Created
March 15, 2026 20:14
-
-
Save gburd/d9e4988944894e44209335ca1d6c3d7e to your computer and use it in GitHub Desktop.
scam attempt from someone posing as "Google"
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Return-Path: <3Mge3aQcKBHEcdgTeanVddVaT.RdbVgTVQjgS.bT@cases-outbound-prod.bounces.google.com> | |
| Received: from phl-compute-01.internal (phl-compute-01.internal [10.202.2.41]) | |
| by slotpi14m52 (Cyrus 3.13.1-342-ga586d3c39-fm-20260310.001-ga586d3c3) with LMTPA; | |
| Sun, 15 Mar 2026 15:23:33 -0400 | |
| X-Cyrus-Session-Id: slotpi14m52-1773602613-3461163-2-15217075183232939 | |
| X-Sieve: CMU Sieve 3.0 | |
| X-Spam-known-sender: no | |
| X-Spam-sender-reputation: 951 (domain) | |
| X-Spam-score: 0.0 | |
| X-Spam-hits: HTML_IMAGE_ONLY_28 0.726, HTML_MESSAGE 0.001, ME_SC_SENDERREP -100, | |
| ME_SENDERREP_ALLOW -4, RCVD_IN_DNSWL_NONE -0.0001, | |
| RCVD_IN_MSPIKE_H3 0.001, RCVD_IN_MSPIKE_WL 0.001, SHORTCIRCUIT -0.0001, | |
| SPF_HELO_NONE 0.001, SPF_PASS -0.001, LANGUAGES en, BAYES_USED none, | |
| SA_VERSION 4.0.1 | |
| X-Spam-source: IP='209.85.160.204', Host='mail-qt1-f204.google.com', Country='US', | |
| FromHeader='com', MailFrom='com' | |
| X-Spam-charsets: plain='UTF-8', html='UTF-8' | |
| X-Resolved-to: greg@burd.me | |
| X-Delivered-to: greg@burd.me | |
| X-Mail-from: 3Mge3aQcKBHEcdgTeanVddVaT.RdbVgTVQjgS.bT@cases-outbound-prod.bounces.google.com | |
| Received: from phl-mx-08 ([10.202.2.207]) | |
| by phl-compute-01.internal (LMTPProxy); Sun, 15 Mar 2026 15:23:33 -0400 | |
| Received: from phl-mx-08.messagingengine.com (localhost [127.0.0.1]) | |
| by mailmx.phl.internal (Postfix) with ESMTP id 9348A15000AA | |
| for <greg@burd.me>; Sun, 15 Mar 2026 15:23:32 -0400 (EDT) | |
| Received: from mailmx.phl.internal (localhost [127.0.0.1]) | |
| by phl-mx-08.messagingengine.com (Authentication Milter) with ESMTP | |
| id D5FBAED4879.6A08415000C9; | |
| Sun, 15 Mar 2026 15:23:32 -0400 | |
| ARC-Seal: i=1; a=rsa-sha256; cv=none; d=messagingengine.com; s=fm1; t= | |
| 1773602612; b=Aq6m7cg1Lq5p0f7yrleb2535NgiSTjjDmVCjkRiBcDmer5okah | |
| nUp1B0mkj/FiHBTsGkrvMiF6qcct+Pif0CkiA+69eEvh26GkKIUwvYGaAINokyQ5 | |
| W7XYJYk1IDcU9QHRBKO+Q3Y0U+xomrkMYuh3gLi70RG/RoogS/rft0JKIkyHQyB1 | |
| IPMNKd6xkZlDulLgc8zrGknckMZzrz+nJSAE5uilzakqaOmE+m/8XHxY9iAKxWpa | |
| 0U9i2/SCu1i5RjmSRSi3yxzYMPTFLcSeov+34WrpYs4wUeQu1Wqqm2not//9qEBF | |
| GxGKBU4BrVTkA/C0NuoUREKadqLJ/63H/dhQ== | |
| ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d= | |
| messagingengine.com; h=mime-version:in-reply-to:reply-to:date | |
| :message-id:subject:from:to:content-type; s=fm1; t=1773602612; | |
| bh=pgtQIjhEobQgP6aCMBE5L7Phmt23MF/cNOhgFIEa9G4=; b=tc8Q8E8OMS1+ | |
| N6y+G2N7QTDF0unn412ZnQS34sAd4k9ROr9ClA7nR3VO2lrTYBtd15Cs5y55gTMP | |
| isreqjHgdiyweGF8237VyqzJ8gzFbcoFDOCRg5arKNaODJOMDYI679lIlaOIWVvd | |
| 5hsHs3b8Vlq/gd8xu47byZs5eWbPlczVcUvOnSR7JVSNe+mpwGQv235jo/kR4XML | |
| NKtE2if98xdILeEAO/c+MMfINb1e0XWSxW9SzElU/A7xAb96GY2vPTIHgy/YqbXj | |
| x/rSCIcuitlph9bkBtsJnbi0LcyUztKFPPavyGHCrMC7UsoNBRrpEHZjQptSR+Hp | |
| HWXBeWV3iQ== | |
| ARC-Authentication-Results: i=1; phl-mx-08.messagingengine.com; | |
| x-csa=none; | |
| x-me-sender=none; | |
| x-ptr=pass smtp.helo=mail-qt1-f204.google.com | |
| policy.ptr=mail-qt1-f204.google.com; | |
| bimi=none (No BIMI records found); | |
| arc=none (no signatures found); | |
| dkim=pass (2048-bit rsa key sha256) header.d=google.com | |
| header.i=@google.com header.b=V9XGiZSJ header.a=rsa-sha256 | |
| header.s=20251104; | |
| dmarc=pass policy.published-domain-policy=reject | |
| policy.applied-disposition=none policy.evaluated-disposition=none | |
| (p=reject,d=none,d.eval=none) policy.policy-from=p | |
| header.from=google.com; | |
| iprev=pass smtp.remote-ip=209.85.160.204 (mail-qt1-f204.google.com); | |
| spf=pass | |
| smtp.mailfrom= | |
| 3Mge3aQcKBHEcdgTeanVddVaT.RdbVgTVQjgS.bT@cases-outbound-prod.bounces.google.com | |
| smtp.helo=mail-qt1-f204.google.com | |
| X-ME-Authentication-Results: phl-mx-08.messagingengine.com; | |
| x-tls=pass smtp.version=TLSv1.3 smtp.cipher=TLS_AES_256_GCM_SHA384 | |
| smtp.bits=256/256; | |
| x-vs=clean score=0 state=0 | |
| Authentication-Results: phl-mx-08.messagingengine.com; | |
| x-csa=none; | |
| x-me-sender=none; | |
| x-ptr=pass smtp.helo=mail-qt1-f204.google.com | |
| policy.ptr=mail-qt1-f204.google.com | |
| Authentication-Results: phl-mx-08.messagingengine.com; | |
| bimi=none (No BIMI records found) | |
| Authentication-Results: phl-mx-08.messagingengine.com; | |
| arc=none (no signatures found) | |
| Authentication-Results: phl-mx-08.messagingengine.com; | |
| dkim=pass (2048-bit rsa key sha256) header.d=google.com | |
| header.i=@google.com header.b=V9XGiZSJ header.a=rsa-sha256 | |
| header.s=20251104; | |
| dmarc=pass policy.published-domain-policy=reject | |
| policy.applied-disposition=none policy.evaluated-disposition=none | |
| (p=reject,d=none,d.eval=none) policy.policy-from=p | |
| header.from=google.com; | |
| iprev=pass smtp.remote-ip=209.85.160.204 (mail-qt1-f204.google.com); | |
| spf=pass | |
| smtp.mailfrom= | |
| 3Mge3aQcKBHEcdgTeanVddVaT.RdbVgTVQjgS.bT@cases-outbound-prod.bounces.google.com | |
| smtp.helo=mail-qt1-f204.google.com | |
| X-ME-VSCause: gggruggvucftvghtrhhoucdtuddrgeefgedrtddtgddvleeifeduucetufdoteggodetrf | |
| dotffvucfrrhhofhhilhgvmecuhfgrshhtofgrihhlpdfurfetoffkrfgpnffqhgenuceu | |
| rghilhhouhhtmecufedttdenucenucfjughrpeggjghrfffkuffhvfgtsegrtderredttd | |
| ejnecuhfhrohhmpehnohhrvghplhihsehgohhoghhlvgdrtghomhenucggtffrrghtthgv | |
| rhhnpeeiteeggfekjeekheffgeekgedtueehjeelheehvdeftdfhteelgfegffekvedvte | |
| enucffohhmrghinhepghhoohhglhgvrdgtohhmnecukfhppedvtdelrdekhedrudeitddr | |
| vddtgeenucevlhhushhtvghrufhiiigvpedtnecurfgrrhgrmhepihhnvghtpedvtdelrd | |
| ekhedrudeitddrvddtgedphhgvlhhopehmrghilhdqqhhtuddqfhdvtdegrdhgohhoghhl | |
| vgdrtghomhdpmhgrihhlfhhrohhmpeeofefoghgvfegrsfgtmfeujffgtggughfvvggrnh | |
| gguggugggrvfdrtfgusgggghfvggfsjhhgufdrsgfvsegtrghsvghsqdhouhhtsghouhhn | |
| ugdqphhrohgurdgsohhunhgtvghsrdhgohhoghhlvgdrtghomheqpdhnsggprhgtphhtth | |
| hopedupdhrtghpthhtohepoehgrhgvghessghurhgurdhmvgeq | |
| X-ME-VSScore: 0 | |
| X-ME-VSCategory: clean | |
| X-ME-CSA: none | |
| X-ME-Received: <xmx:NAe3aSLv46SGVPtN3Q1E25AeAg6_RNIRUQa5jAGS-ZFCDyLsBiqmHw> | |
| X-ME-Received: <xmx:NAe3aSBo6Ae4cX8eyaizj9w6bxf5-2q-lTIitiOGXMng88agyMxEFQ> | |
| Received-SPF: pass | |
| (cases-outbound-prod.bounces.google.com ... _spf.google.com: 209.85.160.204 is authorized to use '3Mge3aQcKBHEcdgTeanVddVaT.RdbVgTVQjgS.bT@cases-outbound-prod.bounces.google.com' in 'mfrom' identity (mechanism 'ip4:209.85.128.0/17' matched)) | |
| receiver=phl-mx-08.messagingengine.com; | |
| identity=mailfrom; | |
| envelope-from="3Mge3aQcKBHEcdgTeanVddVaT.RdbVgTVQjgS.bT@cases-outbound-prod.bounces.google.com"; | |
| helo=mail-qt1-f204.google.com; | |
| client-ip=209.85.160.204 | |
| Received: from mail-qt1-f204.google.com (mail-qt1-f204.google.com [209.85.160.204]) | |
| (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) | |
| key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) | |
| (No client certificate requested) | |
| by phl-mx-08.messagingengine.com (Postfix) with ESMTPS id 6A08415000C9 | |
| for <greg@burd.me>; Sun, 15 Mar 2026 15:23:32 -0400 (EDT) | |
| Received: by mail-qt1-f204.google.com with SMTP id d75a77b69052e-5090dd0db80so3920371cf.0 | |
| for <greg@burd.me>; Sun, 15 Mar 2026 12:23:32 -0700 (PDT) | |
| DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; | |
| d=google.com; s=20251104; t=1773602611; x=1774207411; darn=burd.me; | |
| h=to:from:subject:message-id:date:reply-to:in-reply-to:mime-version | |
| :from:to:cc:subject:date:message-id:reply-to; | |
| bh=pgtQIjhEobQgP6aCMBE5L7Phmt23MF/cNOhgFIEa9G4=; | |
| b=V9XGiZSJyszLlZx+LGWJfVcc4B26Dicwme7ZFZ39DmqN0/ofUP8KeLnRWsn1VV8vPj | |
| rOpE2Cqq/I9GCYNhaNg2S+4u/La/D5KqStToINapkbZsu6OKjMMYPsK/br0Y3IDfPC3l | |
| D6OCT6O2w2qJcXhzoTLxyNJm4mgPDoDL0inVJHsfH4Q24p3vyQ7gJ2FWVYnAqKPqV+2P | |
| 6Q3iBbtCcUEZOGfiBTHzJ0KLJzNWPdLMnS/ceI/uaaqJhSga5BsPIsz9BAQAdytvK0qO | |
| 8MTejn4WxKsZ+iisbwoU2kuEYsiBHDF+Q8Kxy6HyfpT9zWKFvOC4EDo0fsAG2YtbnJVJ | |
| 9ekg== | |
| X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; | |
| d=1e100.net; s=20251104; t=1773602611; x=1774207411; | |
| h=to:from:subject:message-id:date:reply-to:in-reply-to:mime-version | |
| :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; | |
| bh=pgtQIjhEobQgP6aCMBE5L7Phmt23MF/cNOhgFIEa9G4=; | |
| b=T0bZ1Vnf/57awuzzlPsKXTPSvgEMdBOgsI8hjv7RoZsyhcL9PuQOSjFTRsJYe4rDil | |
| pDb1/tmoJA4f+ErhNrexDbJdQSdaQ/rhcM3Jjtndi+t1rXhQWihImEB5VTXuTrfQbKi6 | |
| icrVYoGuZqJu7Ul3+r98CMuDbAcnVsSRcA1ZE3Ffgrua4kobFNxhFf7J/V5TIE1c7TEL | |
| /JWVcPgS8b3ZlWnPpYzg7yUCz6/QeE5g4z9a33xl2vhIdDDGlYBuW5PCQZSKRB2587gL | |
| 3dtAO/06mu86XsTW5p3k3DbXmcoFU0hMzZxCFPHR/aUgprG0Byf2e0vhAkGPLqKByER0 | |
| 637w== | |
| X-Gm-Message-State: AOJu0Yw10a8WX/ljUGRS2HMn/RAdxP4zsm+NOScdz7CIEoRyv/h6HCKW | |
| a/lpQxw7LVsMjgaICHiLZUgVXCiOWogf0LT1xza5bhneIOeaBaltLFh9gCWPAtkyCXGHGuLudo8 | |
| zw6KV3VRnCUnocR9pcvJGKi3mbg3btsOCG73XNbdfL9YTVeK2OwW37xJB0RcHnvFHZfg7X+UXt5 | |
| AV1X9nEcqmyeY1qt+9YCBSu6s682A0PgnvWNakYLn4uGK3QWvuGW/JP1Hrc8KMK3aw3Iwt | |
| MIME-Version: 1.0 | |
| X-Received: by 2002:a05:622a:3c7:b0:509:15b6:f6a0 with SMTP id | |
| d75a77b69052e-509694c9448mr18352051cf.6.1773602610755; Sun, 15 Mar 2026 | |
| 12:23:30 -0700 (PDT) | |
| In-Reply-To: <177360260510.4180.8924891205295416913@action-notify.com> | |
| Reply-To: noreply@google.com | |
| Date: Sun, 15 Mar 2026 12:23:30 -0700 | |
| Message-ID: <autogen-java-29b65e13-e046-4f13-970a-140575353898@google.com> | |
| Subject: Re: Case ID: 651567 - Assigned Google Support Agent: Brian Sellers | |
| From: noreply@google.com | |
| To: greg@burd.me | |
| Content-Type: multipart/alternative; boundary="0000000000009711ed064d1509d4" | |
| --0000000000009711ed064d1509d4 | |
| Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes | |
| Content-Transfer-Encoding: base64 | |
| R29vZ2xlIFN1cHBvcnQNCltpbWFnZTogR29vZ2xlXQ0KDQoNCg0KSGVsbG8sDQoNCllvdSBlbWFp | |
| bGVkIGEgbm8tcmVwbHkgZW1haWwgYWRkcmVzcy4gUGxlYXNlIGNoZWNrIG91dA0Kc3VwcG9ydC5n | |
| b29nbGUuY29tL2FjY291bnRzIGZvciBhc3Npc3RhbmNlLg0KDQpCZXN0LA0KDQpUaGUgR29vZ2xl | |
| IEFjY291bnRzIFRlYW0NCkhFTFAgQ0VOVEVSIDxodHRwczovL3N1cHBvcnQuZ29vZ2xlLmNvbS8+ | |
| IMKpIEdvb2dsZSBJbmMuIDE2MDAgQW1waGl0aGVhdHJlDQpQYXJrd2F5IE1vdW50YWluIFZpZXcs | |
| IENBIDk0MDQzDQo= | |
| --0000000000009711ed064d1509d4 | |
| Content-Type: text/html; charset="UTF-8" | |
| Content-Transfer-Encoding: quoted-printable | |
| <meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3DUTF-8"><m= | |
| eta name=3D"viewport" content=3D"width=3Ddevice-width, initial-scale=3D1.0"= | |
| ><title>Google Support</title> | |
| <style type=3D"text/css">body{font-family:Open Sans, Helvetica Neue, Helvet= | |
| ica, Arial, sans-serif;margin:0 auto;background-color:#fafafa;} | |
| p{line-height:1.5em;} | |
| </style> | |
| <table align=3D"center" border=3D"0" cellpadding=3D"0" cellspacing=3D"0" cl= | |
| ass=3D"wrapper" style=3D"width:600px;margin:0 auto!important;border:1px sol= | |
| id #ccc;border-collapse:collapse;"> | |
| <tbody> | |
| <tr> | |
| <td class=3D"header" style=3D"width:600px;background-color:#1e88e5;he= | |
| ight:50px;padding-top:44px;padding-bottom:32px;padding-left:20px;"><img alt= | |
| =3D"Google" border=3D"0" src=3D"http://services.google.com/fh/files/emails/= | |
| logo_lockup_support_white.png" style=3D"border:none;text-decoration:none;po= | |
| sition:relative;left:20px;" width=3D"195" /></td> | |
| </tr> | |
| <tr> | |
| <td class=3D"main-content" style=3D"background-color:#fff;color:#444;= | |
| width:600px;height:auto;padding-left:20px;padding-right:20px;padding-bottom= | |
| :15px;"> | |
| <table border=3D"0" cellpadding=3D"0" cellspacing=3D"0" style=3D"bord= | |
| er-collapse:collapse;margin:0 auto!important" width=3D"480"> | |
| <tbody> | |
| <tr> | |
| <td class=3D"main-content-sub1" style=3D"margin:0 auto!importan= | |
| t;width:460px; color:#444;line-height:1em;padding-left:20px;padding-right:2= | |
| 0px;"> | |
| <p> </p> | |
| <p>Hello,</p> | |
| <p>You emailed a no-reply email address. Please check out <a hr= | |
| ef=3D"https://support.google.com/accounts" rel=3D"noopener">support.google.= | |
| com/accounts</a> for assistance.</p> | |
| <p>Best,</p> | |
| <p>The Google Accounts Team</p> | |
| </td> | |
| </tr> | |
| </tbody> | |
| </table> | |
| </td> | |
| </tr> | |
| <tr> | |
| <td class=3D"footer" style=3D"width:600px;height:50px;padding:20px 20= | |
| px 20px 20px; background-color:#fafafa;color:#444;font-size:12px;"> | |
| <table border=3D"0" cellpadding=3D"0" cellspacing=3D"0" style=3D"bord= | |
| er-collapse:collapse;width:500px;margin:0 auto;"> | |
| <tbody> | |
| <tr> | |
| <td width=3D"100"><a href=3D"https://support.google.com/" style= | |
| =3D"color:rgb(102,102,102);" target=3D"_blank">HELP CENTER</a></td> | |
| <td width=3D"200">=C2=A9 Google Inc. 1600 Amphitheatre Parkway = | |
| Mountain View, CA 94043</td> | |
| </tr> | |
| </tbody> | |
| </table> | |
| <img height=3D"1" src=3D"https://www.google.com/appserve/mkt/proof/im= | |
| g/u3bKEd0QpqmoxvggmyQlJTLPl8o=3D.gif" width=3D"3" /></td> | |
| </tr> | |
| </tbody> | |
| </table> | |
| --0000000000009711ed064d1509d4-- |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment