link spam from Gmail
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Mon, 23 Jan 2023 08:19:52 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)
(envelope-from)
id 1pJybo-000OLX-1W
for dave@doctor.nl2k.ab.ca;
Mon, 23 Jan 2023 08:19:44 -0700
Resent-From: The Doctor
Resent-Date: Mon, 23 Jan 2023 08:19:44 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-ej1-f52.google.com ([209.85.218.52]:36765)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.96)
(envelope-from)
id 1pJq9C-000Dvn-0L
for root@doctor.nl2k.ab.ca;
Sun, 22 Jan 2023 23:17:45 -0700
Received: by mail-ej1-f52.google.com with SMTP id kt14so27782391ejc.3
for; Sun, 22 Jan 2023 22:15:09 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20210112;
h=to:subject:message-id:date:from:mime-version:from:to:cc:subject
:date:message-id:reply-to;
bh=yk/FZHO5LzrzgDQVICO7gqobL/9CjbZxAQab4RSI1D4=;
b=Kf3oFXuUsUi2pzN/yMluzB1ly/JC3DnjZJkipQGLm8nOPR8r7lyTlo+KSNMA0dHvOz
/nHQzPk5NE9oryh7gaaFlgNpkYpCrek0uxNHo4joW8dqidtQxQOFP+FlFSOhW40goVkl
/p9/vG7NFnv5krRKminGhyp3ekYFdqyzVSFyGtbHqcJ5OaRMsCDpBFOIZ0hKGJvpbrO8
t0Y84iGypQlwe2y85DSKIsIunQUDhA/U/Cq00LnpDEC10Xd3YNu2Zh5kA++8qUcmhoK2
mjIhilI+QyWtbTXTKBobQN8EjM8bVfA1aZr4Mez0l9WEMBpz+oXjMLmABbEkx5dwdsRL
9ObQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20210112;
h=to:subject:message-id:date:from:mime-version:x-gm-message-state
:from:to:cc:subject:date:message-id:reply-to;
bh=yk/FZHO5LzrzgDQVICO7gqobL/9CjbZxAQab4RSI1D4=;
b=VEz1G3lM+f0FRqWHQ90bP6jshrQfogTUty9r9dfe11I4tP9Gtgc6sf55mOgodCo/Ci
gR0aGlxxy/5XTyjx9J8VjWgWlGAK4a54/At/l52FF/31T2o3hJYaF5QDPK+4WsJWsfwE
nFymnq5/MshRBjlY6uzFdrMrKYmyTGfqJdY4juyLtuBcwlRD4s030bcGxHLpFe9Vc0cU
nQHXq8IDRScdmw3aVu2Th00ya+keQ2c+w/qaeYHeivSbM11C0+0D3qTIpk1qPPqSnTd1
Xl36yso9o+TxhJozy4mhsAQ3wzEPPe/Q8Sj2tDwPTQdogyY5QU972Rm+Ny16JLEneKFm
nW2Q==
X-Gm-Message-State: AFqh2kqCK9U261DSMbmBzljHS+qFl6oIIgsFZzGQA6ZOGNOiJKaTdS1v
pG8+kx0qsyXb9El2tOcDzKbcDJKlsgjwQkvFFxw=
X-Google-Smtp-Source: AMrXdXtTE3/1o7hZT/pceM6x7CBr8EOXoNmUy+u56s760FMzQrunr3XFxfODilTTQJJ/of2Tj0zjrvL1SZvaRqeCrX4=
X-Received: by 2002:a17:907:8b88:b0:872:dae4:1ef7 with SMTP id
tb8-20020a1709078b8800b00872dae41ef7mr1978744ejc.84.1674454503650; Sun, 22
Jan 2023 22:15:03 -0800 (PST)
MIME-Version: 1.0
From: "evs_idea@yahoo.com"
Date: Mon, 23 Jan 2023 06:17:56 +0000
Message-ID:
Subject:
To: nlangmuir,
patrickhenault1,
pierre tremblay, romtrade mtl ,
root
Content-Type: multipart/alternative; boundary="000000000000e1fd8a05f2e85197"
X-Spam_score: 6.4
X-Spam_score_int: 64
X-Spam_bar: ++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: https://xwqp7.app.link/KhsJHgoPNwb https://xwqp7.app.link/KhsJHgoPNwb
Content analysis details: (6.4 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.218.52 listed in list.dnswl.org]
-0.0 SPF_PASS SPF: sender matches SPF record
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[atitiwatpati(at)gmail.com]
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.4 NAME_EMAIL_DIFF Sender NAME is an unrelated email address
0.0 TVD_SPACE_RATIO No description available.
0.8 FROM_2_EMAILS_SHORT Short body and From looks like 2 different emails
0.7 PDS_FROM_2_EMAILS From header has multiple different addresses
-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)
[209.85.218.52 listed in wl.mailspike.net]
-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders
1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%
[cf: 100]
2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level
above 50%
[cf: 100]
Subject: {SPAM?}
--000000000000e1fd8a05f2e85197
Content-Type: text/plain; charset="UTF-8"
https://xwqp7.app.link/KhsJHgoPNwb
--000000000000e1fd8a05f2e85197
Content-Type: text/html; charset="UTF-8"
https://xwqp7.app.link/KhsJHgoPNwb
--000000000000e1fd8a05f2e85197--
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Mon, 23 Jan 2023 08:19:52 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)
(envelope-from
id 1pJybo-000OLX-1W
for dave@doctor.nl2k.ab.ca;
Mon, 23 Jan 2023 08:19:44 -0700
Resent-From: The Doctor
Resent-Date: Mon, 23 Jan 2023 08:19:44 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-ej1-f52.google.com ([209.85.218.52]:36765)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.96)
(envelope-from
id 1pJq9C-000Dvn-0L
for root@doctor.nl2k.ab.ca;
Sun, 22 Jan 2023 23:17:45 -0700
Received: by mail-ej1-f52.google.com with SMTP id kt14so27782391ejc.3
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20210112;
h=to:subject:message-id:date:from:mime-version:from:to:cc:subject
:date:message-id:reply-to;
bh=yk/FZHO5LzrzgDQVICO7gqobL/9CjbZxAQab4RSI1D4=;
b=Kf3oFXuUsUi2pzN/yMluzB1ly/JC3DnjZJkipQGLm8nOPR8r7lyTlo+KSNMA0dHvOz
/nHQzPk5NE9oryh7gaaFlgNpkYpCrek0uxNHo4joW8dqidtQxQOFP+FlFSOhW40goVkl
/p9/vG7NFnv5krRKminGhyp3ekYFdqyzVSFyGtbHqcJ5OaRMsCDpBFOIZ0hKGJvpbrO8
t0Y84iGypQlwe2y85DSKIsIunQUDhA/U/Cq00LnpDEC10Xd3YNu2Zh5kA++8qUcmhoK2
mjIhilI+QyWtbTXTKBobQN8EjM8bVfA1aZr4Mez0l9WEMBpz+oXjMLmABbEkx5dwdsRL
9ObQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20210112;
h=to:subject:message-id:date:from:mime-version:x-gm-message-state
:from:to:cc:subject:date:message-id:reply-to;
bh=yk/FZHO5LzrzgDQVICO7gqobL/9CjbZxAQab4RSI1D4=;
b=VEz1G3lM+f0FRqWHQ90bP6jshrQfogTUty9r9dfe11I4tP9Gtgc6sf55mOgodCo/Ci
gR0aGlxxy/5XTyjx9J8VjWgWlGAK4a54/At/l52FF/31T2o3hJYaF5QDPK+4WsJWsfwE
nFymnq5/MshRBjlY6uzFdrMrKYmyTGfqJdY4juyLtuBcwlRD4s030bcGxHLpFe9Vc0cU
nQHXq8IDRScdmw3aVu2Th00ya+keQ2c+w/qaeYHeivSbM11C0+0D3qTIpk1qPPqSnTd1
Xl36yso9o+TxhJozy4mhsAQ3wzEPPe/Q8Sj2tDwPTQdogyY5QU972Rm+Ny16JLEneKFm
nW2Q==
X-Gm-Message-State: AFqh2kqCK9U261DSMbmBzljHS+qFl6oIIgsFZzGQA6ZOGNOiJKaTdS1v
pG8+kx0qsyXb9El2tOcDzKbcDJKlsgjwQkvFFxw=
X-Google-Smtp-Source: AMrXdXtTE3/1o7hZT/pceM6x7CBr8EOXoNmUy+u56s760FMzQrunr3XFxfODilTTQJJ/of2Tj0zjrvL1SZvaRqeCrX4=
X-Received: by 2002:a17:907:8b88:b0:872:dae4:1ef7 with SMTP id
tb8-20020a1709078b8800b00872dae41ef7mr1978744ejc.84.1674454503650; Sun, 22
Jan 2023 22:15:03 -0800 (PST)
MIME-Version: 1.0
From: "evs_idea@yahoo.com"
Date: Mon, 23 Jan 2023 06:17:56 +0000
Message-ID:
Subject:
To: nlangmuir
patrickhenault1
pierre tremblay
root
Content-Type: multipart/alternative; boundary="000000000000e1fd8a05f2e85197"
X-Spam_score: 6.4
X-Spam_score_int: 64
X-Spam_bar: ++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: https://xwqp7.app.link/KhsJHgoPNwb https://xwqp7.app.link/KhsJHgoPNwb
Content analysis details: (6.4 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.218.52 listed in list.dnswl.org]
-0.0 SPF_PASS SPF: sender matches SPF record
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[atitiwatpati(at)gmail.com]
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.4 NAME_EMAIL_DIFF Sender NAME is an unrelated email address
0.0 TVD_SPACE_RATIO No description available.
0.8 FROM_2_EMAILS_SHORT Short body and From looks like 2 different emails
0.7 PDS_FROM_2_EMAILS From header has multiple different addresses
-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)
[209.85.218.52 listed in wl.mailspike.net]
-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders
1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%
[cf: 100]
2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level
above 50%
[cf: 100]
Subject: {SPAM?}
--000000000000e1fd8a05f2e85197
Content-Type: text/plain; charset="UTF-8"
https://xwqp7.app.link/KhsJHgoPNwb
--000000000000e1fd8a05f2e85197
Content-Type: text/html; charset="UTF-8"
https://xwqp7.app.link/KhsJHgoPNwb
--000000000000e1fd8a05f2e85197--
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments