More link spam from Gmail
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Thu, 11 May 2023 13:08:07 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))
(envelope-from)
id 1pxBdM-0009Pm-Ac
for dave@doctor.nl2k.ab.ca;
Thu, 11 May 2023 13:07:24 -0600
Resent-From: The Doctor
Resent-Date: Thu, 11 May 2023 13:07:24 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-vk1-f176.google.com ([209.85.221.176]:40334)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.95 (FreeBSD))
(envelope-from)
id 1px9qg-0009zD-63
for doctor@doctor.nl2k.ab.ca;
Thu, 11 May 2023 11:13:05 -0600
Received: by mail-vk1-f176.google.com with SMTP id 71dfb90a1353d-44f8d1b1776so633614e0c.1
for; Thu, 11 May 2023 10:11:03 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20221208; t=1683825057; x=1686417057;
h=to:subject:message-id:date:from:mime-version:from:to:cc:subject
:date:message-id:reply-to;
bh=fmlym0r5Ljl0AffsDr4nBkMZNU12/rTMJ7CxVRVALG8=;
b=hAJAnMtrVGbP2URcDoIt0ppXrDF+VI2K6ZVQBrcWprCHB0p7To29UNqapKzHtQd29H
B5Fd8V72Jyp9p3slahdEXyZqUG3snsyGYEjR3FabxqLBvvz8PvaenMr91OQATcZB97Bn
ayGg+XtkP36gELv0M/7mel66oxGbcgStTvIW8gbSH4AILxcQlooOTaNSSSmkppQnBr2p
L/imO/tt+cFIDsatN8Ot61TmPrB+M/X2co2aLM5v+31nVl8FD6E/9JpK26oETmpCKpa8
ryhiAhN5vY6NZqRLO6KWMUb2HljT9O6h6RkSx5fP5N/tMuGVA5K4SyLJdhGtCxDMSoEO
SaeA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20221208; t=1683825057; x=1686417057;
h=to:subject:message-id:date:from:mime-version:x-gm-message-state
:from:to:cc:subject:date:message-id:reply-to;
bh=fmlym0r5Ljl0AffsDr4nBkMZNU12/rTMJ7CxVRVALG8=;
b=irf6oE4lMb8cccKE+ZgolzL0dExi6eFdodRPam/6+GKiqDP5qGRcO9PQ2fYZaCahy6
AB6OC1ajuSrCHewGhShr8+HlucEaL2rUOLrvqq5ph5mzSB1ZxZiUSU6Zd8ihuHkyeqF6
vKEPkOp6itFqWSUzAFUxjeYy8lmYytoZFK0KxaVULPdlk0V/3UvmVg4gJA4sJDVDboVP
mCs55ZpT8tnzDbRUP1N0Ve6mMQsQY/p+3tXM3le3nPWKuBXq+a50YPusrk0PJOyS0Leq
PNZZk8eepFR2QUjuu2w2LBRo5tQVE6u59dC2+EMA4kXn2yap6+k+UX9DyQBi+MsvDrxS
HboA==
X-Gm-Message-State: AC+VfDzHLM6THelVpmh8ewKhnXYfNzTi7UeX5aOJtxDGL3KTMUuCv6tm
sfUNVg+jnDOp3SjXjZ5/QPdHPskskT8EX0PuTeg=
X-Google-Smtp-Source: ACHHUZ4ZR6pV0YrcHL+vlxMF336TcO7Dc87QybU1+A+ezh8wmtSJxAPwlrXNmcKg+TV7CrYmdukAjxHJqSUfl0tmsoo=
X-Received: by 2002:a05:6102:3d0d:b0:436:2ef4:5e2 with SMTP id
i13-20020a0561023d0d00b004362ef405e2mr1153303vsv.2.1683825057614; Thu, 11 May
2023 10:10:57 -0700 (PDT)
MIME-Version: 1.0
Received: by 2002:a59:9943:0:b0:3c4:4be5:46a4 with HTTP; Thu, 11 May 2023
10:10:57 -0700 (PDT)
From: "stremler.jeannine@orange.fr"
Date: Thu, 11 May 2023 17:10:57 +0000
Message-ID:
Subject: LOAN OFFER @2% INTEREST RATE
To: ctetley, c degagne ,
doctor, elizabethp
Content-Type: text/plain; charset="UTF-8"
X-Spam_score: 7.7
X-Spam_score_int: 77
X-Spam_bar: +++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: https://bit.ly/3B28Rt2
Content analysis details: (7.7 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.221.176 listed in list.dnswl.org]
-0.0 SPF_PASS SPF: sender matches SPF record
1.6 SUBJ_ALL_CAPS Subject is all capitals
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[kibru246(at)gmail.com]
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit
[kibru246(at)gmail.com]
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.221.176 listed in wl.mailspike.net]
0.4 NAME_EMAIL_DIFF Sender NAME is an unrelated email address
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
2.8 POSSIBLE_GMAIL_PHISHER Apparent phishing email sent from a gmail
account
0.7 PDS_FROM_2_EMAILS No description available.
1.0 FROM_2_EMAILS_SHORT Short body and From looks like 2 different emails
1.2 BODY_SINGLE_URI Message body is only a URI
Subject: {SPAM?} LOAN OFFER @2% INTEREST RATE
https://bit.ly/3B28Rt2
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Thu, 11 May 2023 13:08:07 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))
(envelope-from
id 1pxBdM-0009Pm-Ac
for dave@doctor.nl2k.ab.ca;
Thu, 11 May 2023 13:07:24 -0600
Resent-From: The Doctor
Resent-Date: Thu, 11 May 2023 13:07:24 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-vk1-f176.google.com ([209.85.221.176]:40334)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.95 (FreeBSD))
(envelope-from
id 1px9qg-0009zD-63
for doctor@doctor.nl2k.ab.ca;
Thu, 11 May 2023 11:13:05 -0600
Received: by mail-vk1-f176.google.com with SMTP id 71dfb90a1353d-44f8d1b1776so633614e0c.1
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20221208; t=1683825057; x=1686417057;
h=to:subject:message-id:date:from:mime-version:from:to:cc:subject
:date:message-id:reply-to;
bh=fmlym0r5Ljl0AffsDr4nBkMZNU12/rTMJ7CxVRVALG8=;
b=hAJAnMtrVGbP2URcDoIt0ppXrDF+VI2K6ZVQBrcWprCHB0p7To29UNqapKzHtQd29H
B5Fd8V72Jyp9p3slahdEXyZqUG3snsyGYEjR3FabxqLBvvz8PvaenMr91OQATcZB97Bn
ayGg+XtkP36gELv0M/7mel66oxGbcgStTvIW8gbSH4AILxcQlooOTaNSSSmkppQnBr2p
L/imO/tt+cFIDsatN8Ot61TmPrB+M/X2co2aLM5v+31nVl8FD6E/9JpK26oETmpCKpa8
ryhiAhN5vY6NZqRLO6KWMUb2HljT9O6h6RkSx5fP5N/tMuGVA5K4SyLJdhGtCxDMSoEO
SaeA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20221208; t=1683825057; x=1686417057;
h=to:subject:message-id:date:from:mime-version:x-gm-message-state
:from:to:cc:subject:date:message-id:reply-to;
bh=fmlym0r5Ljl0AffsDr4nBkMZNU12/rTMJ7CxVRVALG8=;
b=irf6oE4lMb8cccKE+ZgolzL0dExi6eFdodRPam/6+GKiqDP5qGRcO9PQ2fYZaCahy6
AB6OC1ajuSrCHewGhShr8+HlucEaL2rUOLrvqq5ph5mzSB1ZxZiUSU6Zd8ihuHkyeqF6
vKEPkOp6itFqWSUzAFUxjeYy8lmYytoZFK0KxaVULPdlk0V/3UvmVg4gJA4sJDVDboVP
mCs55ZpT8tnzDbRUP1N0Ve6mMQsQY/p+3tXM3le3nPWKuBXq+a50YPusrk0PJOyS0Leq
PNZZk8eepFR2QUjuu2w2LBRo5tQVE6u59dC2+EMA4kXn2yap6+k+UX9DyQBi+MsvDrxS
HboA==
X-Gm-Message-State: AC+VfDzHLM6THelVpmh8ewKhnXYfNzTi7UeX5aOJtxDGL3KTMUuCv6tm
sfUNVg+jnDOp3SjXjZ5/QPdHPskskT8EX0PuTeg=
X-Google-Smtp-Source: ACHHUZ4ZR6pV0YrcHL+vlxMF336TcO7Dc87QybU1+A+ezh8wmtSJxAPwlrXNmcKg+TV7CrYmdukAjxHJqSUfl0tmsoo=
X-Received: by 2002:a05:6102:3d0d:b0:436:2ef4:5e2 with SMTP id
i13-20020a0561023d0d00b004362ef405e2mr1153303vsv.2.1683825057614; Thu, 11 May
2023 10:10:57 -0700 (PDT)
MIME-Version: 1.0
Received: by 2002:a59:9943:0:b0:3c4:4be5:46a4 with HTTP; Thu, 11 May 2023
10:10:57 -0700 (PDT)
From: "stremler.jeannine@orange.fr"
Date: Thu, 11 May 2023 17:10:57 +0000
Message-ID:
Subject: LOAN OFFER @2% INTEREST RATE
To: ctetley
doctor
Content-Type: text/plain; charset="UTF-8"
X-Spam_score: 7.7
X-Spam_score_int: 77
X-Spam_bar: +++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: https://bit.ly/3B28Rt2
Content analysis details: (7.7 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.221.176 listed in list.dnswl.org]
-0.0 SPF_PASS SPF: sender matches SPF record
1.6 SUBJ_ALL_CAPS Subject is all capitals
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[kibru246(at)gmail.com]
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit
[kibru246(at)gmail.com]
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.221.176 listed in wl.mailspike.net]
0.4 NAME_EMAIL_DIFF Sender NAME is an unrelated email address
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
2.8 POSSIBLE_GMAIL_PHISHER Apparent phishing email sent from a gmail
account
0.7 PDS_FROM_2_EMAILS No description available.
1.0 FROM_2_EMAILS_SHORT Short body and From looks like 2 different emails
1.2 BODY_SINGLE_URI Message body is only a URI
Subject: {SPAM?} LOAN OFFER @2% INTEREST RATE
https://bit.ly/3B28Rt2
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments