I just got an email today claiming that I had spend $75.00 on a Microsoft XBOX Gift Card using my PayPal account but I did not and this email is clearly not from PayPal even though it initially says that it is from no-reply@intI.paypal.com. A closer look shows that it is really from no-reply.8f5o63j5i08@jwndjwnd.com. The message was as follows:
Subject: "You sent a payment of $75.00 USD to Microsoft Corporation on September 2, 2019. Invoice ID#LRSOPCXL for order $75.00 Xbox Digital Gift Card (U heeft op September 2, 2019 een betaling van $ 75,00 USD aan Microsoft Corporation gestuurd. Factuur-ID #LRSOPCXL"
Body: "Open or dowload the attached file for the details for your information!"
The headers of the message revealed the following:
MIME-Version: 1.0
Date: Mon, 2 Sep 2019 09:37:26 -0700
From: "no-reply@intI.paypal.com" no-reply.8f5o63j5i08@jwndjwnd.com
Subject: You sent a payment of $75.00 USD to Microsoft Corporation on
September 2, 2019. Invoice ID#LRSOPCXL for order $75.00 Xbox Digital Gift
Card (U heeft op September 2, 2019 een betaling van $ 75,00 USD aan
Microsoft Corporation gestuurd. Factuur-ID #LRSOPCXL
Thread-Topic: You sent a payment of $75.00 USD to Microsoft Corporation on
September 2, 2019. Invoice ID#LRSOPCXL for order $75.00 Xbox Digital Gift
Card (U heeft op September 2, 2019 een betaling van $ 75,00 USD aan
Microsoft Corporation gestuurd. Factuur-ID #LRSOPCXL
To: "xxxxxxx" xxxxxxxx
Content-Type: multipart/mixed
boundary="_62F423A1-9080-40C0-9C72-C8CBC81D2B06_"
Unfortunately it appears that Windows 10 Mail does not record the IP address of the source or I would try to figure it out. I had to export this to Outlook just to view the headers.