Spam and Phish | Entries from Monday, July 11. 2022

T-shirt spam from Outlook

Posted by Dave Yadallee on Monday, July 11. 2022

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 11 Jul 2022 13:51:01 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1oAzQ9-000HE8-Cv

for dave@doctor.nl2k.ab.ca;

Mon, 11 Jul 2022 13:50:17 -0600

Resent-From: The Doctor

Resent-Date: Mon, 11 Jul 2022 13:50:17 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-yb1-f194.google.com ([209.85.219.194]:38689)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1oAzOr-000H5s-SE

for root@nk.ca;

Mon, 11 Jul 2022 13:49:03 -0600

Received: by mail-yb1-f194.google.com with SMTP id 136so10458616ybl.5

for ; Mon, 11 Jul 2022 12:48:40 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20210112;

h=from:mime-version:date:message-id:subject:to;

bh=x8gMNtvd/slEhMxqDOvLPg+KcqIqzKbBC9eEZNd1Y6g=;

b=Y5DMUfzfHjb6VNye13mqZhEPMkSnvmYVcoiojA7NYbeos/3YfiBQE1YGcFI6wzAQ6S

pnAJ6D2PjuSajBfPw4XDJWvn7hGKw12MOOr8tXh8CWKEWbt+TcKJipuDI1j85iFldV8K

AJU7QKwR38QZdlm/rXQDvf/e6QKkC++AZ8VruQwB2roxeLNRiELLWWpzg5jxBiZpf9oH

JBlYc4+5YN3E+0bg26aWBIOcDuvSbESOjN/nYfzNSoFBTqDEiCcLl/cUH7eChKjwZ/uL

FsEjL7yECI+dn4/4Onc8I16uld3mtudz2Y6LNF9GPPlF/Rjb3OSRQcPE5SpTMMLBEby6

0V1g==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=x-gm-message-state:from:mime-version:date:message-id:subject:to;

bh=x8gMNtvd/slEhMxqDOvLPg+KcqIqzKbBC9eEZNd1Y6g=;

b=Z/T4LcifOjgshR4oEQ0MLuap3LLxNSyl+tsNl4yU143KdK5alU9ZqbVeShG+piolVc

SInFULFTfcKz1MoqO/oceE9HNe0z7Su31xVcYOnF7Ptgt03cbm6BAGuVlG9WGjPmPXIH

eUi+gGEURIh+wh+/ntVfDVN3atfgQGE+mUfCnGTjZdqchigGf1d0I+5z3zUjDxaEE24v

bPnhoYYkILLieVIzFUutSpi11BNkEmZsJydlERVhvUqkIg0r0x4LvvSAufRxyE1TJ9rZ

43p8ugnspr2v7W0MP4bZC2wfkN/mWEbtbJ2fiiM8UMdWPZwy10QGBvaTrl+VOByb9qfW

m29g==

X-Gm-Message-State: AJIora8UiFpqpqsULEF3L+P427BLqQ3FC/hAFG61ybeIQ/azCBgjhHLG

9IYsggPoTtL84PQ/C2Bqh5wsT53r+JspNO9UgpaNqOSFUNs=

X-Google-Smtp-Source: AGRyM1tN36gJpMjBmFDKLB1bWXcOXI3rmzoeKVgXuY0udW2spTx22UpvFTN2l21eQmhXzh9/xSsal1rGM8L6mGyJUq0=

X-Received: by 2002:ab0:c19:0:b0:381:cadf:91b3 with SMTP id

a25-20020ab00c19000000b00381cadf91b3mr5975469uak.93.1657559371066; Mon, 11

Jul 2022 10:09:31 -0700 (PDT)

Received: from 479467361694 named unknown by gmailapi.google.com with

HTTPREST; Mon, 11 Jul 2022 17:09:30 +0000

From: Custom T-shirt Shop

MIME-Version: 1.0

Date: Mon, 11 Jul 2022 17:09:30 +0000

Message-ID:

Subject: Set your own name, choose your design, Uniquely Yours! Grab it now!

To: robertsirico@acton.org

Content-Type: multipart/alternative; boundary="00000000000081b3b105e38a9d04"

Bcc: root@nk.ca

X-Spam_score: 5.3

X-Spam_score_int: 53

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Have you got your own uniquely t-shirt? WELCOME TO CUSTOM

TEE SHOP! Have you ever seen any unique t-shirt for YOU and *only YOU*?

[image: Grab]

Content analysis details: (5.3 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL

blocklist

[URIs: tee4engineers-s4.blogspot.com]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URIs: tee4engineers-s4.blogspot.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail

provider

[mucueunicho[at]gmail.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.219.194 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or

identical to background

0.0 HTML_MESSAGE BODY: HTML included in message

0.8 HTML_IMAGE_RATIO_02 BODY: HTML has a low ratio of text to image

area

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily

valid

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from

author's domain

1.0 UNSUB_GOOG_FORM Unsubscribe via Google Docs form

-0.0 T_SCC_BODY_TEXT_LINE No description available.

Subject: {SPAM?} Set your own name, choose your design, Uniquely Yours! Grab it now!

--00000000000081b3b105e38a9d04

Content-Type: text/plain; charset="UTF-8"

Have you got your own uniquely t-shirt?

WELCOME TO CUSTOM TEE SHOP!

Have you ever seen any unique t-shirt

for YOU and *only YOU*?

[image: Grab]

[image: Your]

[image: Own]

[image: T-shirt]

[image: Now!]

[image: Sale]

[image: OFF]

[image: all item]

[image: Special]

[image: Offer]

[image: for You]

[image: Best]

[image: Gift]

[image: ever!]

BE YOURSELF

You are perfect in every way!

PUT YOUR NAME ON IT NOW

[image: Stay confident with your outfit]

Your t-shirt will be as unique as you are!

[image: Any name you want]

Your name or any name you want

A surprise gift for anyone you like

WHY NOT

[image: alt_text]

Or your special date

You name it, you'll have it. Do you have any date or year that mark your

life?

YES I DO

View as a Web Page

Custom Tee Shop

Your personal online shop

unsubscribe

--00000000000081b3b105e38a9d04

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable

=C2=A0

pacing=3D"0" cellpadding=3D"0" bgcolor=3D"#c1ffbf">

#ffffff">

'Gill Sans MT','Myriad Pro','DejaVu Sans Condensed'=

,Helvetica,Arial,'sans-serif';font-size:24px;line-height:32px;color=

:#555555">

WELCOME TO CUSTOM TEE SHOP!
>Have you ever seen any unique t-shirt
for YOU and
ong>only YOU?

0" cellpadding=3D"0" align=3D"center" bgcolor=3D"#ffffff">

s://tee4engineers-s4.blogspot.com/p/im-tattooed-engineer-j-sp071012151277.h=

tml">