This one is really good, the email is a really nice looking invoice so you probably would think, what the heck?!

One big mistake, though: the scammer put 342 in the subject and 51 in the email. Obviously, they need to get their system screwed right.

That being said, the point here is to get the people to open the .zip attached to the file because, well... maybe it will answer the question of: What the heck is that invoice? Right? Of course, that's a virus. Well... I did not try to open it, it's a word document, it may have a macro or a link back to a website where you'll be asked to enter some credentials. Either way, it's another one of those scams...

Return-Path: 
X-Original-To: contact@m2osw.com
Delivered-To: alexis@m2osw.com
X-Greylist: delayed 1567 seconds by postgrey-1.35 at m2osw.com; Wed, 22 Nov 2017 22:28:58 UTC
DMARC-Filter: OpenDMARC Filter v1.3.1 m2osw.com F2D29401AA
Authentication-Results: mail.m2osw.com; dmarc=none header.from=aliceposta.it
Received: from mfdf018.ocn.ad.jp (mfdf018.ocn.ad.jp [153.128.50.74])
	by m2osw.com (Postfix) with ESMTP id F2D29401AA
	for ; Wed, 22 Nov 2017 22:28:58 +0000 (UTC)
Received: from mogw0616.ocn.ad.jp (mogw0616.ocn.ad.jp [153.149.228.17])
	by mfdf018.ocn.ad.jp (Postfix) with ESMTP id F266BB84AE0
	for ; Thu, 23 Nov 2017 07:02:50 +0900 (JST)
Received: from mf-smf-ucb004.ocn.ad.jp (mf-smf-ucb004.ocn.ad.jp [153.149.227.6])
	by mogw0616.ocn.ad.jp (Postfix) with ESMTP id ABB8DE0023E
	for ; Thu, 23 Nov 2017 07:02:49 +0900 (JST)
Received: from mf-smf-ucb004.ocn.ad.jp (mf-smf-ucb004 [153.149.227.6])
	by mf-smf-ucb004.ocn.ad.jp (Postfix) with ESMTP id 8F2316069B
	for ; Thu, 23 Nov 2017 07:02:49 +0900 (JST)
Received: from ntt.pod01.mv-mta-ucb027 (mv-mta-ucb027.ocn.ad.jp [153.149.142.101])
	by mf-smf-ucb004.ocn.ad.jp (Switch-3.3.4/Switch-3.3.4) with ESMTP id vAMM2YOp050201
	for ; Thu, 23 Nov 2017 07:02:49 +0900
Received: from smtp.ocn.ne.jp ([153.149.227.133])
	by ntt.pod01.mv-mta-ucb027 with 
	id dA2l1w0042tKTyH01A2lKQ; Wed, 22 Nov 2017 22:02:49 +0000
Received: from hisvypvdoqlxl (c-lan-227.lan.micso.com [195.32.84.227])
	by smtp.ocn.ne.jp (Postfix) with ESMTPA
	for ; Thu, 23 Nov 2017 07:02:44 +0900 (JST)
Message-ID: <50AAE1ABEC381E1DC1C48D15B161E449@aliceposta.it>
From: "Mannatech Independent Wellness Consultant  Distrib" 
To: 
Subject: Invoice #: 342
Date: Thu, 23 Nov 2017 01:02:31 +0300
MIME-Version: 1.0
Content-Type: multipart/mixed;
	boundary="----=_NextPart_000_1EF5_01D363F6.BD8D6020"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.5931
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.6157

[attachment not included]