Instagram followers spam from Google Gmail
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Fri, 19 Apr 2024 07:44:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))
(envelope-from)
id 1rxoWv-00000000IAy-2zno
for dave@doctor.nl2k.ab.ca;
Fri, 19 Apr 2024 07:43:53 -0600
Resent-From: The Doctor
Resent-Date: Fri, 19 Apr 2024 07:43:53 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-yb1-f198.google.com ([209.85.219.198]:52256)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.97.1 (FreeBSD))
(envelope-from <3GwQiZg0JBeIHIRSWERXMhhffKQEMP.GSQWEPIWRO.GE@maestro.bounces.google.com>)
id 1rxh2N-00000000Krx-40Vs
for sales@nk.ca;
Thu, 18 Apr 2024 23:43:57 -0600
Received: by mail-yb1-f198.google.com with SMTP id 3f1490d57ef6-dc6ceade361so3685685276.0
for; Thu, 18 Apr 2024 22:41:53 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20230601; t=1713505307; x=1714110107; darn=nk.ca;
h=content-transfer-encoding:to:from:subject:date:message-id
:mime-version:from:to:cc:subject:date:message-id:reply-to;
bh=VC5IwZ3FbFJSSKMzOOoZ6aFS3eJBmeMj8dBQFFQo74k=;
b=YdPcoLzHafT48t3W6zRNuOqw47AtD1vGWBIjcog5D5tyY+9oZ5OcZKF2dbkLcULMA5
ruJ8hkb4T1CESBAO5NPG+W+144qc3OxAwNWtv0cJq8kcnjmZ2CfXMSXroKaj3/m9Mub7
hBVHuo93xtmlcxJAbyQnRofPjsGvz6r7cq5UOONcewO48JWwCdbPLTDPskMN3ldBBJ7W
3SrRv/9FsTAIOknDPwH1KtkRCoKRk0lfXG2j3fxSiU8gL1lUkHEGxiVeBAX2nj1XFxpO
N33FdVJEpqQg4YxbVKkAwnCpD6MdOkc+OG098uAC0zyAscPGARFO3hPYBgZUDepnRPWO
Fa3w==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20230601; t=1713505307; x=1714110107;
h=content-transfer-encoding:to:from:subject:date:message-id
:mime-version:x-gm-message-state:from:to:cc:subject:date:message-id
:reply-to;
bh=VC5IwZ3FbFJSSKMzOOoZ6aFS3eJBmeMj8dBQFFQo74k=;
b=KfCEOjtzj1FRz/b/o0UYQXzSBN3aFLAbG9q5dAK9B7SRsbdg/lJUIyUHOrx6opEoeh
iZd8e9GSIsSmGkfgoofAcZecILMhHBM+bJm7OSm8FXbORbPTdy/+Q8jE5G8U3amTwm1l
dSe8OmYV3mU0YlYQ+n5j5HaYiLI/ZLv7WCOvhouAA2KJNHDYBuTzL4+N7R+8oWcRlE+9
RobOCFMM23wIDpgRUF8cRL9ITa5uCvPRjbzii38Tte+mFoaITTdaatUfKfEUCksBY/cJ
T7pbXUYNckyxqzVLDc7RmPeTnDyD24+9UWHvODwfplX2YckwdivTvKjjzABG0uzGnrbk
39zg==
X-Gm-Message-State: AOJu0YxTdYnkshs00OWJWFZZtWGuHc0Th2hdTsSpKLKXiAtrYAZ2ifr3
bCo4c8uH5hye2SHwXlGhvvyevGPs/MY6mjpN0X1aJa4zfD4uZzPjUifzGkDy6xlFgW1DimgWTWw
=
X-Google-Smtp-Source: AGHT+IEMmWPGJAqZBrC8o+Os6vGez6map5Rb7/G+aO/fYapgN/f2keDFD06+Bznod883ilufnsEqWM8ShA==
MIME-Version: 1.0
X-Received: by 2002:a25:69c9:0:b0:dc8:5e26:f4d7 with SMTP id
e192-20020a2569c9000000b00dc85e26f4d7mr296312ybc.13.1713505307548; Thu, 18
Apr 2024 22:41:47 -0700 (PDT)
Message-ID:
Date: Fri, 19 Apr 2024 05:41:47 +0000
Subject: netknowyeg,Information
From: denosanti3311@gmail.com
To: sales@nk.ca
Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes
Content-Transfer-Encoding: base64
X-Spam_score: 6.9
X-Spam_score_int: 69
X-Spam_bar: ++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Hi , Netknow Internet Service Get 100K Followers Instagram
NOW, Please visit the web page below Cheaper. [ https://bit.ly/instamaxshop?netknowyeg
]
Content analysis details: (6.9 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[209.85.219.198 listed in dnsbl.ahbl.org]
[209.85.219.198 listed in dnsbl.ahbl.org]
[209.85.219.198 listed in dnsbl.ahbl.org]
[209.85.219.198 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[209.85.219.198 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[209.85.219.198 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[209.85.219.198 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[209.85.219.198 listed in dnsbl.ahbl.org]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.219.198 listed in list.dnswl.org]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[209.85.219.198 listed in will-spam-for-food.eu.org]
[209.85.219.198 listed in will-spam-for-food.eu.org]
[209.85.219.198 listed in will-spam-for-food.eu.org]
[209.85.219.198 listed in will-spam-for-food.eu.org]
[209.85.219.198 listed in will-spam-for-food.eu.org]
[209.85.219.198 listed in will-spam-for-food.eu.org]
[209.85.219.198 listed in will-spam-for-food.eu.org]
[209.85.219.198 listed in will-spam-for-food.eu.org]
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.219.198 listed in wl.mailspike.net]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay
domain
0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail
domains are different
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[denosanti3311(at)gmail.com]
2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars
0.2 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and EnvelopeFrom
freemail headers are different
Subject: {SPAM?} netknowyeg,Information
SGkgLA0KTmV0a25vdyBJbnRlcm5ldCBTZXJ2aWNlDQoNCg0KR2V0IDEwMEsgRm9sbG93ZXJzIElu
c3RhZ3JhbSBOT1csDQpQbGVhc2UgdmlzaXQgdGhlIHdlYiBwYWdlIGJlbG93IENoZWFwZXIuDQoN
ClsgaHR0cHM6Ly9iaXQubHkvaW5zdGFtYXhzaG9wP25ldGtub3d5ZWcgXQ0KDQpEbyB5b3UgaGF2
ZSBhYm91dCBbIDk1MiBdIEZvbGxvd2VycyA/DQpJbmNyZWFzZSBOb3cgLi4hISEgT2ZmIDQwJSBU
b2RheS4uLiEhIQ0KDQotIEluc3RhbnQNCi0gU2FmZXN0IE1ldGhvZHMNCi0gUHJpdmFjeSBQcm90
ZWN0aW9uDQotIFNwZWVkIDUwSyAtIDEwMEsgRm9sbG93ZXJzL2RheQ0KLSBIaWdoIFF1YWxpdHkg
Rm9sbG93ZXJzICYgUmVhbA0KLSBEcm9wLUJhY2sgR3VhcmFudGVlDQotIFRydXN0ZWQNCi0gU3Rh
cnRpbmcgZ2V0IDVLIEZvbGxvd2VycyBJbnN0YWdyYW0NCg0KKCBUaHJlYWRzLCBJbnN0YWdyYW0s
IFR3aXR0ZXIsIFlvdXR1YmUsIEZhY2Vib29rLCBldGMuICkNCg0KDQoNClRoYW5rIHlvdSwNClJl
Z2FyZHMsDQoNCg0KQ29weXJpZ2h0IMKpIDIwMTQgLSAyMDI1IEluc3RhbWVkaWFQcm9NQVguIEFs
bCBSaWdodHMgUmVzZXJ2ZWQuDQo=
I2.03KL0LD37.0KI2.21KwhoissourceRank12.9MPIN0Summary reportDiagnosisDensity00n/a
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Fri, 19 Apr 2024 07:44:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))
(envelope-from
id 1rxoWv-00000000IAy-2zno
for dave@doctor.nl2k.ab.ca;
Fri, 19 Apr 2024 07:43:53 -0600
Resent-From: The Doctor
Resent-Date: Fri, 19 Apr 2024 07:43:53 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-yb1-f198.google.com ([209.85.219.198]:52256)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.97.1 (FreeBSD))
(envelope-from <3GwQiZg0JBeIHIRSWERXMhhffKQEMP.GSQWEPIWRO.GE@maestro.bounces.google.com>)
id 1rxh2N-00000000Krx-40Vs
for sales@nk.ca;
Thu, 18 Apr 2024 23:43:57 -0600
Received: by mail-yb1-f198.google.com with SMTP id 3f1490d57ef6-dc6ceade361so3685685276.0
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20230601; t=1713505307; x=1714110107; darn=nk.ca;
h=content-transfer-encoding:to:from:subject:date:message-id
:mime-version:from:to:cc:subject:date:message-id:reply-to;
bh=VC5IwZ3FbFJSSKMzOOoZ6aFS3eJBmeMj8dBQFFQo74k=;
b=YdPcoLzHafT48t3W6zRNuOqw47AtD1vGWBIjcog5D5tyY+9oZ5OcZKF2dbkLcULMA5
ruJ8hkb4T1CESBAO5NPG+W+144qc3OxAwNWtv0cJq8kcnjmZ2CfXMSXroKaj3/m9Mub7
hBVHuo93xtmlcxJAbyQnRofPjsGvz6r7cq5UOONcewO48JWwCdbPLTDPskMN3ldBBJ7W
3SrRv/9FsTAIOknDPwH1KtkRCoKRk0lfXG2j3fxSiU8gL1lUkHEGxiVeBAX2nj1XFxpO
N33FdVJEpqQg4YxbVKkAwnCpD6MdOkc+OG098uAC0zyAscPGARFO3hPYBgZUDepnRPWO
Fa3w==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20230601; t=1713505307; x=1714110107;
h=content-transfer-encoding:to:from:subject:date:message-id
:mime-version:x-gm-message-state:from:to:cc:subject:date:message-id
:reply-to;
bh=VC5IwZ3FbFJSSKMzOOoZ6aFS3eJBmeMj8dBQFFQo74k=;
b=KfCEOjtzj1FRz/b/o0UYQXzSBN3aFLAbG9q5dAK9B7SRsbdg/lJUIyUHOrx6opEoeh
iZd8e9GSIsSmGkfgoofAcZecILMhHBM+bJm7OSm8FXbORbPTdy/+Q8jE5G8U3amTwm1l
dSe8OmYV3mU0YlYQ+n5j5HaYiLI/ZLv7WCOvhouAA2KJNHDYBuTzL4+N7R+8oWcRlE+9
RobOCFMM23wIDpgRUF8cRL9ITa5uCvPRjbzii38Tte+mFoaITTdaatUfKfEUCksBY/cJ
T7pbXUYNckyxqzVLDc7RmPeTnDyD24+9UWHvODwfplX2YckwdivTvKjjzABG0uzGnrbk
39zg==
X-Gm-Message-State: AOJu0YxTdYnkshs00OWJWFZZtWGuHc0Th2hdTsSpKLKXiAtrYAZ2ifr3
bCo4c8uH5hye2SHwXlGhvvyevGPs/MY6mjpN0X1aJa4zfD4uZzPjUifzGkDy6xlFgW1DimgWTWw
=
X-Google-Smtp-Source: AGHT+IEMmWPGJAqZBrC8o+Os6vGez6map5Rb7/G+aO/fYapgN/f2keDFD06+Bznod883ilufnsEqWM8ShA==
MIME-Version: 1.0
X-Received: by 2002:a25:69c9:0:b0:dc8:5e26:f4d7 with SMTP id
e192-20020a2569c9000000b00dc85e26f4d7mr296312ybc.13.1713505307548; Thu, 18
Apr 2024 22:41:47 -0700 (PDT)
Message-ID:
Date: Fri, 19 Apr 2024 05:41:47 +0000
Subject: netknowyeg,Information
From: denosanti3311@gmail.com
To: sales@nk.ca
Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes
Content-Transfer-Encoding: base64
X-Spam_score: 6.9
X-Spam_score_int: 69
X-Spam_bar: ++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Hi , Netknow Internet Service Get 100K Followers Instagram
NOW, Please visit the web page below Cheaper. [ https://bit.ly/instamaxshop?netknowyeg
]
Content analysis details: (6.9 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[209.85.219.198 listed in dnsbl.ahbl.org]
[209.85.219.198 listed in dnsbl.ahbl.org]
[209.85.219.198 listed in dnsbl.ahbl.org]
[209.85.219.198 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[209.85.219.198 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[209.85.219.198 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[209.85.219.198 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[209.85.219.198 listed in dnsbl.ahbl.org]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.219.198 listed in list.dnswl.org]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[209.85.219.198 listed in will-spam-for-food.eu.org]
[209.85.219.198 listed in will-spam-for-food.eu.org]
[209.85.219.198 listed in will-spam-for-food.eu.org]
[209.85.219.198 listed in will-spam-for-food.eu.org]
[209.85.219.198 listed in will-spam-for-food.eu.org]
[209.85.219.198 listed in will-spam-for-food.eu.org]
[209.85.219.198 listed in will-spam-for-food.eu.org]
[209.85.219.198 listed in will-spam-for-food.eu.org]
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.219.198 listed in wl.mailspike.net]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay
domain
0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail
domains are different
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[denosanti3311(at)gmail.com]
2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars
0.2 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and EnvelopeFrom
freemail headers are different
Subject: {SPAM?} netknowyeg,Information
SGkgLA0KTmV0a25vdyBJbnRlcm5ldCBTZXJ2aWNlDQoNCg0KR2V0IDEwMEsgRm9sbG93ZXJzIElu
c3RhZ3JhbSBOT1csDQpQbGVhc2UgdmlzaXQgdGhlIHdlYiBwYWdlIGJlbG93IENoZWFwZXIuDQoN
ClsgaHR0cHM6Ly9iaXQubHkvaW5zdGFtYXhzaG9wP25ldGtub3d5ZWcgXQ0KDQpEbyB5b3UgaGF2
ZSBhYm91dCBbIDk1MiBdIEZvbGxvd2VycyA/DQpJbmNyZWFzZSBOb3cgLi4hISEgT2ZmIDQwJSBU
b2RheS4uLiEhIQ0KDQotIEluc3RhbnQNCi0gU2FmZXN0IE1ldGhvZHMNCi0gUHJpdmFjeSBQcm90
ZWN0aW9uDQotIFNwZWVkIDUwSyAtIDEwMEsgRm9sbG93ZXJzL2RheQ0KLSBIaWdoIFF1YWxpdHkg
Rm9sbG93ZXJzICYgUmVhbA0KLSBEcm9wLUJhY2sgR3VhcmFudGVlDQotIFRydXN0ZWQNCi0gU3Rh
cnRpbmcgZ2V0IDVLIEZvbGxvd2VycyBJbnN0YWdyYW0NCg0KKCBUaHJlYWRzLCBJbnN0YWdyYW0s
IFR3aXR0ZXIsIFlvdXR1YmUsIEZhY2Vib29rLCBldGMuICkNCg0KDQoNClRoYW5rIHlvdSwNClJl
Z2FyZHMsDQoNCg0KQ29weXJpZ2h0IMKpIDIwMTQgLSAyMDI1IEluc3RhbWVkaWFQcm9NQVguIEFs
bCBSaWdodHMgUmVzZXJ2ZWQuDQo=
I2.03KL0LD37.0KI2.21KwhoissourceRank12.9MPIN0Summary reportDiagnosisDensity00n/a
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments