20210601_PHISHING_SCAM_1

INVOICE
                                                                  DATE-01/06/2021

INVOICE NO:- TRF13NID7833
Order id :-  INTRPLYS 9196


BILL TO-CUSTOMER                                                                                     SHIP TO-RECIPIENT
     ##Email##                                            <Payment terms (due on receipt. Due in next day>


DESCRIPTION
QYT
UNIT PRICE
TOTAL
Windows defender protection plan
(1)
$691.99
$691.99
Shipping and handling


0.00
Chat support


0.00
DISCOUNT


0.00
TAX RATE


0.00%
SUBTOTAL


$691.99

Remarks/Payment Instructions:
If you would like to continue with the Services please ignore the invoice or if you wish to cancel it and go for the reversal of the money, please give us a call on +1 833-799-1729

NOTE: The charge will reflect in your statements in next 24 to 48 hours.

Regards

Windows defender Team
Interplay IT Support LLC
Helpline No. : - +1 833-799-1729


Received: from MBX05D-ORD1.mex08.mlsrvr.com (172.29.9.24) by
 MBX05C-ORD1.mex08.mlsrvr.com (172.29.9.23) with Microsoft SMTP Server (TLS)
 id 15.0.1497.2 via Mailbox Transport; Tue, 1 Jun 2021 14:00:17 -0500
Received: from MBX07D-ORD1.mex08.mlsrvr.com (172.29.9.30) by
 MBX05D-ORD1.mex08.mlsrvr.com (172.29.9.24) with Microsoft SMTP Server (TLS)
 id 15.0.1497.2; Tue, 1 Jun 2021 14:00:16 -0500
Received: from gate.forward.smtp.iad3a.emailsrvr.com (204.232.172.40) by
 MBX07D-ORD1.mex08.mlsrvr.com (172.29.9.30) with Microsoft SMTP Server (TLS)
 id 15.0.1497.2 via Frontend Transport; Tue, 1 Jun 2021 14:00:16 -0500
Return-Path: <[email protected]>
X-Spam-Threshold: 95
X-Spam-Score: 0
X-Spam-Flag: NO
Authentication-Results: smtp20.gate.iad3a.rsapps.net x-tls.subject="/C=US/ST=California/L=Mountain View/O=Google LLC/CN=smtp.gmail.com"; auth=pass (cipher=AES128-GCM-SHA256)
X-Virus-Scanned: OK
X-Orig-To:
X-Originating-Ip: [209.85.210.193]
Authentication-Results: smtp20.gate.iad3a.rsapps.net; iprev=pass policy.iprev="209.85.210.193"; spf=pass smtp.mailfrom="[email protected]" smtp.helo="mail-pf1-f193.google.com"; dkim=pass header.d=gmail.com; dmarc=pass (p=none; dis=none) header.from=gmail.com
X-Suspicious-Flag: NO
X-Classification-ID: 99b29184-c30b-11eb-98a2-525400aab2f3-1-1
Received: from [209.85.210.193] ([209.85.210.193:38548] helo=mail-pf1-f193.google.com)
	by smtp20.gate.iad3a.rsapps.net (envelope-from <[email protected]>)
	(ecelerity 4.2.38.62370 r(:)) with ESMTPS (cipher=AES128-GCM-SHA256
	subject="/C=US/ST=California/L=Mountain View/O=Google LLC/CN=smtp.gmail.com")
	id 68/83-16342-FB386B06; Tue, 01 Jun 2021 15:00:16 -0400
Received: by mail-pf1-f193.google.com with SMTP id z26so233347pfj.5
        for <>; Tue, 01 Jun 2021 12:00:15 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=gmail.com; s=20161025;
        h=from:to:subject:date:message-id:mime-version:thread-index
         :content-language;
        bh=T0frqPSNmOGdVOZ6Q4lErwIpPQ2OMtjWNU3LyoEFLw0=;
        b=PY+Usd4W5CYeKil1tlArtAEQTWFf8wj/uQbeYAQ7goJEC3h8rKcApsbExuTNfP8m5p
         FrK/T5qzyUnaMGSw8ex0I5pPhli9w+BwAdp28CKhvBV6bD089g5DW5mk6RfJPUc1v/m0
         APMmmcBDAFNmttKqpu0kkZ4wIQ1umVkxJuRQD7gtFmujkTpB6oGBCC1FK22aAvlD2NEd
         MkZFrxaY2tgwPRcv5+tRDXGdcEEwpHQNszMTG1ARY5hJ2fcU+Wfq8T50liPT0L1zMDf0
         6wCBU4gaLEyz8VsxSwtnlfRwZrnhItAkO3W0MGsK8dsnmRuS35lGz5JCv/S3W8kAMTY4
         meAw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=1e100.net; s=20161025;
        h=x-gm-message-state:from:to:subject:date:message-id:mime-version
         :thread-index:content-language;
        bh=T0frqPSNmOGdVOZ6Q4lErwIpPQ2OMtjWNU3LyoEFLw0=;
        b=Yw26dF95iX6+eM6cS0lylRdR7Mo3hD+xu4pOxCi/6suR9jqZxRHcwY7xVAuFN6B7Dc
         zdcAaj29wK+lK9gwGlPwIUhExmWWK0PsVjv/FEQxVJm+jbBhG8nYoKD4EaPe77q4I7PU
         YVZGtzShmdqjnXCYE1QIe0Tqo325JqDxZNbDQJ+rsuts06AIqZLdnBz2EjxCmaw0nnAZ
         IORtbZiAi417R4QYvnKSPGiAKJfW8B0n8HG7P7Bf3YGk3bpURh5eS+jqf+s+IHsqqnOi
         kexOgYgE9CagOYajZ07L4btnJ9wpA9eWXuCIpocCR+hQ4w5xMVaV0fnvwtlB41X8oI/R
         0R3w==
X-Gm-Message-State: AOAM531KWMo1JCTgwVWz17mPkgnYej4tmEs+i3/R2BmQSPQkvJfTxi49
	05kOAWuozz2QcU52ygmNaw1RHksoilJwc0iNvO+NJw==
X-Google-Smtp-Source: ABdhPJxOSpnnWdE0AbWZG26Bb34P1herfY2kleOU5qDB4rLmDwpzypRhZlCoqRV7gOKbU8q8p9aqGQ==
X-Received: by 2002:a63:5205:: with SMTP id g5mr29292433pgb.49.1622567577903;
        Tue, 01 Jun 2021 10:12:57 -0700 (PDT)
Received: from DESKTOPDPG96H8 ([23.81.207.100])
        by smtp.gmail.com with ESMTPSA id c20sm2658165pjr.35.2021.06.01.10.12.55
        for <>
        (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);
        Tue, 01 Jun 2021 10:12:57 -0700 (PDT)
From: "Javier	Moreno" <[email protected]>
To: <
Subject: Re:Auto renewal subscription information
Date: Tue, 1 Jun 2021 22:33:33 +0530
Message-ID: <[email protected]>
MIME-Version: 1.0
X-Mailer: Microsoft Outlook 16.0
Thread-Index: AddXA1PAOZlBsOvOSrGOcdtZ0fXxDw==
Content-Language: en-us
X-MS-Exchange-Organization-Network-Message-Id: 0e482d5d-c50f-4b9d-d4e4-08d9252f7e6b
X-MS-Exchange-Organization-AuthSource: MBX07D-ORD1.mex08.mlsrvr.com
X-MS-Exchange-Organization-AuthAs: Anonymous
Content-type: multipart/alternative;
	boundary="B_3705397676_1541164552"

> This message is in MIME format. Since your mail reader does not understand
this format, some or all of this message may not be legible.

--B_3705397676_1541164552
Content-type: text/plain;
	charset="UTF-8"
Content-transfer-encoding: 7bit