The mystery is what happens to you if you fall for this scam. The real address in the FROM field is hiddenfindsbox.sbs”. “sbs” is not a particular country. I did not check out what is at that URL.