I had to redact this pretty heavily since it had my bait mail information everywhere.
The sender got this somehow to get returned through gmail’s mail delivery bounce handler despite a forged from header, making header analysis pretty suspect.
Email Body:
Email Termination Request
Dear (redacted username) , Our records indicate that "[email protected] " recently requested to terminate your email account and this request will be processed asap.
You are advised to cancel this request now if you wish to keep your email data safe.
However, if you do not cancel this request, your account will be terminated asap and all your email data will be lost permanently.
redacted domain
admin 2022
All rights reserved.
This message is auto-generated from E-mail admin server, and replies sent to this email cannot be delivered. This email is meant solely for: [email protected]
The link takes you to this site:
which is clearly designed to get you to try to sign in so they can harvest your email/pass combo.
URLScan: atpproduct.com - urlscan.io
Hosted out of Thailand, so I reported to registrar.