RAW email header — Google/Gmail impersonation attempt

Delivered-To: a***@gmail.com [REDACTED]
Received: by 2002:a54:3bd1:0:b0:2c2:6146:6f6f with SMTP id g17csp1084402ecu;
        Thu, 8 Jan 2026 09:02:42 -0800 (PST)
X-Google-Smtp-Source: [REDACTED]
X-Received: by 2002:a05:6808:82c6:b0:45a:6d59:42d6 with SMTP id [REDACTED];
        Thu, 08 Jan 2026 09:02:42 -0800 (PST)
ARC-Seal: i=2; a=rsa-sha256; t=1767891762; cv=pass;
        d=google.com; s=arc-20240605;
        b=gJ+cFRmwXBiMgWf2WNapXzgWsurVCfSVyFXpIWa65sB66lFpYJFtaZOvH4kd/xwzY6
         m5el+2D93pJxNGS0g3x9aKsIXTb5qPwVoQZ1ZfXr6Jyy5ezLci3709/2j7/kQr3PZUQ+
         h3y+Mp55sr77RgglK+v2VjpzWRb+gVkC9ptVQEU1gUbsPSxrmzWHQP9QatrDFXfrith3
         DTQbuJeXn20KtTiGPGYc82jtz8gl10GyxKHUIZxctRtvO9YEoLtDo8TAZH+3/RzXaVV+
         XsEsExKWJleu3h/1FadaUQMNyvyPwmFVNscUY3N5NtzdKHp4+DPvA++ysnvlwYD1mQn8
         2llg==
ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;
        h=mime-version:date:message-id:subject:reply-to:to:sender:from
         :dkim-signature;
        bh=odhnKCONUpv2jteBgGjRNnUGqy8ooiFOp0gQssYrPXU=;
        fh=wrb9j71lbkIlfPUaWz9CYoKLTowLDxny4AyeoFkEmAI=;
        b=e+qqGg3oV4Vw0a8aG2JidN7QXkQqELrKNs8sR5llO5mZkpaJ2f514YCA6INGQSNpW2
         uLHZthCC8luFmc5XHbvheB6r2fIQlSdnuR16w0M5zR4/VCRmUybDWBUnUuzVtkhKHakv
         v+pIsX2EAjaOWspJ4+hXlwy5HVWODnrZWrtFIRwCkywZ9bzUDXOEMKpHgAxrhQWTyZ8g
         dd1+KXZE+TswzWrt+NMnW6wnixzVI7CSWx8EzzcPDvoXMlsRlNhol6AYK0KzDxfGfwUa
         d5ZlV5cEGsbnGtbWBpKbRgRGvg12XN3I3X4p+pxODQzFHLq3U4mEllzabfLLPFO1z7Gm
         2jqg==;
        dara=google.com
ARC-Authentication-Results: i=2; mx.google.com;
       dkim=permerror (no key for signature) [email protected] header.s=default header.b="jNFX/vAV";
       arc=pass (i=1);
       spf=pass (google.com: domain of [email protected] designates 23.83.220.50 as permitted sender) [email protected]
Return-Path: <[email protected]>
Received: from dormouse.yew.relay.mailchannels.net (dormouse.yew.relay.mailchannels.net. [23.83.220.50])
        by mx.google.com with ESMTPS id 5614622812f47-45a5e31edcfsi4779801b6e.78.2026.01.08.09.02.40
        for <a***@gmail.com> [REDACTED]
        (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
        Thu, 08 Jan 2026 09:02:41 -0800 (PST)
Received-SPF: pass (google.com: domain of [email protected] designates 23.83.220.50 as permitted sender) client-ip=23.83.220.50;
Authentication-Results: mx.google.com;
       dkim=permerror (no key for signature) [email protected] header.s=default header.b="jNFX/vAV";
       arc=pass (i=1);
       spf=pass (google.com: domain of [email protected] designates 23.83.220.50 as permitted sender) [email protected]
X-Sender-Id: nocmonitoringorg|x-authuser|[email protected]
Received: from relay.mailchannels.net (localhost [127.0.0.1]) by relay.mailchannels.net (Postfix) with ESMTP id E91D38C2F90; Thu, 08 Jan 2026 17:02:39 +0000 (UTC)
Received: from usvip4.noc401.com (100-107-79-161.trex-nlb.outbound.svc.cluster.local [100.107.79.161]) (Authenticated sender: nocmonitoringorg) by relay.mailchannels.net (Postfix) with ESMTPA id 2762C8C23F5 for <a***@gmail.com> [REDACTED]; Thu, 08 Jan 2026 17:02:38 +0000 (UTC)
ARC-Seal: i=1; a=rsa-sha256; d=mailchannels.net; s=arc-2022; cv=none; t=1767891758; b=y2JTcvWPNcRZoGuT6pW8d41HBDLorHJ5HIR+aUfXWkriSFJGmYgENlSkwo5BKlisWeAGKG SoosX3aiUTzl95GXWoNwJ6tZOEwZSiEFvHCsofpxqotgFidFpjX4pjBk3dvB8HsYAQwnoV WDjS8OmmI+aBHLu+D+4UJvZOFD1GD/2Ceylx0XTiacMIzJPrrPxJl5pIgUZ0PYUyAqWXO4 9I1UzYqfp4dnzTXC256/jA+4yKRuSaTKdk3mk4BPo6zITPJr82s8zb6fjo2e8JEfg5b5Mj X3T7B0ifP6O07SBxiD34UML2h0y7cVBH4vle56Bv1jkqkWGFSx+h5ojNemV3Hg==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=mailchannels.net; s=arc-2022; t=1767891758; h=from:from:sender:sender:reply-to:reply-to:subject:subject:date:date:
	 message-id:message-id:to:to:cc:mime-version:mime-version:
	 content-type:content-type:dkim-signature; bh=odhnKCONUpv2jteBgGjRNnUGqy8ooiFOp0gQssYrPXU=; b=Ehy28H1gBX0b4IBzHyF3A7WW8FFZnfws5yg8qdyQvOQtNBIKa9UA5tVKRdVVBU9gCoQ+l0 VTapaM/0Gfy7sR1yVhH10Hf+tCc77z3+uHKmpJ74wNRkOjS2GkkpPEKLkNwFQ2PQiE/JxV h3VKuhziuzOpA0JRcxh4IignbK4K5LxIJoa1QjBBzoxjTIfEoSjaixJ2vsRt/viSDO37fu dxgnlGYrM6rtjGNg0/5DZ5EsttOpzsRIYr/3P9vYJsiVJ3WcBKWBoPCXR1cRzI8pkVjt2o zedr0nS92CnJQLgA+KBAwj0WA7rydRwvWzbmhq9gzov0hO4SiVJtiK/gjkqKsQ==
ARC-Authentication-Results: i=1; rspamd-79549fd459-gzn8q; auth=pass smtp.auth=nocmonitoringorg [email protected]
X-Sender-Id: nocmonitoringorg|x-authuser|[email protected]
X-MC-Relay: Good
X-MC-Copy: stored-urls
X-MailChannels-SenderId: nocmonitoringorg|x-authuser|[email protected]
X-MailChannels-Auth-Id: nocmonitoringorg
X-Versed-Descriptive: 467fa6a54742658a_1767891758618_741182121
X-MC-Loop-Signature: 1767891758618:216402612
X-MC-Ingress-Time: 1767891758618
Received: from usvip4.noc401.com (we.love.servers.at.ioflood.net [184.164.74.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384) by 100.107.79.161 (trex/7.1.3); Thu, 08 Jan 2026 17:02:38 +0000
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=activity-google.com; s=default; h=Content-Type:MIME-Version:Date:Message-ID :Subject:Reply-To:To:Sender:From:Cc:Content-Transfer-Encoding:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=odhnKCONUpv2jteBgGjRNnUGqy8ooiFOp0gQssYrPXU=; b=jNFX/vAV+HowfSdpaHqbrBNYPt SDtK90V1j51WFtyHSQQF82arSSWwNp/Bmfbmjj3sXl8irtHg+Dyp1VJTh2hKCIcLUnCO1e5B9NFq+ qFDpAJD13Cn+VtdHhwRwhnhfAxVmA9zehwTFO6mfNNEASmKwMSWCUu5cU6fbM2ynOfSf5ZwAUkUzd 8quRkgPIsvayMOaE9VIXzFrseZjP8F7Q0RlL9Yi55tzLoTG6DH07yX0BoX/jFGXgmp0ZIdLe3e855 v7zYhEZYfBU+YhrOWbDyRZbHdvyiWuC1IpvtbYS2jk9bdBIJpMf8E+1FKQshauB0P1hOjSdyyY4gz ZAdlTdBg==;
Received: from 23-29-114-41.static.hvvc.us ([23.29.114.41]:48920 helo=thirsty-ramanujan.hivelocitydns.com) by usvip4.noc401.com with esmtpsa
  (TLS1.3) tls TLS_AES_256_GCM_SHA384 (Exim 4.99) (envelope-from <[email protected]>) id 1vdtOh-00000003vRU-3N9i for a***@gmail.com [REDACTED]; Thu, 08 Jan 2026 10:02:35 -0700
From: Gmail <[email protected]>
Sender: [email protected]
To: a***@gmail.com [REDACTED]
Reply-To: [email protected]
Subject: Assigned representative
Message-ID: <[REDACTED]@activity-google.com>
Date: Thu, 08 Jan 2026 17:02:36 +0000
MIME-Version: 1.0
Content-Type: multipart/related; type="text/html"; boundary="--_NmP-ec785cb0674e4865-Part_1"
X-AuthUser: [email protected]

----_NmP-ec785cb0674e4865-Part_1
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE html>
<html lang=3D"en">

<head>
    <meta charset=3D"UTF-8">
    <meta name=3D"viewport" content=3D"width=3Ddevice-width, initial-scale=
=3D1.0">
</head>

<body>
    <div class=3D"">
        <div class=3D"aHl"></div>
        <div id=3D":nb" tabindex=3D"-1"></div>
        <div id=3D":n1" class=3D"ii gt"
            jslog=3D"20277; u014N:xr6bB; 1:WyIjdGhyZWFkLWY6MTgzMjgzNDQ1OTI2=
MjcwMzIwOSJd; 4:WyIjbXNnLWY6MTgzMjgzNDQ1OTI2MjcwMzIwOSIsbnVsbCxudWxsLG51bGw=
sMSwwLFsxLDAsMF0sNzMsNDY2LG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCwxLG51bGwsbnVsbC=
xbM10sbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsMCwwXQ..">
            <div id=3D":n0" class=3D"a3s aiL msg5549559371351534799"><u></u=
>
                <div style=3D"margin:0;padding:0" bgcolor=3D"#FFFFFF">
                    <table width=3D"100%" height=3D"100%" style=3D"min-widt=
h:348px" border=3D"0" cellspacing=3D"0" cellpadding=3D"0"
                        lang=3D"en">
                        <tbody>
                            <tr height=3D"32" style=3D"height:32px">
                                <td></td>
                            </tr>
                            <tr align=3D"center">
                                <td>
                                    <div>
                                        <div></div>
                                    </div>
                                    <table border=3D"0" cellspacing=3D"0" c=
ellpadding=3D"0"
                                        style=3D"padding-bottom:20px;max-wi=
dth:516px;min-width:220px">
                                        <tbody>
                                            <tr>
                                                <td width=3D"8" style=3D"wi=
dth:8px"></td>
                                                <td>
                                                    <div style=3D"border-st=
yle:solid;border-width:thin;border-color:#dadce0;border-radius:8px;padding:=
40px 20px"
                                                        align=3D"center" cl=
ass=3D"m_5549559371351534799mdv2rw"><img
                                                            src=3D"cid:goog=
le"
                                                            width=3D"74" he=
ight=3D"24" aria-hidden=3D"true"
                                                            style=3D"margin=
-bottom:16px" alt=3D"Google" class=3D"CToWUd"
                                                            data-bit=3D"iit=
">
                                                        <div
                                                            style=3D"font-f=
amily:'Google Sans',Roboto,RobotoDraft,Helvetica,Arial,sans-serif;border-bo=
ttom:thin solid #dadce0;color:rgba(0,0,0,0.87);line-height:32px;padding-bot=
tom:24px;text-align:center;word-break:break-word">
                                                            <div style=3D"f=
ont-size:20px">Case verification : G-878499
                                                            </div>
                                                           <table align=3D"=
center" style=3D"margin-top:8px"><tbody><tr style=3D"line-height:normal"><t=
d align=3D"right" style=3D"padding-right:8px"></td><td><a style=3D"font-fam=
ily:'Google Sans',Roboto,RobotoDraft,Helvetica,Arial,sans-serif;color:rgba(=
0,0,0,0.87);font-size:14px;line-height:20px">a***@gmail.com [REDACTED]</a></td></t=
r></tbody></table>
                                                        </div>
                                                        <div
                                                            style=3D"font-f=
amily:Roboto-Regular,Helvetica,Arial,sans-serif;font-size:14px;color:rgba(0=
,0,0,0.87);line-height:20px;padding-top:20px;text-align:center">
                                                           For the initiate=
d case G-878499,<strong> Andreas T. [REDACTED]</strong>has been assigned to ass=
ist you. Please verify their identity before sharing any information.<br><b=
r>Support representatives will never ask you to share your password or disc=
lose any confidential information.<div
                                                                style=3D"pa=
dding-top:32px;text-align:center"></div>
                                                        </div>
                                                        <div
                                                            style=3D"font-f=
amily:Roboto-Regular,Helvetica,Arial,sans-serif;padding-top:20px;font-size:=
12px;line-height:16px;color:#5f6368;letter-spacing:0.3px;text-align:center"=
>
                                                            You can also vi=
ew your security notifications anytime at:<br><a
                                                                href=3D"{li=
nk}"
                                                                style=3D"fo=
nt-family:Roboto-Regular,Helvetica,Arial,sans-serif;color:rgba(56, 12, 202,=
 0.87);text-decoration:inherit">https://myaccount.google.com/<wbr>notificat=
ions</a>
                                                        </div>
                                                    </div>
                                                    <div style=3D"text-alig=
n:left">
                                                        <div
                                                            style=3D"font-f=
amily:Roboto-Regular,Helvetica,Arial,sans-serif;color:rgba(0,0,0,0.54);font=
-size:11px;line-height:18px;padding-top:12px;text-align:center">
                                                            <div>You receiv=
ed this email to let you know about important
                                                                changes to =
your Google Account and services.</div>
                                                            <div style=3D"d=
irection:ltr">=C2=A9 2025 Google LLC, <a
                                                                    class=
=3D"m_5549559371351534799afal"
                                                                    style=
=3D"font-family:Roboto-Regular,Helvetica,Arial,sans-serif;color:rgba(0,0,0,=
0.54);font-size:11px;line-height:18px;padding-top:12px;text-align:center">1=
600
                                                                    Amphith=
eatre Parkway, Mountain View, CA 94043,
                                                                    USA</a>
                                                            </div>
                                                        </div>
                                                    </div>
                                                </td>
                                                <td width=3D"8" style=3D"wi=
dth:8px"></td>
                                            </tr>
                                        </tbody>
                                    </table>
                                </td>
                            </tr>
                            <tr height=3D"32" style=3D"height:32px">
                                <td></td>
                            </tr>
                        </tbody>
                    </table>
                </div>
            </div>
        </div>
    </div>
</body>

</html>
----_NmP-ec785cb0674e4865-Part_1
Content-Type: image/png; name=google.png
Content-ID: <google>
Content-Transfer-Encoding: base64
Content-Disposition: inline; filename=google.png


----_NmP-ec785cb0674e4865-Part_1--