Phishing Mail header/PayPay

Return-Path: <[email protected]>
X-Original-To: [email protected]
Delivered-To: [email protected]
Received: from vps-122072.team7848033.com (unknown [162.241.97.75]) (using TLSv1.2 with
 cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by
 mail15i.protonmail.ch (Postfix) with ESMTPS id 239A118E for <[email protected]>;
 Wed, 11 Dec 2019 14:10:45 +0000 (UTC)
Received: from updateshostesddn by vps-122072.team7848033.com with local (Exim 4.92)
 (envelope-from <[email protected]>) id 1if2hK-0003XM-Fk for
 [email protected]; Wed, 11 Dec 2019 09:10:38 -0500
Authentication-Results: mail15i.protonmail.ch; dmarc=none (p=none dis=none)
 header.from=vps-122072.team7848033.com
Authentication-Results: mail15i.protonmail.ch; spf=tempfail
 [email protected]
Authentication-Results: mail15i.protonmail.ch; dkim=none
To: [email protected]
Subject: =?UTF-8?B?UGF5UGF5IDog44Ki44Kr44Km44Oz44OI44KS5pu05paw44GZ44KL?=
X-Php-Script: updates-hostes.ddns.net/alexus-smtp.php for 202.186.194.18
X-Php-Originating-Script: 1004:alexus-smtp.php
From: PayPay <[email protected]>
Mime-Version: 1.0
Content-Type: text/html
Reply-To: [email protected]
Message-Id: <[email protected]>
Date: Wed, 11 Dec 2019 09:10:38 -0500
X-Antiabuse: This header was added to track abuse, please include it with any abuse report
X-Antiabuse: Primary Hostname - vps-122072.team7848033.com
X-Antiabuse: Original Domain - protonmail.com
X-Antiabuse: Originator/Caller UID/GID - [1004 991] / [47 12]
X-Antiabuse: Sender Address Domain - vps-122072.team7848033.com
X-Get-Message-Sender-Via: vps-122072.team7848033.com: authenticated_id:
 updateshostesddn/primary_hostname/system user
X-Authenticated-Sender: vps-122072.team7848033.com: updateshostesddn
X-Source-Args: php-fpm: pool updates-hostes_ddns_net
X-Source-Dir: updates-hostes.ddns.net:/public_html
X-Spam-Flag: YES
X-Spam-Status: Yes, score=13.8 required=4.0 tests=FROM_EXCESS_BASE64,
 FROM_FMBLA_NEWDOM28,HTML_MESSAGE,MAY_BE_FORGED,RCVD_IN_IVMSIP,
 RCVD_IN_RP_RNBL,RDNS_NONE,T_SPF_HELO_TEMPERROR,T_SPF_TEMPERROR, T_TVD_MIME_NO_HEADERS
 autolearn=no autolearn_force=no version=3.4.2
X-Spam-Report: *
  5.0 RCVD_IN_IVMSIP RBL: listed on ivmSIP found at invaluement.com *
      [162.241.97.75 listed in sip.invaluement.local] *
  5.0 RCVD_IN_RP_RNBL RBL: Relay in RNBL, *
      https://senderscore.org/blacklistlookup/ *
      [162.241.97.75 listed in bl.score.senderscore.com] *
  0.0 T_SPF_TEMPERROR SPF: test of record failed (temperror) *
  0.0 T_SPF_HELO_TEMPERROR SPF: test of HELO record failed *
      (temperror) *
  0.0 T_TVD_MIME_NO_HEADERS BODY: No description available. *
  0.0 HTML_MESSAGE BODY: HTML included in message *
  3.0 RDNS_NONE Delivered to internal network by a host with no rDNS *
  0.0 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily *
  0.8 FROM_FMBLA_NEWDOM28 From domain was registered in last 14-28 *
      days *
  0.0 MAY_BE_FORGED Relay IP's reverse DNS does not resolve to IP
X-Spam-Level: *************
X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on maili.protonmail.ch
X-Pm-Origin: external
X-Pm-Content-Encryption: on-delivery
X-Pm-Transfer-Encryption: TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)