The Candy House Email

It arrived in Spanish, addressed to a name that wasn't quite mine, and told me — at some length — about two children who escape a witch's candy house. There was no ask, no invoice, no urgent warning. Just a fairy tale, two university links, and a signature from someone claiming to work for a Paris insurance company. It read like nothing at all, which is exactly why I couldn't leave it alone.

§1What actually arrived

Translated from the original Spanish, the body read like this:

Nothing in that message connects to anything else in it. A retelling of a Brothers Grimm story links to a state university's admissions page and an academic-advisor directory, then gets signed by "Pierre" from a French insurer whose name never appears anywhere else in the email. The greeting doesn't use a real name — it uses the string before the @ in my address. And underneath a visible link that reads contacto@axa.fr, the actual mailto: target in the raw HTML points to admissions@weber.edu. None of it was asking me for anything. That's what made it worth pulling apart.

§2Verdict

§3What the headers say

The header block is the part of this email that's telling the truth — as far as it goes. It confirms who actually sent the mail, but not why, and not on whose authority.

The message passed SPF and DKIM for arseya.org, and Outlook logged DMARC / compound authentication as passing or best-guess passing. It came from 40.107.200.124 — an outbound Microsoft-protection host — and Outlook's own spam confidence score landed it at SCL 1: not flagged as junk.

That establishes only one thing with confidence: infrastructure authorized to send as arseya.org sent this. It does not establish that AXA sent it, or that it's benign. A compromised Microsoft 365 tenant, an abused mailbox, or a domain built for spam are all consistent with what the headers show — the headers alone can't tell those apart. The clumsy construction of the message reads like it was built specifically to slide under simple filters without tripping content-based detection.

§4Seven things that don't add up

1. Identity mismatch. The authenticated sender is at arseya.org; the signature claims to be Pierre from AXA S.A.
2. Misleading link. Visible text reads contacto@axa.fr; the underlying mailto: target is admissions@weber.edu.
3. Unrelated content. Sender, AXA signature, Spanish fairy tale, and Weber State University URLs share no coherent thread.
4. Generic personalization. The greeting uses my mailbox name, not a verified real name.
5. Unexplained attachment. A file named CLIENTE23915.bin arrived with no reason given for it.
6. Likely hash-busting content. That attachment is 32 random-looking hex strings — the kind of inert filler used to change a message's hash and dodge signature-based spam detection.
7. No business purpose stated. The email never says why AXA, Weber State, or the sender is contacting me at all.

§5Where the links actually go

Both HTTPS links in the body resolved, on inspection, to ordinary Weber State University pages — one an admissions "what's next" page, the other an academic-advisor directory. No redirect chain, no credential form, no drive-by download.

A legitimate destination doesn't launder the rest of the email — it just means these two links, in this specimen, on this day, were decoys rather than the attack itself. Page behavior can change after the fact, so that's a snapshot, not a guarantee.

§6The 1,055 bytes that don't do anything

The attachment is where the message stops pretending to make sense and starts looking like tooling.

The .bin extension and the MacBinary MIME label both suggest a binary payload; what's actually inside is inert plain text with no code and no links. That mismatch, and the fact that nothing in the message explains why the attachment exists, is why it still shouldn't be opened — its only apparent job is to make every copy of this email hash differently.

§7So what is this, actually?

This isn't a conventional phishing attempt — it never asks for a login, a payment, or a reply. But false identity cues, mismatched link destinations, unrelated legitimate URLs, and randomized attachment filler don't happen by accident together. That combination is deliberate.

The most likely explanation is spam-filter testing or reputation conditioning: whoever sent this may be probing mailbox delivery, using benign university links to build deliverability history, or staging infrastructure for a later, sharper campaign. A compromised account blasting out malformed test mail is equally plausible. Nothing in a single specimen is enough to identify the operator or predict the next stage.

§8What I did about it

• Reported the message in Outlook as phishing / junk.
• Deleted it after preserving the raw .eml and its hashes.
• Did not reply, call the listed number, or open the attachment.
• No credential reset or device remediation was warranted — there was no interaction beyond saving the file for analysis.

If you ever open a link, enter credentials, or run an attachment from a message like this, that's a different situation — treat it as an active incident, not a research exercise.