Main blog

You're being targeted by one of the cleverest scams going right now, and the reason it works is uncomfortable: the email genuinely came from PayPal.

The trick is in the subject line, not the email

When most people think "phishing email," they picture sketchy senders, broken English, and links to weird domains. This scam is the opposite. The email passes every authenticity check — SPF, DKIM, DMARC, all green. It comes from PayPal's actual mail servers. The fonts are right. The footer is right. The unsubscribe link works. If you forwarded it to a security expert and asked "is this really from PayPal?" they'd have to say yes.

So how is it a scam?

Scammers have figured out that PayPal lets anyone send small amounts of money to anyone else, and that PayPal will dutifully email the recipient a notification. The scammer sends you a payout of, say, one Hungarian forint — about a quarter of a cent. PayPal's system then automatically generates and sends you a real, legitimate, fully-authenticated email confirming the transaction.

Here's the catch: the email's subject line is whatever the scammer typed when they set up the payout. PayPal doesn't sanitize it. So they write something terrifying like "Pending charge of USD 987.90 — call this number with questions" and PayPal's servers cheerfully deliver that subject line straight to your inbox, wrapped in a perfectly legitimate-looking notification.

March 31

Tumblr user @sexy-people-contests-2026 posts the first round of their tumblr sexy jester/clown poll bracket. Entries were collected via community form, in which a user submitted vtuber Gavis Bettel.

April 3

Cover Corporation (parent company of Hololive Production) announces that they are downsizing their male vtuber branch, Holostars. Company support is almost entirely pulled from their 12 Japanese talents. Fans of their 10 English talents worry that they could be next on the chopping block. A larger discussion on how these talents are marketed by the company also begins.

April 7

Bettel wins his first round against Laughing Jack and moves onto the next round. In this next match up he is put against Shadow Milk Cookie from Cookie Run Kingdom.

April 8

Gavis Bettel hits 200k subscribers on YouTube.

April 9

Twitter users are made aware of the poll. Users start coming back to their old tumblr accounts or create new ones to start voting for Bettel.

April 10

Bettel becomes aware of the poll.

He also becomes a popular pick for people who are mad at the writing decisions made in Cookie Run Kingdom.

People also start making joke ship art between Bettel and Shadow Milk (bettelmilk)

April 15

Bettel wins the second round and moves on to round three.

In this round he is put against Pomni from The Amazing Digital Circus.

He talks about the poll bracket on his Week in Review stream and admits he has never used tumblr. Viewers inform him of classic tumblr memes and stories. He also asks the social media team from Bandai Namco America (they often appear in his chat) to get on their defunct tumblr to vote for him (they can't access the account).

April 18

Bettel has an unarchieved karaoke stream to celebrate 200k subscribers, the runner of the of the polls tunes in.

April 19

The official Holostars EN twitter and Instagram accounts make ominous posts about the poll since they are unable to directly link to it due to company policy.

April 20-21

Bettel makes one last rallying cry to see if he can get people to vote for him. He receives endorsements from other vtubers including Elira Pendora, Shu Yamino, and Yu Q. Wilson.

The illustrator for his vtuber model, Senzaki Makoto, also becomes aware of the poll and says she will draw him if he wins the bracket.

April 22

With a rally of support from across the vtuber fan sphere, Bettel is able to beat Pomni.