Previously I took a close look at another invite scam based on the use of Punchbowl as a cover. The mystery invite is a similar scam, using near identical techniques. But the psychology is different.
The Message
As you can see, the message is vague. Nothing specific. It is designed to get your attention and to learn more about the message you will need to click a link (“Tap to View Invitation”). There are two locations in the message where a link is provided. It is a dangerous connection because it launches a script (written in PHP). It is not a conventional HTML coded web page.
Another important aspect is how this type of message appears on a smartphone. “A Night Made for You” is actually an image block that takes up the whole screen. For some phone users, they may not take the precaution of scrolling through the message, but simply press the screen.
The Email Address
The email where I first received the message was in an account reserved for communicating with friends and family. The message was from a person I had known for years and had worked with on numerous occasions at our church. It did not surprise me when the same message appeared under an e-mail account reserved for church activities. And it also appeared in my G-Mail account, an account we used for collaborative projects. If anything, it was clear evidence that someone had tapped into this person’s e-mail address book.
As a side note, it is important to realize that e-mail software is often set up by default to automatically collect e-mail addresses. For Thunderbird, these are stored under “Collected Addresses.” In contrast, there is a “Personal Address Book” where you can intentionally add addresses. While “collected addresses” is a convenient feature, it can also expose email traffic to people you may not realize.
The Links
As noted above, this message has only one URL.
https://nuvellor.net/vvvip11/log.php
The log.php part of this URL is the dangerous component. Unfortunately, PHP scripts are not always readable “as is” using your browser. So heaven knows what it will attempt to do. PHP is a server-side operation. HTML, the code in which most web pages are written, is a browser-side operation. In essence, a PHP script can be tucked away securely on a server out of sight. This is referred to as “back-end” processing. HTML is the front-end. More on that later.
Who Is
So who is nuvellor.net?
WHOIS reports this domain as being registered only on October 6th, 2026. So this message was generated a mere three days after the domain was registered. It was registered through Hostinger, a Lithuanian company. So the biggest red flag is the recent registration date. The second is no location data is presented for the registrant. A third concern may be the registration site in Lithuania. While that in itself is not necessarily a red flag, it is something to note for now.
What about the IP Address
The IP addresses associated with the nuvellor.net domain are as follows:
~$ nslookup nuvellor.net
Server: 127.0.0.53
Address: 127.0.0.53#53
Non-authoritative answer:
Name: nuvellor.net
Address: 104.21.86.189
Name: nuvellor.net
Address: 172.67.136.25
Name: nuvellor.net
Address: 2606:4700:3030::6815:56bd
Name: nuvellor.net
Address: 2606:4700:3035::ac43:8819
AbuseIPDB reports these IP addresses as being from Cloudfare. There is no reported abusive activity reported for these IP addresses as of this time.
What Happens When You Click Any of the Links
It will launch a script written in PHP. The peculiar thing about the PHP script is that it is not readable using your browser, so I have no idea what the script is running.
My attempt to read the script produced this warning in Firefox
view-source:https://nuvellor.net/vvvip11/log.php
Out of curiousity, tried the same thing in Chromium, with a similar result.
Clicking “Advanced” will produce an explanation for the red-flag.
Self-signed certificates are not always a bad thing if you are looking at intranet activity. But any time you are accessing a site over an internet connection, you want the digital certificate to be signed by an authorized third party certificate issuer.
Viewing the certificate provides some more hints about the operation. The certificate reports the domain as 1-i-1-0.es, and WHOIS reports the following warning.
$ nslookup 1-i-1-0.es
Server: 127.0.0.53
Address: 127.0.0.53#53
Non-authoritative answer:
Name: 1-i-1-0.es
Address: 185.53.179.136
AbuseIPDB does report this site as a concern, with 26% of its traffic being reported as abusive.
As you can see, this mystery is like an onion, each layer we peel off reveals another questionable link.
Header Analysis
The email header on this message matches exactly with that of the header described for the Punchbowl scam. In summary, the scammers are using the same technique, utilizing a bulk mail service to inject a digitally signed, authenticated message that passes through the mail servers as a certified, legitimate message. It is presented by a system using a private IP address, injected into the Google network before being delivered to my e-mail account at IONOS (another web provider).
Is This Scam a Trend?
It took a while, but the key phrase that generated dozens of hits was “SPECIAL INVITATION TO A FANTABULOUS DINNER PARTY FROM scam”. The fake invitation is running hot creating all sorts of mischief.
Scoring this Scam
As with the Punchbowl scam, the technique these scammers are using is difficult to intercept with spam filters. This message got through a filter that included Spamassassin. Even if scoring was a feature with email messages, this sort of message would most likely score high because it passes with flying colors the credentialing that is currently in use to certify that email messages are legitimate. The scammers are using bulk-mailing services that are evidently trusted.
There are some negatives.
- Recent registration of domain
- No location data of domain
- Foreign location of registrar
- Link is to a PHP script
- Link has a self-signed certificate, generating a warning on your browser
What You Can Do About It?
To be frank, this sort of message is deadly. It looks so tempting. And the block of the message that activates the link is massive (covering about half of the message space).
- Avoid responding to invites like this using your smartphone. A message like this is designed to take up the entire screen and provides little information about the true nature of the message. Best to save this for a desktop.
- If a friend is inviting you to an unknown event, and you suspect it is a scam, call your friend to be sure.
- Before clicking, hover over buttons to see if the corresponding URL matches the actual company it claims to be. This is another reason to use your desktop to view the message.
- If you can get an IP address of the abuser, AbuseIPDB has a rather efficient reporting process which can quickly be completed.
- Cloudfare, however, has a rather extensive form to fill out. In fact, it is about as extensive as the completion of this article. 🙂 Unfortunately, their reporting page fails when you click “Submit,” presenting a 403 error (which means “Missing Page.”). Maybe it gets through.
- If you get fooled and type in your password, change your password immediately. And get smart about passwords. See Passwords – The Gremlins of Cyberspace.
- Mark as spam? IONOS, my email provider, has such an option. But reporting a message as spam (which Google provides) and marking a message as spam are two different things. Marking the message as spam may block messages from your friend altogether.
Resources
- Passwords – The Gremlins of Cyberspace
- Email: A Method to the Madness
- WHOIS
- AbuseIPDB
- “PHP vs HTML,” Geeks for Geeks, August 30, 2019
© Copyright 2026 to Eric Niewoehner