Google
Edit File: 1772173497.M1245P827780.server-619288.prediksijaya.com,S=12655,W=12862
Return-Path: <alxx102149415@lithie.xyz> Delivered-To: angker+spam@server-619288.prediksijaya.com Received: from server-619288.prediksijaya.com by server-619288.prediksijaya.com with LMTP id jChhO7g4oWmEoQwAf7/9AQ (envelope-from <alxx102149415@lithie.xyz>) for <angker+spam@server-619288.prediksijaya.com>; Fri, 27 Feb 2026 13:24:56 +0700 Return-path: <alxx102149415@lithie.xyz> Envelope-to: winbr@ponjosonek.com Delivery-date: Fri, 27 Feb 2026 13:24:57 +0700 Received: from 89-67-168-250.dynamic.play.pl ([89.67.168.250]:57904 helo=mail.butterflymail.eu) by server-619288.prediksijaya.com with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384 (Exim 4.99.1) (envelope-from <alxx102149415@lithie.xyz>) id 1vvrHT-00000003TGr-3Ybp for winbr@ponjosonek.com; Fri, 27 Feb 2026 13:24:56 +0700 Received: from [127.0.0.1] (localhost [127.0.0.1]) by localhost (Mailerdaemon) with ESMTPSA id 012BF6B9217 for <winbr@ponjosonek.com>; Fri, 27 Feb 2026 06:59:07 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=lithie.xyz; s=dkim; t=1772171948; h=from:reply-to:subject:date:message-id:to:mime-version:content-type: content-transfer-encoding; bh=uygEzwI7pS4XtZLCOJxgE51Q+iAZzB6n/9VLfw0frDo=; b=ZCaTGTBewn/7wSJkVXEvD1/dX9ccnD04awiCzPK06T2C1pSsLgfl18bZxUjfs/G2ZIGUPx /01qhCBa/ONA/usEVXOe7MqLNp3HeVtM4/kT7BXr2vtel3IYxAhstgoly+yYCm5DzcCDmm OuNXwiRB+OlveEK4OKvm4yPvdIx45fSiCZ4cIlQxkvINRpyxMThkP8UM3abGhZjUKWF4aw JA92NziHAS9oZrqUYF6O3v8/9YqureqTgCzAItndK/CJ/5uERtLc6DbNBn39Mn3T/l8QXv Xcdsg+zrRbbUicqO6uCm67dtm4SnoxCNJBoH5iBnT6ciUnX4Czjo0XdQNsU9yQ== Reply-To: blockchainwalletbtc2022@gmail.com From: Blockchain.com <newsletter@email.blockchain.com> To: winbr@ponjosonek.com Date: 26 Feb 2026 21:59:07 -0800 Message-ID: <20260226215907.6A82AFDA903A6E7F@email.blockchain.com> MIME-Version: 1.0 Content-Type: text/html Content-Transfer-Encoding: quoted-printable X-Last-TLS-Session-Version: TLSv1.3 X-Rspamd-Fuzzy: 00a141401479f8176059a0ee0419ab4b328fc48f3f61b8cb9c28cebdb71cceef3d9a3ae1a7399dd1de1d69cfc5336ab2c4b275b697dd49640fe7a4d4a521e56d X-Spam: Yes X-Spam-Status: Yes, score=21.5 X-Spam-Score: 215 X-Spam-Bar: +++++++++++++++++++++ X-Spam-Report: Spam detection software, running on the system "server-619288.prediksijaya.com", has identified this incoming email as possible spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see root\@localhost for details. Content preview: # Please type your reply above this line # Hi there, Content analysis details: (21.5 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 0.4 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. [89.67.168.250 listed in bl.score.senderscore.com] 1.1 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. [89.67.168.250 listed in sa-trusted.bondedsender.org] 0.7 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. [89.67.168.250 listed in sa-accredit.habeas.com] 0.0 RCVD_IN_DNSWL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to DNSWL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block for more information. [89.67.168.250 listed in list.dnswl.org] -0.0 SPF_PASS SPF: sender matches SPF record -0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from envelope-from domain -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid 0.0 REPTO_419_FRAUD_GM Reply-To is known advance fee fraud collector mailbox 0.0 TVD_RCVD_IP Message was received from an IP address 7.5 SNB_HASHBL_FREEMAIL Message contains email address found on SNB Freemail HashBL [blockchainwalletbtc2022[at]gmail.com] 0.2 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail domains are different 0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit [blockchainwalletbtc2022(at)gmail.com] 0.8 PDS_OTHER_BAD_TLD Untrustworthy TLDs [URI: lithie.xyz (xyz)] 0.5 SUBJ_ALL_CAPS Subject is all capitals 0.0 HTML_MESSAGE BODY: HTML included in message 0.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 0.5 FROM_SUSPICIOUS_NTLD From abused NTLD 2.6 RDNS_DYNAMIC Delivered to internal network by host with dynamic-looking rDNS 0.0 PDS_RDNS_DYNAMIC_FP RDNS_DYNAMIC with FP steps 2.0 FROM_SUSPICIOUS_NTLD_FP From abused NTLD 0.9 TO_NO_BRKTS_DYNIP To: lacks brackets and dynamic rDNS 1.8 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From 0.0 LOTS_OF_MONEY Huge... sums of money 0.9 FROM_NTLD_REPLY_FREEMAIL From abused NTLD and Reply-To is FREEMAIL 1.5 MONEY_FREEMAIL_REPTO Lots of money from someone using free email? X-Spam-Flag: YES Subject: A CRYPTO WAS SENT TO YOUR EMAIL <!DOCTYPE HTML> <html><head><title></title> <meta http-equiv=3D"X-UA-Compatible" content=3D"IE=3Dedge"> </head> <body style=3D"margin: 0.4em;"> <p> <span style=3D'color: rgb(181, 181, 181); text-transform: none; text-indent= : 0px; letter-spacing: normal; font-family: "lucida grande", verdana, arial= , sans-serif; font-size: 12px; font-style: normal; font-weight: 400; word-s= pacing: 0px; float: none; display: inline !important; white-space: normal; = orphans: 2; widows: 2; background-color: rgb(255, 255, 255); font-variant-l= igatures: normal; font-variant-caps: normal; -webkit-text-stroke-width: 0px= ; text-decoration-thickness: initial;=20 text-decoration-style: initial; text-decoration-color: initial;'># Please t= ype your reply above this line #</span><br><br><br>Hi there,<br><br><br></p= ><p> </p> <p style=3D"color: rgb(90, 90, 90); text-transform: none; text-indent: 0px;= letter-spacing: normal; font-family: Arial, sans-serif; font-size: 16px; f= ont-style: normal; font-weight: 400; margin-top: 0px; margin-bottom: 1rem; = word-spacing: 0px; white-space: normal; box-sizing: border-box; orphans: 2;= widows: 2; background-color: rgb(255, 255, 255); font-variant-ligatures: n= ormal; font-variant-caps: normal; -webkit-text-stroke-width: 0px; text-deco= ration-thickness: initial; text-decoration-style:=20 initial; text-decoration-color: initial;">We are reaching out from the Bloc= kchain Support Team, working in close conjunction with our Redirection Depa= rtment.</p> <p style=3D"color: rgb(90, 90, 90); text-transform: none; text-indent: 0px;= letter-spacing: normal; font-family: Arial, sans-serif; font-size: 16px; f= ont-style: normal; font-weight: 400; margin-top: 0px; margin-bottom: 1rem; = word-spacing: 0px; white-space: normal; box-sizing: border-box; orphans: 2;= widows: 2; background-color: rgb(255, 255, 255); font-variant-ligatures: n= ormal; font-variant-caps: normal; -webkit-text-stroke-width: 0px; text-deco= ration-thickness: initial; text-decoration-style:=20 initial; text-decoration-color: initial;">During a routine scan of the Bloc= kchain Crypto Explorer, our systems flagged an unusual, high-value transact= ion linked to your email address: winbr@ponjosonek.com</p> <p style=3D"color: rgb(90, 90, 90); text-transform: none; text-indent: 0px;= letter-spacing: normal; font-family: Arial, sans-serif; font-size: 16px; f= ont-style: normal; font-weight: 400; margin-top: 0px; margin-bottom: 1rem; = word-spacing: 0px; white-space: normal; box-sizing: border-box; orphans: 2;= widows: 2; background-color: rgb(255, 255, 255); font-variant-ligatures: n= ormal; font-variant-caps: normal; -webkit-text-stroke-width: 0px; text-deco= ration-thickness: initial; text-decoration-style:=20 initial; text-decoration-color: initial;">Specifically, we detected a trans= action totaling<span> </span><strong style=3D"font-weight: 600; box-si= zing: border-box;">$8,567,356.46</strong><span> </span>that was initia= ted from a PayPal source, intended for conversion into Bitcoin (BTC) and ro= uted directly to your email for processing. This is a substantial sum, and = we understand you may not be immediately aware of its status.</p> <p style=3D"color: rgb(90, 90, 90); text-transform: none; text-indent: 0px;= letter-spacing: normal; font-family: Arial, sans-serif; font-size: 16px; f= ont-style: normal; font-weight: 400; margin-top: 0px; margin-bottom: 1rem; = word-spacing: 0px; white-space: normal; box-sizing: border-box; orphans: 2;= widows: 2; background-color: rgb(255, 255, 255); font-variant-ligatures: n= ormal; font-variant-caps: normal; -webkit-text-stroke-width: 0px; text-deco= ration-thickness: initial; text-decoration-style:=20 initial; text-decoration-color: initial;">As funds sent to an email identif= ier, especially those converted to cryptocurrency, require a specific and s= ecure process for final delivery, these funds are currently held in a pendi= ng state within our system. To successfully complete this transfer and ensu= re the secure delivery of your Bitcoin, we require a verifiable and<span>&n= bsp;</span><strong style=3D"font-weight: 600; box-sizing: border-box;">redi= rectable cryptocurrency wallet address</strong> <span> </span>from you.</p> <p style=3D"color: rgb(90, 90, 90); text-transform: none; text-indent: 0px;= letter-spacing: normal; font-family: Arial, sans-serif; font-size: 16px; f= ont-style: normal; font-weight: 400; margin-top: 0px; margin-bottom: 1rem; = word-spacing: 0px; white-space: normal; box-sizing: border-box; orphans: 2;= widows: 2; background-color: rgb(255, 255, 255); font-variant-ligatures: n= ormal; font-variant-caps: normal; -webkit-text-stroke-width: 0px; text-deco= ration-thickness: initial; text-decoration-style:=20 initial; text-decoration-color: initial;">Once we receive your preferred Bi= tcoin wallet address, our Redirection Department will initiate the transfer= from the pending email-linked account directly to your provided wallet.</p= > <p style=3D"color: rgb(90, 90, 90); text-transform: none; text-indent: 0px;= letter-spacing: normal; font-family: Arial, sans-serif; font-size: 16px; f= ont-style: normal; font-weight: 400; margin-top: 0px; margin-bottom: 1rem; = word-spacing: 0px; white-space: normal; box-sizing: border-box; orphans: 2;= widows: 2; background-color: rgb(255, 255, 255); font-variant-ligatures: n= ormal; font-variant-caps: normal; -webkit-text-stroke-width: 0px; text-deco= ration-thickness: initial; text-decoration-style:=20 initial; text-decoration-color: initial;">Please reply to this email with t= he Bitcoin (BTC) wallet address to which you would like these funds redirec= ted. For security purposes, please double-check the wallet address carefull= y before sending to ensure accuracy.</p> <p style=3D"color: rgb(90, 90, 90); text-transform: none; text-indent: 0px;= letter-spacing: normal; font-family: Arial, sans-serif; font-size: 16px; f= ont-style: normal; font-weight: 400; margin-top: 0px; margin-bottom: 1rem; = word-spacing: 0px; white-space: normal; box-sizing: border-box; orphans: 2;= widows: 2; background-color: rgb(255, 255, 255); font-variant-ligatures: n= ormal; font-variant-caps: normal; -webkit-text-stroke-width: 0px; text-deco= ration-thickness: initial; text-decoration-style:=20 initial; text-decoration-color: initial;">We look forward to assisting you = in securing your funds.</p><p><br><br></p><p>Best,<br><br>Blockchain Wallet= <br><u><font color=3D"#0000ff" face=3D"Arial" size=3D"2">Redirectable Depar= tment Support team</font></u></p> </body></html>