Scammers beware

Here’s a fun one…

Oh, the irony of being caught by honeymail…

The source

Alias listing

The headers

[...]
X-OriginatorOrg: gowoodlands.onmicrosoft.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 22b60191-35d4-4e3f-7c3d-08dac0e29e7a
X-MS-Exchange-CrossTenant-AuthSource: SN6PR06MB3888.namprd06.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 07 Nov 2022 17:07:58.5627 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 410f9b34-38a5-4f4d-a070-a4825e871412
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: XRjC2yluahoSwQQJn5kuhLTDRWwxL2g4Y48qFVLfo2LbgW/vQvaQCEO9ywAKZqWP+VqP38PDL8jaUmnDMXaEpmtxjlM5bL/Bg0xkWUqWSilibK4in40kv5xHy0oeTP7kEOuZvAY6F6zO2Ix4X2tHuQ==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN6PR06MB4831
Received-SPF: pass client-ip=40.107.223.120; envelope-from=example.user246@gowoodlands.onmicrosoft.com; helo=NAM11-DM6-obe.outbound.protection.outlook.com

The email?

Scam email

At the time of writing this entry, the Bitcoin wallet is still empty.