDCxYSAxlWWFMOBQgEWRtfW0BVFA8T RRIKUkRABUdJVFdVRRtfU0FSAloQH15HXFQHBhQaA09IFHYTABAFHB1eGAoQFRYGGh5VDRhHRFcK UwtAOAsuEgpCXwwSOQsSVlNZD1c=

X-Mantsh: 1TFkXGx4cEQpZRBdkH2JzU2xmY2FgcxEKWU0XZEVETxEKWUkXGB5xGwYeEncGGRo GGgYaBhMYBhpxGhAadwYaBhoGGgYaBhoGGnEaEBp3BhoRClleF2xseREKQ04XQVIdYR1kW31uX lB4cmhSEnBFWn57aURoTXJSeVBdWh8RClhcFxkEGgQfGgUbGhoEHRoEGxMSBBseEBseGh8aEQp eWRdOYhxyeREKTVwXGxIeEQpMWhdgQ0VvaxEKTEYXTWsRCkNaFxgZBBIZBBgbGAQfGhEKQl4XG xEKQlwXGxEKQksXZUdCGWV5WGBIHkQRCkJJF3p7Wxx9ZhJhUmxJEQpCRRdsWFxdWkhlAVAFGxE KQk4XentbHH1mEmFSbEkRCkJMF2B8ZlJbR3p9fhxGEQpCbBdgfGZSW0d6fX4cRhEKQkAXZkRPb EBgQn9tQEYRCkJYF21aH3Bafl1DY39eEQpCeBduYlhPXFlmXXNpGREKWlgXGxIRCnBnF2hEWXp TZk0YfEYZEAccGBEKcGgXa2RFGm5iYFxublIQGhEKcGgXbllTcHJaBWQdRHkQGhEKcGgXYEVFT U8aGUh6TnkQGhEKcGgXb0Z8WmlCeG96YlIQGhEKcGgXaWlmbBx/f11CTXwQGhEKcGgXZU9MWEB NXQUfUloQGhEKcGgXZ0BEb0tLREsaTBkQGhEKcGgXYR5jT1hBY1BLExkQGhEKcH8XZUVZBUJeY HtHWR4QBxsbEhEKcF8XbEROW2tyeF9YHnAQGhEKcH0XYklYeVBvXhhrTVAQGhEKcH0XYklYeVB vXhhrTVAQGhEKcH8XYU8fGXlJaVx5GmYQBxMdEQpwXxdseWYfQ2xNWXAYbRAHExoRCnB9F2VJf n58XWtzcxl/EBoRCnB/F21kaU5tAU1Fe0xAEAcbGh4RCnBfF24cRGxnBXxjWXxSEBoRCnB9F2x pQF8BS2FIXl9oEBoRCnB/F28bQWh6Y2YeSGYTEAcbGhwRCnBfF2RDaxxgYHNBWwVyEAcdHBEKc H0XYht8clJuQnBaHhkQBxseHxEKcH8XbFpgZRN/Z2RgEkQQBxgEGREKcF8XehpyG29SAUcSTmU QGxwRCnB9F2ccQmEZEn1uf0VpEBoRCnB9F2JJWHlQb14Ya01QEBoRCnB9F2JJWHlQb14Ya01QE BoRCnB9F2VJfn58XWtzcxl/EBoRCnB/F29uAW97exkYZhNNEAcSGBEKcF8XYmxkQhsFHWtSYkM QBx0cEQpwfRdhcgVcTGkcRxJfaRAHHRoRCnB9F2xpQF8BS2FIXl9oEBoRCnB9F2dDQU1kY3sBQ EJgEAcSEhEKcGcXZ1hPR1oaQnJIeGwQBx0ZEQpwfRdiG3xyUm5CcFoeGRAHGx4fEQpwfRdvYE5 ZbXtdS31LGRAHHR8RCnBnF2hMcFhreXhcbRtfEAccHxEKcH0XaF9TeE8BXBJFHmEQGhEKcEMXb EN9blpsE0NfQ2MQBxgcEQptfhcaEQpYTRdLEQ==

X-Sender-Id: hostingeremail|x-authuser|billing@quicken.helpqb.com

X-Sender-Id: hostingeremail|x-authuser|billing@quicken.helpqb.com

Arc-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=mailchannels.net; s=arc-2022; t=1709834548; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: dkim-signature; bh=yeIuZS+AIMlFJLCn+yOFDj3KLz2L16xwajXgzPMLO4M=; b=ALwJ6VsHP9U/y+OIQOmdOvf87soLsQoMmLHtRmSOqwdiYgRiRqUiKc6XKAIxHQLFPTNMiw stKY8SCtIEg4SCtDHwHiu+TEl58qqfnp6N6ASrvN8lCvkxm0XUs2hKpRYqyVnei8D9GXGB TEQI6AnBJMRjOWTp+jIFhhGSpmr2P4W6EyfaopWEq3Q/ZALSGX9IpnQRpSgkocTIxnrBvh +B9s+alhzD1VBrB+1AordKJ7wfoNMPMKGrtoBd1LaMDj2GgSVGO/BUs7LyYoF1yfvsk3d+ pGlibKDgl94LXYdw4xFLum2DNCaW1xkRHvle/b8A12sYIy0pzLEULePTLpQYqQ==

Dkim-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=quicken.helpqb.com; s=hostingermail-a; t=1709834543; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type; bh=5/Vri/fmvSiITg6RS4tZVLcFqy7a7FiTauLDQezZPDg=; b=gcul/K+M+6OWVG+nQ8iFu+1aBuzOMlsgNLRSc4X186zYlddny/Kra8We6BnzNRQ3u6tzmc QPKYqprCnvp9/kQKVoQwpRSjMYeY62ktEeGAQ9aRZNqKp+x6b99EaTynHAqi2t+XIU7lpp xxHHJSbPx3ApuP4OCyoSOh0XLs1l1u+wJfEKVh1X3orFZg9WtjGRcj2r7f1/vxkSkeZBo7 CVx064m1sODsHHpUPVwDDg5ismzlkmvz80lZeF0jrqV86PPWi3LjHbhmUgQz6jwDO4e9JA E8cXPJkq98RXp/LO9MiRrrEZj3H6++I5bbRdxV1TcYN9AX17cSmK9aWv077f9w==

Comments

  • QuickUserPSP
    QuickUserPSP Member, Windows Beta Beta
    Options

    @MisterH this information should be sent to spoof@quicken.com so Quicken's fraud investigation team can investigate this phishing attempt.

  • Chris_QPW
    Chris_QPW Member ✭✭✭✭
    Options

    Definitely phishing

    image.png

    Signature:
    This is my website: http://www.quicknperlwiz.com/
  • QuickUserPSP
    QuickUserPSP Member, Windows Beta Beta
    Options

    The other giveaway is the orphaned footnote with the stale date and stating for new subscribers only.

    image.png

This discussion has been closed.

Categories