Instagram followers spam from Google Gmail
Posted by Dave Yadallee on
Return-path:
Envelope-to: sales@nk.ca
Delivery-date: Thu, 02 May 2024 13:42:00 -0600
Received: from mail-yw1-f197.google.com ([209.85.128.197]:56644)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.97.1 (FreeBSD))
(envelope-from)
id 1s2cIx-00000000Ouw-2HfD
for sales@nk.ca;
Thu, 02 May 2024 13:41:23 -0600
Received: by mail-yw1-f197.google.com with SMTP id 00721157ae682-61df903af62so54137237b3.1
for; Thu, 02 May 2024 12:39:25 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20230601; t=1714678759; x=1715283559; darn=nk.ca;
h=content-transfer-encoding:to:from:subject:date:message-id
:mime-version:from:to:cc:subject:date:message-id:reply-to;
bh=SY+1I/qjfezyBwFATEahr4j/V/f3t/LiUx/L9JjdTcw=;
b=S5BBbIc3GTL0hKTxl/B7sZ7Ejk+7a1qsXDXjtuOJ14BbQPFUIyuPIJsBpJRFLRVn4Z
AAgjegMkdE3vmmjZRHXAzsWBEb/27WRihZUif1hdCmiSL0ixw8VVCYrI9qG8VmDmJ/ZQ
yxv9na7eNdgMATr7UWR+9+2+qxEzHfZJpl+vF4vhKCP0m6dJ5ACU/vAQSm5bCM9pcHOQ
3kEMMxzK/fO1zqUgVXt6Rm3tEmkSbUBzuKBSOMoMr7NelW1Ted9swN25bD9/7dc88rlI
To7rNCWPWwAwfk661ULAsrIk+PZt4wU0TDce0Kruk2/aX5JFMjA53an18JNae+vtVh3s
brjQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20230601; t=1714678759; x=1715283559;
h=content-transfer-encoding:to:from:subject:date:message-id
:mime-version:x-gm-message-state:from:to:cc:subject:date:message-id
:reply-to;
bh=SY+1I/qjfezyBwFATEahr4j/V/f3t/LiUx/L9JjdTcw=;
b=fosL6aMPR8RnIv6i8muBU5C8MqKdnrxxbEx1HG3lKmFa1ygF3m1jb6GD5B2aYdlMcw
YeFiyQaPEjWJ4deuAjkXDGFUe+BNcooNwL6/rqh0ZwGLrUDByzQR8bLg/IsHVq9ZdxHC
bF4OTbqdPtUFDH5+S6fZHHfK4vq7wmgHAgfwLHgV9zw7ngVjQh5riFU0rI7U+BL2SIC9
iGDhXL5hdOrbrs7YqpjV0S9Gu5gElJ0vYiJGireDvQHHRkSy1kX6JCH1tNhfTeIyu1Dp
cRS8s7nbF0Phe64D/CfH/IfopY17EmzY2VKjUVjBuW0QAs198R0RK6iFpx1Ru6o62ThB
dQIQ==
X-Gm-Message-State: AOJu0YxkAH4jSTyNgKo8Y3kp5CeQXLza+qOY4uWsZ3TXu2tlBBykA7zc
kYhWNVOq1VYzLDMQMHb4uDWqSEiGnJvFOjAMUkHwnNQTN+RDd9u7XBapCT+J3rVlFg+luNmhGKw
=
X-Google-Smtp-Source: AGHT+IEJ3fD7J2mPtVUdlKTxNNiHN3qSfEroVt3ja5h+8+pgaenU/zoWNkvSU8y4gAm3v7IU1swsF8d5yg==
MIME-Version: 1.0
X-Received: by 2002:a05:690c:399:b0:610:cd34:439e with SMTP id
bh25-20020a05690c039900b00610cd34439emr587605ywb.49.1714678759219; Thu, 02
May 2024 12:39:19 -0700 (PDT)
Message-ID:
Date: Thu, 02 May 2024 19:39:19 +0000
Subject: netknowyeg,Increase 5K IG Followers here
From: gerrimauuala@gmail.com
To: sales@nk.ca
Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes
Content-Transfer-Encoding: base64
X-Spam_score: 10.2
X-Spam_score_int: 102
X-Spam_bar: ++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Hi , Netknow Internet Service Get 100K Followers Instagram
NOW ! Please visit the web page below . [ https://linktr.ee/instamediamax?netknowyeg
]
Content analysis details: (10.2 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[209.85.128.197 listed in dnsbl.ahbl.org]
[209.85.128.197 listed in dnsbl.ahbl.org]
[209.85.128.197 listed in dnsbl.ahbl.org]
[209.85.128.197 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[209.85.128.197 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[209.85.128.197 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[209.85.128.197 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[209.85.128.197 listed in dnsbl.ahbl.org]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[209.85.128.197 listed in will-spam-for-food.eu.org]
[209.85.128.197 listed in will-spam-for-food.eu.org]
[209.85.128.197 listed in will-spam-for-food.eu.org]
[209.85.128.197 listed in will-spam-for-food.eu.org]
[209.85.128.197 listed in will-spam-for-food.eu.org]
[209.85.128.197 listed in will-spam-for-food.eu.org]
[209.85.128.197 listed in will-spam-for-food.eu.org]
[209.85.128.197 listed in will-spam-for-food.eu.org]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
1.3 RCVD_IN_VALIDITY_RPBL RBL: Relay in Validity RPBL,
https://senderscore.org/blocklistlookup/
[209.85.128.197 listed in bl.score.senderscore.com]
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[209.85.128.197 listed in bl.score.senderscore.com]
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.128.197 listed in wl.mailspike.net]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[gerrimauuala(at)gmail.com]
2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars
1.0 FREEMAIL_REPLY From and body contain different freemails
Subject: {SPAM?} netknowyeg,Increase 5K IG Followers here
X-Antivirus: AVG (VPS 240502-4, 5/2/2024), Inbound message
X-Antivirus-Status: Clean
SGkgLA0KTmV0a25vdyBJbnRlcm5ldCBTZXJ2aWNlDQoNCg0KR2V0IDEwMEsgRm9sbG93ZXJzIElu
c3RhZ3JhbSBOT1cgIQ0KUGxlYXNlIHZpc2l0IHRoZSB3ZWIgcGFnZSBiZWxvdyAuDQoNClsgaHR0
cHM6Ly9saW5rdHIuZWUvaW5zdGFtZWRpYW1heD9uZXRrbm93eWVnIF0NCg0KRG8geW91IGhhdmUg
YWJvdXQgWyA5NTIgXSBGb2xsb3dlcnMgPw0KU3BlY2lhbHMgIGxpbWl0ZWQgIE9mZiA0MCUgVG9k
YXkuLi4hISENCkluY3JlYXNlIE5vdyAuLiEhIQ0KDQotIGluc3RhbnQgcHJvY2Vzcw0KLSBTYWZl
c3QgTWV0aG9kcw0KLSBQcml2YWN5IFByb3RlY3Rpb24NCi0gU3BlZWQgMTAwSyBGb2xsb3dlcnMv
ZGF5DQotIEhpZ2ggUXVhbGl0eSBGb2xsb3dlcnMgJiBSZWFsDQotIERyb3AtQmFjayBHdWFyYW50
ZWUNCi0gVHJ1c3RlZCBTZWxsZXIgdGVzdGltb255DQotIFN0YXJ0aW5nIGdldCA1SyBGb2xsb3dl
cnMgSW5zdGFncmFtDQotIEd1YXJhbnRlZWQgdG8gYmUgdGhlIGNoZWFwZXN0DQoNClRoYW5rIHlv
dSwNClJlZ2FyZHMsDQpzb2NpYWxpbnN0YW1heEBnbWFpbC5jb20NCg0KQ29weXJpZ2h0IMKpIDIw
MTQgLSAyMDI1IEluc3RhbWVkaWFNQVguIEFsbCBSaWdodHMgUmVzZXJ2ZWQuDQo=
Envelope-to: sales@nk.ca
Delivery-date: Thu, 02 May 2024 13:42:00 -0600
Received: from mail-yw1-f197.google.com ([209.85.128.197]:56644)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.97.1 (FreeBSD))
(envelope-from
id 1s2cIx-00000000Ouw-2HfD
for sales@nk.ca;
Thu, 02 May 2024 13:41:23 -0600
Received: by mail-yw1-f197.google.com with SMTP id 00721157ae682-61df903af62so54137237b3.1
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20230601; t=1714678759; x=1715283559; darn=nk.ca;
h=content-transfer-encoding:to:from:subject:date:message-id
:mime-version:from:to:cc:subject:date:message-id:reply-to;
bh=SY+1I/qjfezyBwFATEahr4j/V/f3t/LiUx/L9JjdTcw=;
b=S5BBbIc3GTL0hKTxl/B7sZ7Ejk+7a1qsXDXjtuOJ14BbQPFUIyuPIJsBpJRFLRVn4Z
AAgjegMkdE3vmmjZRHXAzsWBEb/27WRihZUif1hdCmiSL0ixw8VVCYrI9qG8VmDmJ/ZQ
yxv9na7eNdgMATr7UWR+9+2+qxEzHfZJpl+vF4vhKCP0m6dJ5ACU/vAQSm5bCM9pcHOQ
3kEMMxzK/fO1zqUgVXt6Rm3tEmkSbUBzuKBSOMoMr7NelW1Ted9swN25bD9/7dc88rlI
To7rNCWPWwAwfk661ULAsrIk+PZt4wU0TDce0Kruk2/aX5JFMjA53an18JNae+vtVh3s
brjQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20230601; t=1714678759; x=1715283559;
h=content-transfer-encoding:to:from:subject:date:message-id
:mime-version:x-gm-message-state:from:to:cc:subject:date:message-id
:reply-to;
bh=SY+1I/qjfezyBwFATEahr4j/V/f3t/LiUx/L9JjdTcw=;
b=fosL6aMPR8RnIv6i8muBU5C8MqKdnrxxbEx1HG3lKmFa1ygF3m1jb6GD5B2aYdlMcw
YeFiyQaPEjWJ4deuAjkXDGFUe+BNcooNwL6/rqh0ZwGLrUDByzQR8bLg/IsHVq9ZdxHC
bF4OTbqdPtUFDH5+S6fZHHfK4vq7wmgHAgfwLHgV9zw7ngVjQh5riFU0rI7U+BL2SIC9
iGDhXL5hdOrbrs7YqpjV0S9Gu5gElJ0vYiJGireDvQHHRkSy1kX6JCH1tNhfTeIyu1Dp
cRS8s7nbF0Phe64D/CfH/IfopY17EmzY2VKjUVjBuW0QAs198R0RK6iFpx1Ru6o62ThB
dQIQ==
X-Gm-Message-State: AOJu0YxkAH4jSTyNgKo8Y3kp5CeQXLza+qOY4uWsZ3TXu2tlBBykA7zc
kYhWNVOq1VYzLDMQMHb4uDWqSEiGnJvFOjAMUkHwnNQTN+RDd9u7XBapCT+J3rVlFg+luNmhGKw
=
X-Google-Smtp-Source: AGHT+IEJ3fD7J2mPtVUdlKTxNNiHN3qSfEroVt3ja5h+8+pgaenU/zoWNkvSU8y4gAm3v7IU1swsF8d5yg==
MIME-Version: 1.0
X-Received: by 2002:a05:690c:399:b0:610:cd34:439e with SMTP id
bh25-20020a05690c039900b00610cd34439emr587605ywb.49.1714678759219; Thu, 02
May 2024 12:39:19 -0700 (PDT)
Message-ID:
Date: Thu, 02 May 2024 19:39:19 +0000
Subject: netknowyeg,Increase 5K IG Followers here
From: gerrimauuala@gmail.com
To: sales@nk.ca
Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes
Content-Transfer-Encoding: base64
X-Spam_score: 10.2
X-Spam_score_int: 102
X-Spam_bar: ++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Hi , Netknow Internet Service Get 100K Followers Instagram
NOW ! Please visit the web page below . [ https://linktr.ee/instamediamax?netknowyeg
]
Content analysis details: (10.2 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[209.85.128.197 listed in dnsbl.ahbl.org]
[209.85.128.197 listed in dnsbl.ahbl.org]
[209.85.128.197 listed in dnsbl.ahbl.org]
[209.85.128.197 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[209.85.128.197 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[209.85.128.197 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[209.85.128.197 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[209.85.128.197 listed in dnsbl.ahbl.org]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[209.85.128.197 listed in will-spam-for-food.eu.org]
[209.85.128.197 listed in will-spam-for-food.eu.org]
[209.85.128.197 listed in will-spam-for-food.eu.org]
[209.85.128.197 listed in will-spam-for-food.eu.org]
[209.85.128.197 listed in will-spam-for-food.eu.org]
[209.85.128.197 listed in will-spam-for-food.eu.org]
[209.85.128.197 listed in will-spam-for-food.eu.org]
[209.85.128.197 listed in will-spam-for-food.eu.org]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
1.3 RCVD_IN_VALIDITY_RPBL RBL: Relay in Validity RPBL,
https://senderscore.org/blocklistlookup/
[209.85.128.197 listed in bl.score.senderscore.com]
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[209.85.128.197 listed in bl.score.senderscore.com]
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.128.197 listed in wl.mailspike.net]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[gerrimauuala(at)gmail.com]
2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars
1.0 FREEMAIL_REPLY From and body contain different freemails
Subject: {SPAM?} netknowyeg,Increase 5K IG Followers here
X-Antivirus: AVG (VPS 240502-4, 5/2/2024), Inbound message
X-Antivirus-Status: Clean
SGkgLA0KTmV0a25vdyBJbnRlcm5ldCBTZXJ2aWNlDQoNCg0KR2V0IDEwMEsgRm9sbG93ZXJzIElu
c3RhZ3JhbSBOT1cgIQ0KUGxlYXNlIHZpc2l0IHRoZSB3ZWIgcGFnZSBiZWxvdyAuDQoNClsgaHR0
cHM6Ly9saW5rdHIuZWUvaW5zdGFtZWRpYW1heD9uZXRrbm93eWVnIF0NCg0KRG8geW91IGhhdmUg
YWJvdXQgWyA5NTIgXSBGb2xsb3dlcnMgPw0KU3BlY2lhbHMgIGxpbWl0ZWQgIE9mZiA0MCUgVG9k
YXkuLi4hISENCkluY3JlYXNlIE5vdyAuLiEhIQ0KDQotIGluc3RhbnQgcHJvY2Vzcw0KLSBTYWZl
c3QgTWV0aG9kcw0KLSBQcml2YWN5IFByb3RlY3Rpb24NCi0gU3BlZWQgMTAwSyBGb2xsb3dlcnMv
ZGF5DQotIEhpZ2ggUXVhbGl0eSBGb2xsb3dlcnMgJiBSZWFsDQotIERyb3AtQmFjayBHdWFyYW50
ZWUNCi0gVHJ1c3RlZCBTZWxsZXIgdGVzdGltb255DQotIFN0YXJ0aW5nIGdldCA1SyBGb2xsb3dl
cnMgSW5zdGFncmFtDQotIEd1YXJhbnRlZWQgdG8gYmUgdGhlIGNoZWFwZXN0DQoNClRoYW5rIHlv
dSwNClJlZ2FyZHMsDQpzb2NpYWxpbnN0YW1heEBnbWFpbC5jb20NCg0KQ29weXJpZ2h0IMKpIDIw
MTQgLSAyMDI1IEluc3RhbWVkaWFNQVguIEFsbCBSaWdodHMgUmVzZXJ2ZWQuDQo=