mailheader/Phishing/PayPay

Return-Path: <[email protected]>
X-Original-To: [email protected]
Delivered-To: [email protected]
Received: from serverhosthouse.ddns.net (unknown [103.76.88.93]) (using TLSv1.2 with
 cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by
 mail17i.protonmail.ch (Postfix) with ESMTPS id 89C673000080 for
 <[email protected]>; Sun, 24 Nov 2019 05:39:11 +0000 (UTC)
Received: from hostercongisendd by serverhosthouse.ddns.net with local (Exim 4.92)
 (envelope-from <[email protected]>) id 1iYGdp-0000xM-DT for
 [email protected]; Fri, 22 Nov 2019 16:39:01 -0500
Authentication-Results: mail17i.protonmail.ch; dmarc=none (p=none dis=none)
 header.from=intl.apaypay.co.jp
Authentication-Results: mail17i.protonmail.ch; spf=none
 [email protected]
Authentication-Results: mail17i.protonmail.ch; dkim=none
To: [email protected]
Subject: =?UTF-8?B?UGF5UGF5IOWKoOebn+W6l+OBruOBiueUs+i+vOOBvw==?=
X-Php-Script: hostercongisend.ddnsking.com/mailuntitled.php for 34.69.97.115
X-Php-Originating-Script: 1001:mailuntitled.php
From: Paypay.ne.jp <[email protected]>
Mime-Version: 1.0
Content-Type: text/html
Reply-To: [email protected]
Message-Id: <[email protected]>
Date: Fri, 22 Nov 2019 16:39:01 -0500
X-Antiabuse: This header was added to track abuse, please include it with any abuse report
X-Antiabuse: Primary Hostname - serverhosthouse.ddns.net
X-Antiabuse: Original Domain - protonmail.com
X-Antiabuse: Originator/Caller UID/GID - [1001 994] / [47 12]
X-Antiabuse: Sender Address Domain - serverhosthouse.ddns.net
X-Get-Message-Sender-Via: serverhosthouse.ddns.net: authenticated_id:
 hostercongisendd/only user confirmed/virtual account not confirmed
X-Authenticated-Sender: serverhosthouse.ddns.net: hostercongisendd
X-Spam-Flag: YES
X-Spam-Status: Yes, score=24.5 required=4.0 tests=BAYES_50,DATE_IN_PAST_24_48,
 DKIM_ADSP_NXDOMAIN,FROM_EXCESS_BASE64,FSL_BULK_SIG,
 HEADER_FROM_DIFFERENT_DOMAINS,HTML_FONT_SIZE_LARGE,HTML_MESSAGE,
 RAZOR2_CF_RANGE_51_100,RAZOR2_CHECK,RCVD_IN_IVMSIP,RCVD_IN_RP_RNBL,
 RDNS_NONE,SPF_HELO_NONE,SPF_NONE,T_REMOTE_IMAGE,T_TVD_MIME_NO_HEADERS autolearn=no
 autolearn_force=no version=3.4.2
X-Spam-Report: *
  4.0 BAYES_50 BODY: Bayes spam probability is 40 to 60% *
      [score: 0.5000] *
  5.0 RCVD_IN_IVMSIP RBL: listed on ivmSIP found at invaluement.com *
      [103.76.88.93 listed in sip.invaluement.local] *
  5.0 RCVD_IN_RP_RNBL RBL: Relay in RNBL, *
      https://senderscore.org/blacklistlookup/ *
      [103.76.88.93 listed in bl.score.senderscore.com] *
  0.2 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level *
      mail domains are different *
  0.0 SPF_NONE SPF: sender does not publish an SPF Record *
  0.9 DKIM_ADSP_NXDOMAIN No valid author signature and domain not in *
      DNS *
  1.3 DATE_IN_PAST_24_48 Date: is 24 to 48 hours before Received: *
      date *
  0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record *
  0.0 T_TVD_MIME_NO_HEADERS BODY: No description available. *
  0.0 HTML_MESSAGE BODY: HTML included in message *
  0.0 HTML_FONT_SIZE_LARGE BODY: HTML font size is large *
  3.0 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) *
  1.9 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% *
      [cf: 100] *
  3.0 RDNS_NONE Delivered to internal network by a host with no rDNS *
  0.0 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily *
  0.1 FSL_BULK_SIG Bulk signature with no Unsubscribe *
  0.0 T_REMOTE_IMAGE Message contains an external image
X-Spam-Level: ************************
X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on maili.protonmail.ch
X-Pm-Origin: external
X-Pm-Content-Encryption: on-delivery
X-Pm-Transfer-Encryption: TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)