AMP-RI “Here’s What’s Coming Up Next” Email With Bitcoin Transfer Link: Likely Mailchimp Signup Form Abuse

Warning: I received an unsolicited email with the subject “Here's what's coming up next” that appeared to be an AMP-RI mailing-list confirmation sent through Mailchimp.

What made the message suspicious was not the normal newsletter content. Near the bottom, the email reproduced information supposedly submitted through a signup form, and the Last Name field contained a Bitcoin-related scam message and an external link.

The external destination is omitted from this article for safety.

Details of the email


Subject: Here's what's coming up next

Displayed sender: AMP-RI <info＠amp-ri.com>

Received: September 16, 2026

The email included the following text:

For your records, here is a copy of the information you submitted to us...

Email Address: [recipient address omitted]
First Name: Tricobis
Last Name: 1.1542 BITCOIN TRANSFER ON HOLD. CONFIRM HERE [external URL omitted]

Why this looks like signup-form abuse

This case is unusual because AMP-RI itself appears to be a real professional organization, and the email otherwise resembles an ordinary Mailchimp subscription message.

The suspicious Bitcoin text appears specifically inside the value recorded as the subscriber's Last Name. That strongly suggests that somebody may have submitted the recipient's email address to a newsletter form while placing the scam message and link into another form field.

The automated email then appears to have reproduced those submitted values back to the recipient.

This does not by itself mean that AMP-RI created the Bitcoin message, that AMP-RI intentionally sent a scam, or that its email account was hacked.

Mailchimp itself warns that signup forms can receive fake signups and recommends protections such as reCAPTCHA for embedded forms:

Mailchimp: Add an Embedded Signup Form to Your Website

The legitimate-looking sender does not make the inserted link safe

This example shows why checking only the displayed sender address is not always enough.

A legitimate organization and a legitimate email-marketing platform can potentially be used as part of an abuse chain if an attacker is able to submit another person's email address and attacker-controlled text through a public form.

In this case, the strongest warning sign is the completely unrelated message:

1.1542 BITCOIN TRANSFER ON HOLD. CONFIRM HERE

A newsletter signup confirmation has no legitimate reason to ask the recipient to confirm a Bitcoin transfer through an unrelated external link.

What to do if you receive this email

  • Do not click the Bitcoin-related link.
  • Do not enter cryptocurrency wallet information, passwords, recovery phrases, payment details, or personal information.
  • If you did not subscribe to the mailing list, you can report the message as spam and delete it.
  • Do not assume that every other link in the message is safe merely because the email contains legitimate Mailchimp or organization links.
  • If you need to contact the organization, reach its website independently rather than through the suspicious content in the email.

The notable feature of this incident is therefore not simply another Bitcoin spam message. It is the apparent use of a legitimate newsletter signup and automated email system to deliver attacker-controlled text to someone who did not submit that information themselves.

Comments

Post a Comment

Popular posts from this blog

MetaMask phishing email from system@phrase.com: “Please set up your new sign option and link your email”

Image
I received a suspicious email impersonating MetaMask with the subject: Please set up your new sign option and link your email The visible sender was: TheMetamaskTeamTMS Phrase <system@phrase.com> This email is particularly worth documenting because Gmail reported that its authentication checks passed: SPF: PASS DKIM: PASS for phrase.com DMARC: PASS However, passing SPF, DKIM and DMARC does not mean that MetaMask sent or authorized the message. What the email says The message asks the recipient to set up a “new sign option” and link an email address. It says the action applies to all users and creates urgency by stating that the link will expire after 24 hours. The main button says: Set Up New Sign Option & Link Email The email also states: This link will expire after 24 hours. I have intentionally not reproduced the destination URL in this article. Why this email should not be trusted as a MetaMask message MetaMask's own Help Center ...
Read more

ArterioFlush Scam Email: Dr. Oz “Arterial Flush Ritual” and CBS News Claims

Image
Warning: I received an unsolicited email promoting a product called ArterioFlush and claiming that a simple “Arterial Flush Ritual” can rapidly reverse high blood pressure. The email had the subject line “Watch before deleted: The simple ritual resetting BP to 118/78” and showed the sender as support@eurobunker-arena.com . It uses CBS News branding and Dr. Oz’s name while claiming that a substance called “Arterial Cement” is responsible for hypertension and can supposedly be flushed away with a natural compound. Why this email is suspicious The displayed sender address is unrelated to CBS News. The link presented as a CBS News presentation does not lead to cbsnews.com. It points to a Google Cloud Storage address instead. The email makes dramatic medical claims, including large blood-pressure reductions within days and the removal of arterial plaque. It specifically names prescription drugs such as Losartan, Amlodipine, and Lisinopril while presenting the promoted “ritua...
Read more

“URGENT: Watch before CNN removes this knee surgery video” — spam email from support@uploadboy.com

Image
I received a suspicious health-related spam email with the subject: URGENT: Watch before CNN removes this knee surgery video The visible sender was: Knee Joint News <support@uploadboy.com> The message claims that a Harvard researcher discovered a simple morning honey recipe that can help people avoid knee surgery. It also repeatedly refers to CNN and creates urgency by suggesting that the video may soon be removed. What the email claims The email uses the headline: Harvard Researcher Reveals the Simple Recipe That's Saving Americans From Knee Surgery! It claims that joint pain is caused by a “joint toxin” and that a daily honey routine can supposedly flush it out. The message also includes dramatic personal stories, including claims that people who needed canes or walkers were able to move normally again after following the routine. Why this email is suspicious The email did not come from CNN, Harvard University, or a medical provider. It was sent ...
Read more