header:
01: Received: from mail-wr1-f68.google.com ([209.85.221.68]) by mx-ha.gmx.net
02: (mxgmx014 [212.227.15.9]) with ESMTPS (Nemesis) ID: [ID filtered]
03: for <x>; Tue, 21 Jan 2020 xx:xx:xx +0100
04: Received: by mail-wr1-f68.google.com with SMTP ID: [ID filtered]
05: for <x>; Tue, 21 Jan 2020 xx:xx:xx -0800 (PST)
06: Received: from ip-172-31-13-25
07: (ec2-18-195-168-13.eu-central-1.compute.amazonaws.com. [18.195.168.13])
08: by smtp.gmail.com with ESMTPSA ID: [ID filtered]
09: (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
10: Tue, 21 Jan 2020 xx:xx:xx -0800 (PST)

Hallo,

Vielen Dank für Ihre Bestellung. Ihre Bestätigungsnummer lautet PX6QSHX9

Bitte sehen Sie alle Details in der angehängten Datei ( PDF͛ ).
URL in PDF:

whois:http://ad4e.com/p5OF4wU

weiter auf:

whois:http://secure1-manageorder.amazon-cencelmyorder.atzxw.com
IP: 162.241.201.44 -> 162-241-201-44.unifiedlayer.com