I wish I'd kept my checklist I created for work, saved hours.
These are some basic questions I do remember, every "Bad" is like a line on hangman
1. Were you expecting the email [No, is bad]
2. Is it specifically addressed to you [No, is bad]
3. Does it have some attachment [Yes, is bad]
4. Is it from an unknown address [Yes, is bad]
5. Does it want you to "click a link" [Yes, is bad]
6. Does it claim to be urgent [Yes, is bad]
7. Does it require you to log on somewhere [Yes, is bad]
8. Are there linked images (that do not obviously come from the legitimate site) [Yes, is bad]
9. Are there spelling or grammatical errors [Yes, is bad]
10. Is the "From" incorrect or masked [Yes, is bad]
In this example if the email is from the wrong domain that is (1 Bad), "To:" hidden, (2) not expected, (3), requires you to log on somewhere, (4), probably from a link they give (5), already that goes in the bin.
It is likely the email used for twitter, or handle has been picked up from some target list, probably from some hack.
Visit haveibeenpwned . com and see where it was scalped from, then consider if you have reused passwords elsewhere, fix that, as others may be trying to get access to other online resources to grab your accounts or identity.
Once you are on the list, it is better to assume the next few contacts will be similar attempts.
A good time to turn on multi factor and update passwords.
