Apparently I won a donation. Of course I did.
“$10 Million Donation Award For You, Confirmation Required”
Fast truth. The To line is make up, you@email.com is not my email.
The Delivered To line is real, as I received the email.
Want to see it.
In Gmail hit Show original. The header tells you where it actually went.
Click to see the original
Delivered-To: ****@gmail.com
Received: by 2013:v05:622a:1234:b0:4b2:ec11:7052 with SMTP id ki16csp348916qta;
Wed, 27 Aug 2025 16:04:36 -0700 (PDT)
X-Forwarded-Encrypted: i=2; AJvYcCU1+8vTXDXm3QB674ZYzuAw3huURnTbb4GkKSz@gmail.com
X-Google-Smtp-Source: AGHT+IHmSNTsI5JiwN1tnulnp/f+521UbCHngjVnlqPIlRLgXrT75ilXt3SCKN6oWhGrDxxRUTjW
X-Received: by 2032:a02:6a20:430b:b1:243:15b9:778d with SMTP id adf61e71a8af0-24340e6c22bmr327637.49.1756335876425;
Wed, 27 Aug 2025 16:04:36 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; t=1756335876; cv=none;
d=google.com; s=arc-20240605;
b=FHJKuyuf3ztaMzU8i3xa1VsxAEpSNe7sgSeMYjZD0R0jA6ehSVRVMGg1j
jFaFH5LJ1Wqs+kP1KXN3n2i3iq8f0MaknIFt6IND3At/tW08aTdujGelpF2ZFL
Swgr7QAoHWOlRzbJP4reVrO5NLn1bdE3wLI0SmpeNsv6QfQw9tqlpyZr
OBRGhy11z96BxJuwYicHW3aN/KPRFvlKqNoHrJi5nKJIIiZDfgUxOBiXvhR
afnXwcudLJ3Gz2Uu2W03wIFH9PAmBp5E7nHqO5QoKlRVbfrZLXysxz1AaxXt/
AZ5A==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;
h=sensitivity:content-transfer-encoding:mime-version:subject
:message-id:to:reply-to:from:date:dkim-signature;
bh=q3OK6iG+ef+xxCtMA7+Oj8q8lfQ7o0R6ikqS2Bg66oc=;
fh=AThvZy6KSqVgbJSxuVGz81tXf1YitAdcRARpfYGNz3Q=;
b=dvUVvmMtxzWHOU2POUXPNhVDSzAXm04EBsbTmSY/wnjsiFd/8z4FNfE5EHFMnE91xf
SQTsw167Vj2Uv5eEx9FHyR2Xi6goCxqLqC1qIRCmlk7c7qzUa8MvFlYsHrhkCZfQMmmC
l8QPKvH8r3XOWib/M7DYbbvClLoXi4CGoZ/TDbzkinKB/V3sCn/xHlPFc2j6nvgtRAfC
uBhgZSapFUPq7RKK1xDnFxGX9keyf6ZslffbqLOA322TFPH2DHCW4ZEHz5US9gkeZrr9
0QP8Gpoeg+Jp30P/bspYtAhzEgsZ0fRSKJdhbbNOC8EDyzdnl5HCRPpEkenBq1B0NNyG
JPMw==;
dara=google.com
ARC-Authentication-Results: i=1; mx.google.com;
dkim=pass header.i=@plala.or.jp header.s=p20240201 header.b=VWM3cDqe;
spf=pass (google.com: domain of molosn36a@smail.plala.or.jp designates 60.36.166.39 as permitted sender) smtp.mailfrom=molosn36a@smail.plala.or.jp;
dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=plala.or.jp
Return-Path: <molosn36a@smail.plala.or.jp>
Received: from msc117.plala.or.jp (msc117.plala.or.jp. [60.36.166.39])
by mx.google.com with ESMTPS id 41be03b00d2f7-b4c23c0801dsi4605635a12.351.2025.08.27.16.04.33
(version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
Wed, 27 Aug 2025 16:04:36 -0700 (PDT)
Received-SPF: pass (google.com: domain of molosn36a@smail.plala.or.jp designates 60.36.166.39 as permitted sender) client-ip=60.36.166.39;
Authentication-Results: mx.google.com;
dkim=pass header.i=@plala.or.jp header.s=p20240201 header.b=VWM3cDqe;
spf=pass (google.com: domain of molosn36a@smail.plala.or.jp designates 60.36.166.39 as permitted sender) smtp.mailfrom=molosn36a@smail.plala.or.jp;
dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=plala.or.jp
Received: from mdkim-o05.ake-mailbk.plala.or.jp ([172.23.12.54])
by msc117.plala.or.jp with ESMTP
id <20250827230432.DNFH3766.msc117.plala.or.jp@mdkim-o05.ake-mailbk.plala.or.jp>;
Thu, 28 Aug 2025 08:04:32 +0900
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=plala.or.jp; q=dns/txt; s=p20240201; t=1756335872;
x=1787871872;
h=date:from:reply-to:to:message-id:subject:mime-version:
content-transfer-encoding;
bh=q3OK6iG+ef+xxCtMA7+Oj8q8lfQ7o0R6ikqS2Bg66oc=;
b=VWM3cDqetTORR9bxlMcwvYiUkScGu/xDlD5fGUGc17bo0an6stsoA9Ts
GKea9GJextoJgpGqW/+lX+LeG3DAHrEta5ZiGtnX3m/vJspgiVu8OTqxi
repqccxEGlOHHXq/GP+FJJMks3yFWQf2nOISd+2ibqp+eD/HfTWOmVSr8
KttKdEYFmzR2i1P7LtYGhBZTYP5Jpo9O10JPvUPww8p1Ze2fLuieq9O0v
JWg+jxCrIFPBebZMoPFZ8B2WzkH/s9OqiZVSe76g4skEi4IA6L//e82Rr
Euwpyx3MACoAWrJ5TjiAZHLkfJiI9dHFtq09uV2r+tydlzyZjIzSJmDD+
w==;
X-CSE-ConnectionGUID: 8p9I0VUiSu6dluiM7aOhcA==
X-CSE-MsgGUID: XHoP+eBFSZGpVg9jvOSMEQ==
Received: from msa12.ake-mailbk.plala.or.jp (HELO msa12.plala.or.jp) ([172.23.12.92])
by mdkim-o.ake-mailbk.plala.or.jp with ESMTP; 28 Aug 2025 08:04:32 +0900
Received: from mwebp13 ([172.23.13.133]) by msa12.plala.or.jp with ESMTP
id <20250827230432.YSFF6406.msa12.plala.or.jp@mwebp13>;
Thu, 28 Aug 2025 08:04:32 +0900
Date: Thu, 28 Aug 2025 08:04:32 +0900
From: "Mark K. Harder" <molosn36a@smail.plala.or.jp>
Reply-To: john@financialcb.org
To: you@email.com
Message-ID: <20250828080432.E9I1P.998.root@mwebp13>
Subject: $10 Million Donation Award For You, Confirmation Required
MIME-Version: 1.0
Content-Type: text/plain; charset=iso-2022-jp
Content-Transfer-Encoding: 7bit
X-Priority: 3 (Normal)
Sensitivity: Normal
X-VirusScan: Outbound; mvir-ac12; Thu, 28 Aug 2025 08:04:32 +0900
Dear Recipient,
I hope this message finds you well. My name is Mark K. Harder, and I am the legal representative of The Breakfast Club. It is my pleasure to share some truly extraordinary news with you today.
You may find this message unexpected, but I assure you it is for a wonderful reason. The Breakfast Club is honored to have won the $842.4 million Powerball jackpot drawn on June 11, 2024. In gratitude for this remarkable blessing, we have committed ourselves to philanthropy and making a meaningful impact in the lives of others.
As part of this mission, we have chosen to donate $10 million each to five selected individuals worldwide. I am delighted to inform you that you have been selected as one of these recipients.
This donation we are offering you might not be too much for you or your business but I believe it's enough to assist you in helping others to keep humanity alive even in the face of this great adversity. We have chosen you to be a part of these blessings because we believe that there is an expression of worship.
For verification, you may view the official Powerball announcement here:
https://www.youtube.com/watch?v=RQL8MSrHnAo&t=82s&ab_channel=WNEMTV5
To facilitate the secure and efficient processing of this donation, we have appointed Mr. John Hoag, Senior Vice President of CIBC Bank Group in the United States, as our official representative. Please reach out to Mr. Hoag to confirm your acceptance and initiate the necessary procedures.
Contact Information:
Contact Person: Mr. John Hoag
Email: john@financialcb.org
Contact Number: +1 917-392-7199 (Text message only for record purposes)
Please ensure that you mention this payment code [TBC-97121USA] when contacting Mr. John Hoag. Additionally, kindly provide the following information below to him to facilitate the payment process:
Full Name:
Age:
Gender:
Country & Full Address:
Occupation:
WhatsApp & Other Phone Number(s):
A recent photograph of yourself and a copy of your ID or passport
This transaction is being monitored by the United States Government to ensure full transparency and prevent fraudulent activities.
I hope that this donation will go some way towards making a positive difference in your life, and I urge you to reach out to Mr. John Hoag as soon as possible to express your interest. Once again, congratulations on being selected for this donation. I hope it brings you immense joy and helps you achieve your goals. I look forward to hearing from you soon.
Best regards,
Mark K. Harder
Attorney & Representative
The Breakfast ClubThe sneaky bit is Reply To.
Scammers want you to hit reply so your message goes to a different address they own. Looks normal in marketing. Weaponised here.
SPF pass. DKIM pass. DMARC pass. Lovely. Still not safe.
Those checks say the server was allowed and the content was intact. They do not judge intent. A hacked mailbox will pass all three and still rob you.
ARC is just the travel diary. Useful for hops. Neutral on truth.
My quick drill,
- Copy the full header. Paste into Google’s header analyser. Confirm the sending IP and alignment.
2. Copy links without clicking. Drop them into virustotal.
Everyone says its safe…
That’s why you run a proper URL/DNS filter.
Yes, this one screamed scam. I had apparently won millions. But we are moments away from far more convincing stories with the power of GPTs.
Promise to self. One day I will tell how a friend fell for a romance crypto investment scam and lost about £50k in four weeks.
I treat spam as a free training. Each one teaches something. Spend less time wondering if Mail was tricked, do not take my word for it. 🙂
Spend more time quietly shutting doors.
Leave a Reply