Crypto currency spam from Amazon
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Sun, 07 Aug 2022 04:22:01 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))
(envelope-from)
id 1oKdPh-000Ojs-Qp
for dave@doctor.nl2k.ab.ca;
Sun, 07 Aug 2022 04:21:41 -0600
Resent-From: The Doctor
Resent-Date: Sun, 7 Aug 2022 04:21:41 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from ec2-3-13-125-39.us-east-2.compute.amazonaws.com ([3.13.125.39]:56872)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.95 (FreeBSD))
(envelope-from)
id 1oKXPh-000GTC-6G
for doctor@doctor.nl2k.ab.ca;
Sat, 06 Aug 2022 21:57:22 -0600
Received: from lifewise by hosting.247webhostingservice.com with local (Exim 4.95)
(envelope-from)
id 1oKXPG-0001gO-3o
for doctor@doctor.nl2k.ab.ca;
Sat, 06 Aug 2022 23:56:50 -0400
To: doctor@doctor.nl2k.ab.ca
Subject: CRYPTOCURRENCY WILL MAKE YOU A MILLIONAIRE
X-PHP-Script: lifewiselearningcenter.com/index.php for 156.146.63.156
X-PHP-Originating-Script: 1028:PHPMailer.php
Date: Sun, 7 Aug 2022 03:56:50 +0000
From: EducationWP
Reply-To: admin@educationwp.thimpress.com
Message-ID:
X-Mailer: PHPMailer 6.6.0 (https://github.com/PHPMailer/PHPMailer)
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="b1_avqtgc8hYkFaIQtaGNs1KJFGAsLe1R7jBgLQgDuSVQ"
Content-Transfer-Encoding: 8bit
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - hosting.247webhostingservice.com
X-AntiAbuse: Original Domain - doctor.nl2k.ab.ca
X-AntiAbuse: Originator/Caller UID/GID - [1028 993] / [47 12]
X-AntiAbuse: Sender Address Domain - hosting.247webhostingservice.com
X-Get-Message-Sender-Via: hosting.247webhostingservice.com: authenticated_id: lifewise/only user confirmed/virtual account not confirmed
X-Authenticated-Sender: hosting.247webhostingservice.com: lifewise
X-Source:
X-Source-Args: php-fpm: pool lifewiselearningcenter_com
X-Source-Dir: lifewiselearningcenter.com:/public_html
X-Spam_score: 7.7
X-Spam_score_int: 77
X-Spam_bar: +++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Message Body: THE WORLD FINANCIAL CRISIS CAN MAKE YOU RICH!
https://telegra.ph/Cryptocurrency-makes-people-millionaires-at-15-people-per-hour---Page-484685-08-02
-- This e-mail was sent from a contact form on EducationWP (http://educationwp.thimpress.com/demo-el-3/)
Content analysis details: (7.7 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was
blocked. See
http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
for more information.
[URIs: thimpress.com]
1.6 SUBJ_ALL_CAPS Subject is all capitals
0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
mail domains are different
-0.0 SPF_PASS SPF: sender matches SPF record
0.0 HTML_MESSAGE BODY: HTML included in message
0.4 RDNS_DYNAMIC Delivered to internal network by host with
dynamic-looking rDNS
2.5 PHP_SCRIPT Sent by PHP script
3.2 HELO_DYNAMIC_IPADDR Relay HELO'd using suspicious hostname (IP
addr 1)
Subject: {SPAM?} CRYPTOCURRENCY WILL MAKE YOU A MILLIONAIRE
This is a multi-part message in MIME format.
--b1_avqtgc8hYkFaIQtaGNs1KJFGAsLe1R7jBgLQgDuSVQ
Content-Type: text/plain; charset=us-ascii
Message Body:
THE WORLD FINANCIAL CRISIS CAN MAKE YOU RICH! https://telegra.ph/Cryptocurrency-makes-people-millionaires-at-15-people-per-hour---Page-484685-08-02
--
This e-mail was sent from a contact form on EducationWP (http://educationwp.thimpress.com/demo-el-3/)
--b1_avqtgc8hYkFaIQtaGNs1KJFGAsLe1R7jBgLQgDuSVQ
Content-Type: text/html; charset=us-ascii
--b1_avqtgc8hYkFaIQtaGNs1KJFGAsLe1R7jBgLQgDuSVQ--
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Sun, 07 Aug 2022 04:22:01 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))
(envelope-from
id 1oKdPh-000Ojs-Qp
for dave@doctor.nl2k.ab.ca;
Sun, 07 Aug 2022 04:21:41 -0600
Resent-From: The Doctor
Resent-Date: Sun, 7 Aug 2022 04:21:41 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from ec2-3-13-125-39.us-east-2.compute.amazonaws.com ([3.13.125.39]:56872)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.95 (FreeBSD))
(envelope-from
id 1oKXPh-000GTC-6G
for doctor@doctor.nl2k.ab.ca;
Sat, 06 Aug 2022 21:57:22 -0600
Received: from lifewise by hosting.247webhostingservice.com with local (Exim 4.95)
(envelope-from
id 1oKXPG-0001gO-3o
for doctor@doctor.nl2k.ab.ca;
Sat, 06 Aug 2022 23:56:50 -0400
To: doctor@doctor.nl2k.ab.ca
Subject: CRYPTOCURRENCY WILL MAKE YOU A MILLIONAIRE
X-PHP-Script: lifewiselearningcenter.com/index.php for 156.146.63.156
X-PHP-Originating-Script: 1028:PHPMailer.php
Date: Sun, 7 Aug 2022 03:56:50 +0000
From: EducationWP
Reply-To: admin@educationwp.thimpress.com
Message-ID:
X-Mailer: PHPMailer 6.6.0 (https://github.com/PHPMailer/PHPMailer)
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="b1_avqtgc8hYkFaIQtaGNs1KJFGAsLe1R7jBgLQgDuSVQ"
Content-Transfer-Encoding: 8bit
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - hosting.247webhostingservice.com
X-AntiAbuse: Original Domain - doctor.nl2k.ab.ca
X-AntiAbuse: Originator/Caller UID/GID - [1028 993] / [47 12]
X-AntiAbuse: Sender Address Domain - hosting.247webhostingservice.com
X-Get-Message-Sender-Via: hosting.247webhostingservice.com: authenticated_id: lifewise/only user confirmed/virtual account not confirmed
X-Authenticated-Sender: hosting.247webhostingservice.com: lifewise
X-Source:
X-Source-Args: php-fpm: pool lifewiselearningcenter_com
X-Source-Dir: lifewiselearningcenter.com:/public_html
X-Spam_score: 7.7
X-Spam_score_int: 77
X-Spam_bar: +++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Message Body: THE WORLD FINANCIAL CRISIS CAN MAKE YOU RICH!
https://telegra.ph/Cryptocurrency-makes-people-millionaires-at-15-people-per-hour---Page-484685-08-02
-- This e-mail was sent from a contact form on EducationWP (http://educationwp.thimpress.com/demo-el-3/)
Content analysis details: (7.7 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was
blocked. See
http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
for more information.
[URIs: thimpress.com]
1.6 SUBJ_ALL_CAPS Subject is all capitals
0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
mail domains are different
-0.0 SPF_PASS SPF: sender matches SPF record
0.0 HTML_MESSAGE BODY: HTML included in message
0.4 RDNS_DYNAMIC Delivered to internal network by host with
dynamic-looking rDNS
2.5 PHP_SCRIPT Sent by PHP script
3.2 HELO_DYNAMIC_IPADDR Relay HELO'd using suspicious hostname (IP
addr 1)
Subject: {SPAM?} CRYPTOCURRENCY WILL MAKE YOU A MILLIONAIRE
This is a multi-part message in MIME format.
--b1_avqtgc8hYkFaIQtaGNs1KJFGAsLe1R7jBgLQgDuSVQ
Content-Type: text/plain; charset=us-ascii
Message Body:
THE WORLD FINANCIAL CRISIS CAN MAKE YOU RICH! https://telegra.ph/Cryptocurrency-makes-people-millionaires-at-15-people-per-hour---Page-484685-08-02
--
This e-mail was sent from a contact form on EducationWP (http://educationwp.thimpress.com/demo-el-3/)
--b1_avqtgc8hYkFaIQtaGNs1KJFGAsLe1R7jBgLQgDuSVQ
Content-Type: text/html; charset=us-ascii
Message Body:
THE WORLD FINANCIAL CRISIS CAN MAKE YOU RICH! https://telegra.ph/Cryptocurrency-makes-people-millionaires-at-15-people-per-hour---Page-484685-08-02
--
This e-mail was sent from a contact form on EducationWP (http://educationwp.thimpress.com/demo-el-3/)
--b1_avqtgc8hYkFaIQtaGNs1KJFGAsLe1R7jBgLQgDuSVQ--