Instagram followers spam from Google Gmail
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Sat, 14 Sep 2024 14:16:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))
(envelope-from)
id 1spZAj-00000000Nbd-2b98
for dave@doctor.nl2k.ab.ca;
Sat, 14 Sep 2024 14:15:09 -0600
Resent-From: The Doctor
Resent-Date: Sat, 14 Sep 2024 14:15:09 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-yb1-f197.google.com ([209.85.219.197]:47450)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.98 (FreeBSD))
(envelope-from)
id 1spYUO-00000000CcM-2hTK
for sales@nk.ca;
Sat, 14 Sep 2024 13:31:32 -0600
Received: by mail-yb1-f197.google.com with SMTP id 3f1490d57ef6-e1dc21ca19aso2498902276.3
for; Sat, 14 Sep 2024 12:29:34 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20230601; t=1726342168; x=1726946968; darn=nk.ca;
h=content-transfer-encoding:to:from:subject:date:message-id
:mime-version:from:to:cc:subject:date:message-id:reply-to;
bh=uSthD3h3MZkI37TDfZWIgydsnQgtxLkZEg0G1+dXNdA=;
b=ZIbRdwNGs4Ov56z3vL1jJr2IxENkmDlnYffbOazlZe9gPXVW/Hlq5AjT/lS6RThA4v
gJoOAfJcLD8k+lF921KNYWmhsELoAQ7xUIqRDX2njAnF+OacRSFW6g0Rc5wDjaXA6b36
PRPyaWBRFQGw+qoACvbPx5dsMbnKTtVnIPDgjurMJv7YL22U6qYSaTI5TyzY+3HuGZP1
Ao5Jj1BEnx37tJSavFKLS0tGdkBC7iApuNlB4WxiAcL2lPRRpNhV7IEsUA3ByqCnVx0y
fIdpAmM8DUlWloisRXq58b1q6qqpweYePbrvJuIz32KPAarHERHt2ZTIgAtbbITuN+yp
KgQA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20230601; t=1726342168; x=1726946968;
h=content-transfer-encoding:to:from:subject:date:message-id
:mime-version:x-gm-message-state:from:to:cc:subject:date:message-id
:reply-to;
bh=uSthD3h3MZkI37TDfZWIgydsnQgtxLkZEg0G1+dXNdA=;
b=Cer7Q0AUFGuwBqm4Vr3L37WuRdRpNw1ZLLoYoo/zgkXqkuoZUA6oPhHQRvW53YW4q3
6HRaROdJKaXdaiwhCOHTO1YdG/JfqNQhgr1uEgoFNAuWiCR6o+VtJ2R4CSPTPpvprIZ9
LXJVUCovSx9HmWqnHumJfHvYtZYU1ZUJgzp6VfoV0WMrez0pP4x9akr/np31kHvwmMvs
XOrtqutJTk7I6OwErl7seV9cRhK7BsVOogjG4JEr695vS1BTbof0vrRchyiJhwqIiLvN
Mth6XZu3EKlUFKvfjGeiTNN+RQ/+EYKR4LBt5IYJjio8d5zfKGW/EcEONIum2Fy32+T1
joKQ==
X-Gm-Message-State: AOJu0YzW3R4fSmgCgqYo3VuFuQm2EN7XKwqBTQjpOiEIXRiPIxcNs7gt
g3+ONDU80NbqBf4BQ+CcG/oWMg15wHtIm5Wjr7zi4WdYHWDvePE8Vi5R5hN6GBCjw/a8FkO0fpQ
=
X-Google-Smtp-Source: AGHT+IFDPX3f27PlQjnWLRNrWL8tK5KQUxrzDaYtMnd/Dgxc6f5QsmAdvsbOY0rQzEWB1Pjk+e7bgXGl1A==
MIME-Version: 1.0
X-Received: by 2002:a05:6902:1b8d:b0:e1d:3a7f:2f85 with SMTP id
3f1490d57ef6-e1d9dbbe04fmr8724713276.24.1726342168484; Sat, 14 Sep 2024
12:29:28 -0700 (PDT)
Message-ID:
Date: Sat, 14 Sep 2024 19:29:28 +0000
Subject: daveyadallee, THE BEST SELLER
From: nkkbjj2@gmail.com
To: sales@nk.ca
Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes
Content-Transfer-Encoding: base64
X-Spam_score: 13.5
X-Spam_score_int: 135
X-Spam_bar: +++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Hello , daveyadallee GET 50K Followers Instagram NOW !!! Order
here : [ https://instamedia.shop/store???daveyadallee ]
Content analysis details: (13.5 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[209.85.219.197 listed in will-spam-for-food.eu.org]
[209.85.219.197 listed in will-spam-for-food.eu.org]
[209.85.219.197 listed in will-spam-for-food.eu.org]
[209.85.219.197 listed in will-spam-for-food.eu.org]
[209.85.219.197 listed in will-spam-for-food.eu.org]
[209.85.219.197 listed in will-spam-for-food.eu.org]
[209.85.219.197 listed in will-spam-for-food.eu.org]
[209.85.219.197 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[209.85.219.197 listed in dnsbl.ahbl.org]
[209.85.219.197 listed in dnsbl.ahbl.org]
[209.85.219.197 listed in dnsbl.ahbl.org]
[209.85.219.197 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[209.85.219.197 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[209.85.219.197 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[209.85.219.197 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[209.85.219.197 listed in dnsbl.ahbl.org]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.219.197 listed in list.dnswl.org]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
1.0 HK_RANDOM_FROM From username looks random
0.6 HK_RANDOM_ENVFROM Envelope sender username looks random
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.219.197 listed in wl.mailspike.net]
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[209.85.219.197 listed in bl.score.senderscore.com]
1.3 RCVD_IN_VALIDITY_RPBL RBL: Relay in Validity RPBL,
https://senderscore.org/blocklistlookup/
[209.85.219.197 listed in bl.score.senderscore.com]
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit
[nkkbjj2(at)gmail.com]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[nkkbjj2(at)gmail.com]
2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars
1.5 VOWEL_FROM_6 Impronouncable from header (6 consecutive vowels)
-0.0 T_SCC_BODY_TEXT_LINE No description available.
1.0 FREEMAIL_REPLY From and body contain different freemails
Subject: {SPAM?} daveyadallee, THE BEST SELLER
SGVsbG8gLA0KZGF2ZXlhZGFsbGVlDQoNCg0KR0VUIDUwSyBGb2xsb3dlcnMgSW5zdGFncmFtIE5P
VyAhISENCk9yZGVyIGhlcmUgOg0KDQpbIGh0dHBzOi8vaW5zdGFtZWRpYS5zaG9wL3N0b3JlPz8/
ZGF2ZXlhZGFsbGVlIF0NCg0KRG8geW91IGhhdmUgYWJvdXQgWyBMZXNzIHRoYW4gOTVLIF0gRm9s
bG93ZXJzID8NClNwZWNpYWxzICBsaW1pdGVkICBPZmYgNDAlIFRvZGF5Li4uIQ0KSW5jcmVhc2Ug
Tm93IC4uISEhDQoNCi0gSW5zdGFudCBTdGFydA0KLSBTYWZlc3QgTWV0aG9kcw0KLSBQcml2YWN5
IFByb3RlY3Rpb24NCi0gU3BlZWQgMjAwSyBGb2xsb3dlcnMvZGF5DQotIEhpZ2ggUXVhbGl0eSBG
b2xsb3dlcnMNCi0gRHJvcC1CYWNrIEd1YXJhbnRlZQ0KLSBUcnVzdGVkIFNlbGxlciB0ZXN0aW1v
bnkNCi0gU3RhcnRpbmcgZ2V0IDVLIEZvbGxvd2VycyBJbnN0YWdyYW0NCi0gR3VhcmFudGVlZCB0
byBiZSB0aGUgY2hlYXBlc3QNCg0KVGhhbmsgeW91LA0KUmVnYXJkcywNCnNvY2lhbGluc3RhbWF4
QGdtYWlsLmNvbQ0KDQpDb3B5cmlnaHQgwqkgMjAxNCAtIDIwMjUgSW5zdGFtZWRpYU1BWA0K
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Sat, 14 Sep 2024 14:16:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))
(envelope-from
id 1spZAj-00000000Nbd-2b98
for dave@doctor.nl2k.ab.ca;
Sat, 14 Sep 2024 14:15:09 -0600
Resent-From: The Doctor
Resent-Date: Sat, 14 Sep 2024 14:15:09 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-yb1-f197.google.com ([209.85.219.197]:47450)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.98 (FreeBSD))
(envelope-from
id 1spYUO-00000000CcM-2hTK
for sales@nk.ca;
Sat, 14 Sep 2024 13:31:32 -0600
Received: by mail-yb1-f197.google.com with SMTP id 3f1490d57ef6-e1dc21ca19aso2498902276.3
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20230601; t=1726342168; x=1726946968; darn=nk.ca;
h=content-transfer-encoding:to:from:subject:date:message-id
:mime-version:from:to:cc:subject:date:message-id:reply-to;
bh=uSthD3h3MZkI37TDfZWIgydsnQgtxLkZEg0G1+dXNdA=;
b=ZIbRdwNGs4Ov56z3vL1jJr2IxENkmDlnYffbOazlZe9gPXVW/Hlq5AjT/lS6RThA4v
gJoOAfJcLD8k+lF921KNYWmhsELoAQ7xUIqRDX2njAnF+OacRSFW6g0Rc5wDjaXA6b36
PRPyaWBRFQGw+qoACvbPx5dsMbnKTtVnIPDgjurMJv7YL22U6qYSaTI5TyzY+3HuGZP1
Ao5Jj1BEnx37tJSavFKLS0tGdkBC7iApuNlB4WxiAcL2lPRRpNhV7IEsUA3ByqCnVx0y
fIdpAmM8DUlWloisRXq58b1q6qqpweYePbrvJuIz32KPAarHERHt2ZTIgAtbbITuN+yp
KgQA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20230601; t=1726342168; x=1726946968;
h=content-transfer-encoding:to:from:subject:date:message-id
:mime-version:x-gm-message-state:from:to:cc:subject:date:message-id
:reply-to;
bh=uSthD3h3MZkI37TDfZWIgydsnQgtxLkZEg0G1+dXNdA=;
b=Cer7Q0AUFGuwBqm4Vr3L37WuRdRpNw1ZLLoYoo/zgkXqkuoZUA6oPhHQRvW53YW4q3
6HRaROdJKaXdaiwhCOHTO1YdG/JfqNQhgr1uEgoFNAuWiCR6o+VtJ2R4CSPTPpvprIZ9
LXJVUCovSx9HmWqnHumJfHvYtZYU1ZUJgzp6VfoV0WMrez0pP4x9akr/np31kHvwmMvs
XOrtqutJTk7I6OwErl7seV9cRhK7BsVOogjG4JEr695vS1BTbof0vrRchyiJhwqIiLvN
Mth6XZu3EKlUFKvfjGeiTNN+RQ/+EYKR4LBt5IYJjio8d5zfKGW/EcEONIum2Fy32+T1
joKQ==
X-Gm-Message-State: AOJu0YzW3R4fSmgCgqYo3VuFuQm2EN7XKwqBTQjpOiEIXRiPIxcNs7gt
g3+ONDU80NbqBf4BQ+CcG/oWMg15wHtIm5Wjr7zi4WdYHWDvePE8Vi5R5hN6GBCjw/a8FkO0fpQ
=
X-Google-Smtp-Source: AGHT+IFDPX3f27PlQjnWLRNrWL8tK5KQUxrzDaYtMnd/Dgxc6f5QsmAdvsbOY0rQzEWB1Pjk+e7bgXGl1A==
MIME-Version: 1.0
X-Received: by 2002:a05:6902:1b8d:b0:e1d:3a7f:2f85 with SMTP id
3f1490d57ef6-e1d9dbbe04fmr8724713276.24.1726342168484; Sat, 14 Sep 2024
12:29:28 -0700 (PDT)
Message-ID:
Date: Sat, 14 Sep 2024 19:29:28 +0000
Subject: daveyadallee, THE BEST SELLER
From: nkkbjj2@gmail.com
To: sales@nk.ca
Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes
Content-Transfer-Encoding: base64
X-Spam_score: 13.5
X-Spam_score_int: 135
X-Spam_bar: +++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Hello , daveyadallee GET 50K Followers Instagram NOW !!! Order
here : [ https://instamedia.shop/store???daveyadallee ]
Content analysis details: (13.5 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[209.85.219.197 listed in will-spam-for-food.eu.org]
[209.85.219.197 listed in will-spam-for-food.eu.org]
[209.85.219.197 listed in will-spam-for-food.eu.org]
[209.85.219.197 listed in will-spam-for-food.eu.org]
[209.85.219.197 listed in will-spam-for-food.eu.org]
[209.85.219.197 listed in will-spam-for-food.eu.org]
[209.85.219.197 listed in will-spam-for-food.eu.org]
[209.85.219.197 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[209.85.219.197 listed in dnsbl.ahbl.org]
[209.85.219.197 listed in dnsbl.ahbl.org]
[209.85.219.197 listed in dnsbl.ahbl.org]
[209.85.219.197 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[209.85.219.197 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[209.85.219.197 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[209.85.219.197 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[209.85.219.197 listed in dnsbl.ahbl.org]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.219.197 listed in list.dnswl.org]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
1.0 HK_RANDOM_FROM From username looks random
0.6 HK_RANDOM_ENVFROM Envelope sender username looks random
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.219.197 listed in wl.mailspike.net]
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[209.85.219.197 listed in bl.score.senderscore.com]
1.3 RCVD_IN_VALIDITY_RPBL RBL: Relay in Validity RPBL,
https://senderscore.org/blocklistlookup/
[209.85.219.197 listed in bl.score.senderscore.com]
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit
[nkkbjj2(at)gmail.com]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[nkkbjj2(at)gmail.com]
2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars
1.5 VOWEL_FROM_6 Impronouncable from header (6 consecutive vowels)
-0.0 T_SCC_BODY_TEXT_LINE No description available.
1.0 FREEMAIL_REPLY From and body contain different freemails
Subject: {SPAM?} daveyadallee, THE BEST SELLER
SGVsbG8gLA0KZGF2ZXlhZGFsbGVlDQoNCg0KR0VUIDUwSyBGb2xsb3dlcnMgSW5zdGFncmFtIE5P
VyAhISENCk9yZGVyIGhlcmUgOg0KDQpbIGh0dHBzOi8vaW5zdGFtZWRpYS5zaG9wL3N0b3JlPz8/
ZGF2ZXlhZGFsbGVlIF0NCg0KRG8geW91IGhhdmUgYWJvdXQgWyBMZXNzIHRoYW4gOTVLIF0gRm9s
bG93ZXJzID8NClNwZWNpYWxzICBsaW1pdGVkICBPZmYgNDAlIFRvZGF5Li4uIQ0KSW5jcmVhc2Ug
Tm93IC4uISEhDQoNCi0gSW5zdGFudCBTdGFydA0KLSBTYWZlc3QgTWV0aG9kcw0KLSBQcml2YWN5
IFByb3RlY3Rpb24NCi0gU3BlZWQgMjAwSyBGb2xsb3dlcnMvZGF5DQotIEhpZ2ggUXVhbGl0eSBG
b2xsb3dlcnMNCi0gRHJvcC1CYWNrIEd1YXJhbnRlZQ0KLSBUcnVzdGVkIFNlbGxlciB0ZXN0aW1v
bnkNCi0gU3RhcnRpbmcgZ2V0IDVLIEZvbGxvd2VycyBJbnN0YWdyYW0NCi0gR3VhcmFudGVlZCB0
byBiZSB0aGUgY2hlYXBlc3QNCg0KVGhhbmsgeW91LA0KUmVnYXJkcywNCnNvY2lhbGluc3RhbWF4
QGdtYWlsLmNvbQ0KDQpDb3B5cmlnaHQgwqkgMjAxNCAtIDIwMjUgSW5zdGFtZWRpYU1BWA0K