Bitcoin phish from Microsoft Outlook PArt 3
Posted by Dave Yadallee on
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[40.93.2.12 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[40.93.2.12 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[40.93.2.12 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[40.93.2.12 listed in dnsbl.ahbl.org]
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[40.93.2.12 listed in list.dnswl.org]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
1.0 HK_RANDOM_FROM From username looks random
3.5 VOWEL_FROM_7 Impronouncable from header (7+ consecutive vowels)
0.5 FROM_LOCAL_NOVOWEL From: localpart has series of non-vowel letters
1.0 HK_RANDOM_REPLYTO Reply-To username looks random
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[40.93.2.12 listed in bl.score.senderscore.com]
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[40.93.2.12 listed in wl.mailspike.net]
-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay
domain
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[haressaznzxrrsxaxz321(at)gmail.com]
0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail
domains are different
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
[haressaznzxrrsxaxz321(at)gmail.com]
2.6 HK_SCAM_N13 BODY: No description available.
0.1 TW_RW BODY: Odd Letter Triples with RW
0.3 LONGWORD BODY: Uses overlong words
0.6 MEGALONGWORD BODY: Uses really overlong words
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars
0.2 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and EnvelopeFrom
freemail headers are different
0.1 TO_IN_SUBJ To address is in Subject
3.0 LONG_INVISIBLE_TEXT Long block of hidden text - bayes poison?
Subject: {SPAM?} =?UTF-8?Q?Pozv=C3=A1nky=3A_Important_Transaction_Alert_=2D_BTC_Order_S?=
=?UTF-8?Q?ubmitted_=40_po_22=2E_j=C3=BAn_2026_=28cynthiaperez389903=40groups=2Eoutlo?=
=?UTF-8?Q?ok=2Ecom=29?=
Haresasz Nxysarwsa has invited you to Important Transaction Alert – BTC Order Submitted
Title: Important Transaction Alert – BTC Order Submitted
When: June 22, 2026
Organizer:
Haresasz Nxysarwsa
Description: Dear Customer,
This email confirms that your PayPal payment for Bitcoin has been received and your order is now under review.
Transaction Overview:
Payment Method: PayPal
Asset Purchased: Bitcoin (BTC)
Amount Paid: $500.00
Current Status: Under Review
Our security team is currently validating the transaction. Once approved, your order will be completed automatically.
If you did not authorize this activity, please call +1 813 934 5533 immediately to prevent further processing.
Thank you for your prompt attention.
Sincerely,
Customer Support Team
Attendees:
cynthiaperez389903@groups.outlook.com
Dear Customer,
This email confirms that your PayPal payment for Bitcoin has been received and your order is now under review.
Transaction Overview:
Payment Method: PayPal
Asset Purchased: Bitcoin (BTC)
Amount Paid: $500.00
Current Status: Under Review
Our security team is currently validating the transaction. Once approved, your order will be completed automatically.
If you did not authorize this activity, please call +1 813 934 5533 immediately to prevent further processing.
Thank you for your prompt attention.
Sincerely,
Customer Support Team
Kedy
pondelok 22. jún 2026
Organizátor
Haresasz Nxysarwsa
haressaznzxrrsxaxz321@gmail.com
Hostia
(Zoznam hostí bol na žiadosť organizátora skrytý)
Odpoveď na cynthiaperez389903@groups.outlook.com
Áno
Nie
Možno
Ďalšie možnosti
Pozvánka z Kalendára Google
Túto správu ste dostali, pretože ste účastníkom danej udalosti.
Ak túto pozvánku prepošlete, ktorýkoľvek jej príjemca bude môcť odoslať odpoveď organizátorovi, byť pridaný do zoznamu hostí, pozývať iných bez ohľadu na ich vlastný stav pozvánky alebo meniť vaše potvrdenie účasti. Ďalšie informácie
[40.93.2.12 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[40.93.2.12 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[40.93.2.12 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[40.93.2.12 listed in dnsbl.ahbl.org]
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[40.93.2.12 listed in list.dnswl.org]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
1.0 HK_RANDOM_FROM From username looks random
3.5 VOWEL_FROM_7 Impronouncable from header (7+ consecutive vowels)
0.5 FROM_LOCAL_NOVOWEL From: localpart has series of non-vowel letters
1.0 HK_RANDOM_REPLYTO Reply-To username looks random
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[40.93.2.12 listed in bl.score.senderscore.com]
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[40.93.2.12 listed in wl.mailspike.net]
-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay
domain
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[haressaznzxrrsxaxz321(at)gmail.com]
0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail
domains are different
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
[haressaznzxrrsxaxz321(at)gmail.com]
2.6 HK_SCAM_N13 BODY: No description available.
0.1 TW_RW BODY: Odd Letter Triples with RW
0.3 LONGWORD BODY: Uses overlong words
0.6 MEGALONGWORD BODY: Uses really overlong words
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars
0.2 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and EnvelopeFrom
freemail headers are different
0.1 TO_IN_SUBJ To address is in Subject
3.0 LONG_INVISIBLE_TEXT Long block of hidden text - bayes poison?
Subject: {SPAM?} =?UTF-8?Q?Pozv=C3=A1nky=3A_Important_Transaction_Alert_=2D_BTC_Order_S?=
=?UTF-8?Q?ubmitted_=40_po_22=2E_j=C3=BAn_2026_=28cynthiaperez389903=40groups=2Eoutlo?=
=?UTF-8?Q?ok=2Ecom=29?=
Haresasz Nxysarwsa has invited you to Important Transaction Alert – BTC Order Submitted
Title: Important Transaction Alert – BTC Order Submitted
When: June 22, 2026
Organizer:
Haresasz Nxysarwsa
Description: Dear Customer,
This email confirms that your PayPal payment for Bitcoin has been received and your order is now under review.
Transaction Overview:
Payment Method: PayPal
Asset Purchased: Bitcoin (BTC)
Amount Paid: $500.00
Current Status: Under Review
Our security team is currently validating the transaction. Once approved, your order will be completed automatically.
If you did not authorize this activity, please call +1 813 934 5533 immediately to prevent further processing.
Thank you for your prompt attention.
Sincerely,
Customer Support Team
Attendees:
cynthiaperez389903@groups.outlook.com
Dear Customer,
This email confirms that your PayPal payment for Bitcoin has been received and your order is now under review.
Transaction Overview:
Payment Method: PayPal
Asset Purchased: Bitcoin (BTC)
Amount Paid: $500.00
Current Status: Under Review
Our security team is currently validating the transaction. Once approved, your order will be completed automatically.
If you did not authorize this activity, please call +1 813 934 5533 immediately to prevent further processing.
Thank you for your prompt attention.
Sincerely,
Customer Support Team
Kedy
pondelok 22. jún 2026
Organizátor
Haresasz Nxysarwsa
haressaznzxrrsxaxz321@gmail.com
Hostia
(Zoznam hostí bol na žiadosť organizátora skrytý)
Odpoveď na cynthiaperez389903@groups.outlook.com
Áno
Nie
Možno
Ďalšie možnosti
Pozvánka z Kalendára Google
Túto správu ste dostali, pretože ste účastníkom danej udalosti.
Ak túto pozvánku prepošlete, ktorýkoľvek jej príjemca bude môcť odoslať odpoveď organizátorovi, byť pridaný do zoznamu hostí, pozývať iných bez ohľadu na ich vlastný stav pozvánky alebo meniť vaše potvrdenie účasti. Ďalšie informácie