There's two different mails flooding my inbox.
One is purely an image of an invoice, with a big bold phone number to call. Recent ones (matching what you report) always from a gmail address. As you say, run of the mill.
The other one I'm talking about is a real paypal mail (forwarded), with a real live paypal "pay-me" link (it was created through paypal, and if one is logged into paypal and clicks through, will pay the scammer). In the notes field of the paypal generated pay-me email, it also has a "didn't make this order?" phone number.
The paypal one is more interesting to me, since it is signed (correctly) by paypal, doesn't arrive from paypal, but my rspamd doesn't detect it as spam (and rspamd config is so opaque I can't figure out why).
I've gotten a dozen of each in the past week.
Brad Rubenstein “:verified:” [OLD ACCOUNT]
npub1l4…3al7a
2024-12-17 22:05:28 UTC
in reply to nevent1q…0yqg
Author Public Key
npub1l4t7cz0y8k8aq6dh34ww90t6tln7rvlwhl5rr20zhgjvzf3h36esm3al7aSeen on
wss://relay.momostr.pinkPublished at
2024-12-17 22:05:28 UTCEvent JSON
{
"id": "4e283553fa74ec2a878528aeb8a54c823f17e2c860e05703fc3ed08166f992ba",
"pubkey": "fd57ec09e43d8fd069b78d5ce2bd7a5fe7e1b3eebfe831a9e2ba24c126378eb3",
"created_at": 1734473128,
"kind": 1,
"tags": [
[
"p",
"f8347ec37d9f23959ba62dd8391fbcade87a7c071205c96f890432e5c047a6ed"
],
[
"proxy",
"https://infosec.exchange/@BradRubenstein/113670430976860855",
"web"
],
[
"e",
"3ad3edf076baba8194cd519d6b4ab302d5513af6a50d83e1d202730acf2722ea",
"",
"root",
"f8347ec37d9f23959ba62dd8391fbcade87a7c071205c96f890432e5c047a6ed"
],
[
"p",
"fd57ec09e43d8fd069b78d5ce2bd7a5fe7e1b3eebfe831a9e2ba24c126378eb3"
],
[
"p",
"df986117e449901ac1b829fc1763e478ce402984d9ba3741cd4b4b18957191fd"
],
[
"e",
"986421b3450911a875a8d5f83b6e494921b5538545e81b9b05da089a2f9a65b3",
"",
"reply",
"f8347ec37d9f23959ba62dd8391fbcade87a7c071205c96f890432e5c047a6ed"
],
[
"proxy",
"https://infosec.exchange/users/BradRubenstein/statuses/113670430976860855",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://infosec.exchange/users/BradRubenstein/statuses/113670430976860855",
"pink.momostr"
],
[
"-"
]
],
"content": "There's two different mails flooding my inbox. \n\nOne is purely an image of an invoice, with a big bold phone number to call. Recent ones (matching what you report) always from a gmail address. As you say, run of the mill.\n\nThe other one I'm talking about is a real paypal mail (forwarded), with a real live paypal \"pay-me\" link (it was created through paypal, and if one is logged into paypal and clicks through, will pay the scammer). In the notes field of the paypal generated pay-me email, it also has a \"didn't make this order?\" phone number.\n\nThe paypal one is more interesting to me, since it is signed (correctly) by paypal, doesn't arrive from paypal, but my rspamd doesn't detect it as spam (and rspamd config is so opaque I can't figure out why).\n\nI've gotten a dozen of each in the past week.",
"sig": "7fa6bf0e23b5e86fa4aa0f5fb808c0a7b33a321adb5ac3d1231df734eaa03c9173d21886f911acfd4b9b59f2bd8f89c281893727cacdbc486129cab0a4741200"
}