Geek squad phish from Microsoft Outlook Part 1
Posted by Dave Yadallee onX-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Mon, 11 May 2026 12:43:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))
(envelope-from
id 1wMVae-00000000HDs-19Ie
for dave@doctor.nl2k.ab.ca;
Mon, 11 May 2026 12:42:52 -0600
Resent-From: The Doctor
Resent-Date: Mon, 11 May 2026 12:42:52 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-eastus2azlp17011012.outbound.protection.outlook.com ([40.93.12.12]:14068 helo=BN8PR05CU002.outbound.protection.outlook.com)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384
(Exim 4.98.2 (FreeBSD))
(envelope-from
id 1wMTA8-000000006B1-2dLe
for doctor@doctor.nl2k.ab.ca;
Mon, 11 May 2026 10:07:32 -0600
Received: from MN0PR03CA0002.namprd03.prod.outlook.com (2603:10b6:208:52f::31)
by MN6PR18MB5444.namprd18.prod.outlook.com (2603:10b6:208:47b::16) with
Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9891.23; Mon, 11 May
2026 16:05:58 +0000
Received: from BL6PEPF0001AB54.namprd02.prod.outlook.com
(2603:10b6:208:52f:cafe::99) by MN0PR03CA0002.outlook.office365.com
(2603:10b6:208:52f::31) with Microsoft SMTP Server (version=TLS1_3,
cipher=TLS_AES_256_GCM_SHA384) id 15.20.9891.23 via Frontend Transport; Mon,
11 May 2026 16:05:58 +0000
Authentication-Results: spf=pass (sender IP is 209.85.128.73)
smtp.mailfrom=gmail.com; dkim=pass (signature was verified)
header.d=google.com;dkim=pass (signature was verified)
header.d=gmail.com;dmarc=pass action=none header.from=gmail.com;compauth=pass
reason=100
Received-SPF: Pass (protection.outlook.com: domain of gmail.com designates
209.85.128.73 as permitted sender) receiver=protection.outlook.com;
client-ip=209.85.128.73; helo=mail-wm1-f73.google.com; pr=C
Received: from mail-wm1-f73.google.com (209.85.128.73) by
BL6PEPF0001AB54.mail.protection.outlook.com (10.167.241.6) with Microsoft
SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.25.13
via Frontend Transport; Mon, 11 May 2026 16:05:58 +0000
X-IncomingTopHeaderMarker:
OriginalChecksum:FBB4CA4D47C93B9940D02205B933F92718B1A45AA160ECCFC838564C847EA15A;UpperCasedChecksum:CFCF916B377C88208D20496F88AE3078B6FDDF4CCEE9242F9E7D660DC80F049A;SizeAsReceived:3418;Count:15
Received: by mail-wm1-f73.google.com with SMTP id 5b1f17b1804b1-48d035e8593so31985825e9.0
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=google.com; s=20251104; t=1778515557; x=1779120357; darn=groups.outlook.com;
h=to:from:subject:date:message-id:sender:reply-to:mime-version:from
:to:cc:subject:date:message-id:reply-to;
bh=hB8DMu1EBHSxViXdZ9sEisTr6GqeccGRk+mIXlkgBiI=;
b=jcWRlPWBAVwGvpsAMexnarF2mn4vatcjQ1z1ZtZUYSpesrt0xiNBZoUpBxtZWwsthD
/FJMl4HgUs5EipD5DwYorGANIbOrsZ7HR6eJL5R63WOP0//FA/EbdZmbOa8KA87B3UxE
82Do5soLia3DEkGfwiyjN/OJ2agKVwkaZ8p73ZNPC6aUke0Y9adVyQyI/CYODkcS2tfo
HDryoZ/+iGTjE4ViQP3Uc+K6sh3L6sACoiTBPZakZMHsl8iZ5RTkOtq8cP0Qz3nBxNy7
y1m5Bkd53XjnVhW/GjNDimm+l66lab20FzcbS4hRIc0AandEWKiKM2bOs4/X9aRlHgwk
iLEw==
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20251104; t=1778515557; x=1779120357; darn=groups.outlook.com;
h=to:from:subject:date:message-id:sender:reply-to:mime-version:from
:to:cc:subject:date:message-id:reply-to;
bh=hB8DMu1EBHSxViXdZ9sEisTr6GqeccGRk+mIXlkgBiI=;
b=Qrt64AAGJnqvB4tK9kCa4Ibsmqd2MmdGxQ24HeKsoULsMzlBYf4Pi60VW/izvaol8e
1agDpQC3fiuoX6vX8mEvim34QiW98AgsfHB+L0dWY6uLEcvssMgnXyMGB50lDrIEyg49
55iwEJmdE9NZ2HwFVCbTMfbPX5xPEaZqLA7EMW3gkfApxw38XBpO+/Jpr2Oq3XRGufmS
5OANrihj0hNs6Et11sdT7EnOSVXFmE23gS+bO8Px6nJRSLAbfpy23J0D4EGsw9cJix6U
xGT7l6k9s1QPeqQHTCEtGHBgdI2+2oRzWZHo8a56+ux4fmOfpUrikDIL8eI1K/3woZkY
6BdQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20251104; t=1778515557; x=1779120357;
h=to:from:subject:date:message-id:sender:reply-to:mime-version
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
bh=hB8DMu1EBHSxViXdZ9sEisTr6GqeccGRk+mIXlkgBiI=;
b=KEeAjmYRmE0Lr1go/0x3mH2qzoDGgFMnWCyQcsI2nrnqd2g7O4TDU8vJHkWQqd1nEi
LLPBxm/4M5oyKvsp1kyEiNNphNus5+2fjyH2vrAB8eOkRawvKrd+AQJqHqFpgObZbPMu
VxoVKQs2e/SDXmfyNNXNwgUYZXSgWwNCchyjN5DtHipjxn6UfYrSygeTd8xwkS+Iy9iW
diLnAY5fWYZmLfMs34lgl8N+Lt5B5COWx/YCZuALx0yojUiI3S+Htbh/6Sin4OzEfNOw
OB73YzpgY1FIVcCxMWzglCGo7Vgm5p6Q6pBCeN5mGY7xucujbf4v08bfv6oUEHCv0k/G
KI7w==
X-Gm-Message-State: AOJu0YxSiftIo+pSGZAhPX0kATuPF53Eh0bC191tBK8/ga4MW891TjyE
maQuoCH2Vj7zuxnRyte2LcCRcUlNS5pgLOCM9+H9yi4J85ZXZwKAtqrJbsxkMt980wMil8/iJvF
6gt9OZ7DgX68eAmvY+HzC9x+P9VTQWch0Gfk=
MIME-Version: 1.0
X-Received: by 2002:a05:600c:3e0c:b0:489:fec9:a17e with SMTP id
5b1f17b1804b1-48e6768514dmr259024865e9.12.1778515557097; Mon, 11 May 2026
09:05:57 -0700 (PDT)
Reply-To: Haresasz Nxysarwsa
Sender: =?UTF-8?Q?Kalend=C3=A1r_Google?=
Message-ID:
Date: Mon, 11 May 2026 16:05:57 +0000
Subject: =?UTF-8?Q?Pozv=C3=A1nky=3A_Subscription_Renewal_Confirmation_=2D_Geek_?=
=?UTF-8?Q?Squad_Protection_=40_po_11=2E_m=C3=A1j_2026_=28cynthiaperez389903=40grou?=
=?UTF-8?Q?ps=2Eoutlook=2Ecom=29?=
From: Haresasz Nxysarwsa
To: cynthiaperez389903@groups.outlook.com
Content-Type: multipart/mixed; boundary="00000000000002327306518cec99"
X-IncomingHeaderCount: 15
X-EOPAttributedMessage: 0
X-EOPTenantAttributedMessage: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa:0
X-MS-PublicTrafficType: Email
X-MS-TrafficTypeDiagnostic: BL6PEPF0001AB54:EE_|MN6PR18MB5444:EE_
X-MS-Office365-Filtering-Correlation-Id: 3f8accb7-7425-4a05-ad0c-08deaf773077
X-MS-Exchange-EOPDirect: true
X-Sender-IP: 209.85.128.73
X-SID-PRA: HARESSAZNZXRRSXAXZ321@GMAIL.COM
X-SID-Result: PASS
X-MS-Consumer-Group-Expansion-Loop: cynthiaperez389903@groups.outlook.com
X-MS-Exchange-Group-Expansion-Loop: cynthiaperez389903@groups.outlook.com
X-Microsoft-Antispam:
BCL:0;ARA:1444111002|9400799043|3151999006|6019299003|32020799003|1680799066|9020799019|34130799006|4040799016|970799063|26000799027|5139299004|26130799012|22000799015|16200799027|9000799056|29080799009|6092099016|24102599021|21002599022;