Google

Edit File: 1768020153.M463973P1490603.server-619288.prediksijaya.com,S=11638,W=11830:2,a

Envelope-to: info@21stbikes.com
Delivery-date: Sat, 10 Jan 2026 11:42:33 +0700
X-CrossPremisesHeadersFilteredBySendConnector: MailSrv01.zjfae.com
Received: from mailsrv02.zjfae.com (10.10.88.13) by MailSrv01.zjfae.com
 (10.10.88.12) with Microsoft SMTP Server (TLS) id 15.0.1497.48; Sat, 10 Jan
 2026 12:41:04 +0800
Received: from [213.209.159.120] (213.209.159.120) by mailsrv02.zjfae.com
 (10.10.88.13) with Microsoft SMTP Server (TLS) id 15.0.1497.48; Sat, 10 Jan
 2026 12:06:24 +0800
Reply-To: <blockchainwalletbtc2022@gmail.com>
From: Blockchain.com <newsletter@email.blockchain.com>
To: <info@21stbikes.com>
Date: Fri, 9 Jan 2026 20:06:24 -0800
Message-ID: <20260109200624.BE9FDD38A417CBEF@email.blockchain.com>
MIME-Version: 1.0
Content-Type: text/html
Content-Transfer-Encoding: quoted-printable
X-ClientProxiedBy: mailsrv02.zjfae.com (10.10.88.13) To mailsrv02.zjfae.com
 (10.10.88.13)
X-OrganizationHeadersPreserved: MailSrv01.zjfae.com
X-Spam-Status: Yes, score=17.8
X-Spam-Score: 178
X-Spam-Bar: +++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "server-619288.prediksijaya.com",
 has identified this incoming email as possible spam. The original
 message has been attached to this so you can view it or label
 similar future email. If you have any questions, see
 root\@localhost for details.
 Content preview: # Please type your reply above this line # Hi there, 
 Content analysis details: (17.8 points, 5.0 required)
 pts rule name description
 ---- ---------------------- --------------------------------------------------
 0.0 RCVD_IN_DNSWL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to DNSWL
 was blocked. See
 http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
 for more information.
 [218.75.77.202 listed in list.dnswl.org]
 0.5 RCVD_IN_HOSTKARMA_BR RBL: Sender listed in HOSTKARMA-BROWN
 [218.75.77.202 listed in hostkarma.junkemailfilter.com]
 0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to
 Validity was blocked. See
 https://knowledge.validity.com/hc/en-us/articles/20961730681243
 for more information.
 [218.75.77.202 listed in sa-accredit.habeas.com]
 0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The
 query to Validity was blocked. See
 https://knowledge.validity.com/hc/en-us/articles/20961730681243
 for more information.
 [218.75.77.202 listed in sa-trusted.bondedsender.org]
 0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to
 Validity was blocked. See
 https://knowledge.validity.com/hc/en-us/articles/20961730681243
 for more information.
 [218.75.77.202 listed in bl.score.senderscore.com]
 1.5 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)
 0.0 KAM_DMARC_STATUS Test Rule for DKIM or SPF Failure with Strict
 Alignment
 2.2 REPTO_419_FRAUD_GM Reply-To is known advance fee fraud collector
 mailbox
 7.5 SNB_HASHBL_FREEMAIL Message contains email address found on SNB
 Freemail HashBL
 [blockchainwalletbtc2022[at]gmail.com]
 0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
 [blockchainwalletbtc2022(at)gmail.com]
 0.5 SUBJ_ALL_CAPS Subject is all capitals
 0.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
 0.0 HTML_MESSAGE BODY: HTML included in message
 2.0 RDNS_NONE Delivered to internal network by a host with no rDNS
 0.0 LOTS_OF_MONEY Huge... sums of money
 1.8 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
 1.5 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?
X-Spam-Flag: YES
Subject: A PAYMENT WITH BITCOIN WAS SENT TO YOUR EMAIL. CONFIRM

<!DOCTYPE HTML>

<html><head><title></title>
<meta http-equiv=3D"X-UA-Compatible" content=3D"IE=3Dedge">
</head>
<body style=3D"margin: 0.4em;">

<span style=3D'color: rgb(181, 181, 181); text-transform: none; text-indent=
: 0px; letter-spacing: normal; font-family: "lucida grande", verdana, arial=
, sans-serif; font-size: 12px; font-style: normal; font-weight: 400; word-s=
pacing: 0px; float: none; display: inline !important; white-space: normal; =
orphans: 2; widows: 2; background-color: rgb(255, 255, 255); font-variant-l=
igatures: normal; font-variant-caps: normal; -webkit-text-stroke-width: 0px=
; text-decoration-thickness: initial;=20
text-decoration-style: initial; text-decoration-color: initial;'># Please t=
ype your reply above this line # Hi there, </p=
>

<p style=3D"color: rgb(90, 90, 90); text-transform: none; text-indent: 0px;=
 letter-spacing: normal; font-family: Arial, sans-serif; font-size: 16px; f=
ont-style: normal; font-weight: 400; margin-top: 0px; margin-bottom: 1rem; =
word-spacing: 0px; white-space: normal; box-sizing: border-box; orphans: 2;=
 widows: 2; background-color: rgb(255, 255, 255); font-variant-ligatures: n=
ormal; font-variant-caps: normal; -webkit-text-stroke-width: 0px; text-deco=
ration-thickness: initial; text-decoration-style:=20
initial; text-decoration-color: initial;">We are reaching out from the Bloc=
kchain Support Team, working in close conjunction with our Redirection Depa=
rtment.
<p style=3D"color: rgb(90, 90, 90); text-transform: none; text-indent: 0px;=
 letter-spacing: normal; font-family: Arial, sans-serif; font-size: 16px; f=
ont-style: normal; font-weight: 400; margin-top: 0px; margin-bottom: 1rem; =
word-spacing: 0px; white-space: normal; box-sizing: border-box; orphans: 2;=
 widows: 2; background-color: rgb(255, 255, 255); font-variant-ligatures: n=
ormal; font-variant-caps: normal; -webkit-text-stroke-width: 0px; text-deco=
ration-thickness: initial; text-decoration-style:=20
initial; text-decoration-color: initial;">During a routine scan of the Bloc=
kchain Crypto Explorer, our systems flagged an unusual, high-value transact=
ion linked to your email address: info@21stbikes.com
<p style=3D"color: rgb(90, 90, 90); text-transform: none; text-indent: 0px;=
 letter-spacing: normal; font-family: Arial, sans-serif; font-size: 16px; f=
ont-style: normal; font-weight: 400; margin-top: 0px; margin-bottom: 1rem; =
word-spacing: 0px; white-space: normal; box-sizing: border-box; orphans: 2;=
 widows: 2; background-color: rgb(255, 255, 255); font-variant-ligatures: n=
ormal; font-variant-caps: normal; -webkit-text-stroke-width: 0px; text-deco=
ration-thickness: initial; text-decoration-style:=20
initial; text-decoration-color: initial;">Specifically, we detected a trans=
action totaling&nbsp;$8,567,356.46&nbsp;that was initia=
ted from a PayPal source, intended for conversion into Bitcoin (BTC) and ro=
uted directly to your email for processing. This is a substantial sum, and =
we understand you may not be immediately aware of its status.
<p style=3D"color: rgb(90, 90, 90); text-transform: none; text-indent: 0px;=
 letter-spacing: normal; font-family: Arial, sans-serif; font-size: 16px; f=
ont-style: normal; font-weight: 400; margin-top: 0px; margin-bottom: 1rem; =
word-spacing: 0px; white-space: normal; box-sizing: border-box; orphans: 2;=
 widows: 2; background-color: rgb(255, 255, 255); font-variant-ligatures: n=
ormal; font-variant-caps: normal; -webkit-text-stroke-width: 0px; text-deco=
ration-thickness: initial; text-decoration-style:=20
initial; text-decoration-color: initial;">As funds sent to an email identif=
ier, especially those converted to cryptocurrency, require a specific and s=
ecure process for final delivery, these funds are currently held in a pendi=
ng state within our system. To successfully complete this transfer and ensu=
re the secure delivery of your Bitcoin, we require a verifiable and&n=
bsp;redi=
rectable cryptocurrency wallet address
&nbsp;from you.
<p style=3D"color: rgb(90, 90, 90); text-transform: none; text-indent: 0px;=
 letter-spacing: normal; font-family: Arial, sans-serif; font-size: 16px; f=
ont-style: normal; font-weight: 400; margin-top: 0px; margin-bottom: 1rem; =
word-spacing: 0px; white-space: normal; box-sizing: border-box; orphans: 2;=
 widows: 2; background-color: rgb(255, 255, 255); font-variant-ligatures: n=
ormal; font-variant-caps: normal; -webkit-text-stroke-width: 0px; text-deco=
ration-thickness: initial; text-decoration-style:=20
initial; text-decoration-color: initial;">Once we receive your preferred Bi=
tcoin wallet address, our Redirection Department will initiate the transfer=
 from the pending email-linked account directly to your provided wallet.</p=
>
<p style=3D"color: rgb(90, 90, 90); text-transform: none; text-indent: 0px;=
 letter-spacing: normal; font-family: Arial, sans-serif; font-size: 16px; f=
ont-style: normal; font-weight: 400; margin-top: 0px; margin-bottom: 1rem; =
word-spacing: 0px; white-space: normal; box-sizing: border-box; orphans: 2;=
 widows: 2; background-color: rgb(255, 255, 255); font-variant-ligatures: n=
ormal; font-variant-caps: normal; -webkit-text-stroke-width: 0px; text-deco=
ration-thickness: initial; text-decoration-style:=20
initial; text-decoration-color: initial;">Please reply to this email with t=
he Bitcoin (BTC) wallet address to which you would like these funds redirec=
ted. For security purposes, please double-check the wallet address carefull=
y before sending to ensure accuracy.
<p style=3D"color: rgb(90, 90, 90); text-transform: none; text-indent: 0px;=
 letter-spacing: normal; font-family: Arial, sans-serif; font-size: 16px; f=
ont-style: normal; font-weight: 400; margin-top: 0px; margin-bottom: 1rem; =
word-spacing: 0px; white-space: normal; box-sizing: border-box; orphans: 2;=
 widows: 2; background-color: rgb(255, 255, 255); font-variant-ligatures: n=
ormal; font-variant-caps: normal; -webkit-text-stroke-width: 0px; text-deco=
ration-thickness: initial; text-decoration-style:=20
initial; text-decoration-color: initial;">We look forward to assisting you =
in securing your funds. Best, Blockchain Wallet=

Redirectable Depar=
tment&nbsp;Support team

</body></html>