loan link spam from gmail
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Mon, 19 Jun 2023 07:34:01 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96 (FreeBSD))
(envelope-from)
id 1qBEzd-000Eon-0H
for dave@doctor.nl2k.ab.ca;
Mon, 19 Jun 2023 07:32:29 -0600
Resent-From: The Doctor
Resent-Date: Mon, 19 Jun 2023 07:32:29 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-pj1-f66.google.com ([209.85.216.66]:45178)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.96 (FreeBSD))
(envelope-from)
id 1qBDeM-0001Xt-0v
for doctor@doctor.nl2k.ab.ca;
Mon, 19 Jun 2023 06:06:30 -0600
Received: by mail-pj1-f66.google.com with SMTP id 98e67ed59e1d1-25ea1b6b659so1731021a91.2
for; Mon, 19 Jun 2023 05:04:28 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20221208; t=1687176262; x=1689768262;
h=to:subject:message-id:date:from:mime-version:from:to:cc:subject
:date:message-id:reply-to;
bh=/BxCDrhRqnBHrLI9vRv0aBCfQYHKiZXNcbwq8JWLRLI=;
b=RXk1dpouzM3Ot+04MWdxs/wIdmjo/jsviPMj1+Hfk3XTpJi6sU9PJnq/joN0YJOPFr
YRgHzIqKu4Ode5gnmEoRtVxsdrR1kvaYauuklmandmN7yDqmxs0NZi1lSRqJFAtDk0yG
1S3IxNVHx8P1GeAyh+ANYq9LTSwCUoahCKqRs1VahCzobhthYJHFUUl3TLDJ+ion0NYi
C8KmByDkEyo0/4BOVksu+K/FEXVN1xzxV6PM0Pawm/+Z29O1Hc4M9etTiLCQFKLPcCU/
OUb83VBVVAgQc+5OPku7IKjnKSoBR2kevjjXLhlu72MaqU5WJjxfnGI3FidclS+QSrUp
6hnw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20221208; t=1687176262; x=1689768262;
h=to:subject:message-id:date:from:mime-version:x-gm-message-state
:from:to:cc:subject:date:message-id:reply-to;
bh=/BxCDrhRqnBHrLI9vRv0aBCfQYHKiZXNcbwq8JWLRLI=;
b=hN6HSIL7vVTL5qogILgTOI6oHP60q1jq1URKVtCOEgDcsV/n92w5zEHwMLUkOUkOLi
V0Dstqm2EjqBrWCPg7EafWS1RfTfK3tCO7QxRcWlkZDBlUpvc63UbA4gvEnOe8GX1DE0
AXfTDRqsSgeac2ZdJX4gms/gWkkflBeHPLrCnk3oxdPHu2725nPsLOnjDZ9Op5yvfSbm
B92XEgaxS9Msaklt5U+Mw+Xrd1av2o860HjabBTtaeMryOw0t3tlvN987+7CFmkHf8/X
EULkjm0AdSJJzZ9hu6LgYBXMWzMYoCYNY3Lz3q3iQU/056z5CgZxaTQbPDX7+qn/2klp
Cv8A==
X-Gm-Message-State: AC+VfDzNjcY13RG/DUvFU/O2x5eHRoyGqQO2o6PdGd7MZ5vO0aFgpLBb
u28oP/vaNLYSH8iKiPZ7eZnUuq0sygPI5Ye5sB8=
X-Google-Smtp-Source: ACHHUZ5gJwrphIaNOgzXsfKQpycEw8b5dzkn4jhuv+Uufx7FQOJ2Sf//sM/osUfW36yA56SF2KVjSdx+FhU1C1Vgqfs=
X-Received: by 2002:a17:90a:3ee2:b0:25b:f273:84ca with SMTP id
k89-20020a17090a3ee200b0025bf27384camr7137650pjc.12.1687176262356; Mon, 19
Jun 2023 05:04:22 -0700 (PDT)
MIME-Version: 1.0
From: "LOAN OFFER @2% INTEREST RATE"
Date: Mon, 19 Jun 2023 12:04:15 +0000
Message-ID:
Subject:
To: cteng, ctetley ,
c degagne, doctor ,
elizabethp, firdosh
Content-Type: multipart/alternative; boundary="000000000000ca93fd05fe7a5512"
X-Spam_score: 5.7
X-Spam_score_int: 57
X-Spam_bar: +++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: http://fCz.alonebenefit.homes/34546de4235m342356 http://fCz.alonebenefit.homes/34546de4235m342356
Content analysis details: (5.7 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist
[URI: alonebenefit.homes]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.216.66 listed in list.dnswl.org]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[zaridze2003(at)gmail.com]
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit
[zaridze2003(at)gmail.com]
1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist
[URI: alonebenefit.homes]
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.0 TVD_SPACE_RATIO No description available.
1.2 BODY_SINGLE_URI Message body is only a URI
0.1 URIBL_SBL_A Contains URL's A record listed in the SBL blocklist
[URI: fcz.alonebenefit.homes/194.50.153.72]
[URI: fcz.alonebenefit.homes/194.50.153.72]
-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)
[209.85.216.66 listed in wl.mailspike.net]
-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders
Subject: {SPAM?}
--000000000000ca93fd05fe7a5512
Content-Type: text/plain; charset="UTF-8"
http://fCz.alonebenefit.homes/34546de4235m342356
--000000000000ca93fd05fe7a5512
Content-Type: text/html; charset="UTF-8"
http://fCz.alonebenefit.homes/34546de4235m342356
--000000000000ca93fd05fe7a5512--
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Mon, 19 Jun 2023 07:34:01 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96 (FreeBSD))
(envelope-from
id 1qBEzd-000Eon-0H
for dave@doctor.nl2k.ab.ca;
Mon, 19 Jun 2023 07:32:29 -0600
Resent-From: The Doctor
Resent-Date: Mon, 19 Jun 2023 07:32:29 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-pj1-f66.google.com ([209.85.216.66]:45178)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.96 (FreeBSD))
(envelope-from
id 1qBDeM-0001Xt-0v
for doctor@doctor.nl2k.ab.ca;
Mon, 19 Jun 2023 06:06:30 -0600
Received: by mail-pj1-f66.google.com with SMTP id 98e67ed59e1d1-25ea1b6b659so1731021a91.2
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20221208; t=1687176262; x=1689768262;
h=to:subject:message-id:date:from:mime-version:from:to:cc:subject
:date:message-id:reply-to;
bh=/BxCDrhRqnBHrLI9vRv0aBCfQYHKiZXNcbwq8JWLRLI=;
b=RXk1dpouzM3Ot+04MWdxs/wIdmjo/jsviPMj1+Hfk3XTpJi6sU9PJnq/joN0YJOPFr
YRgHzIqKu4Ode5gnmEoRtVxsdrR1kvaYauuklmandmN7yDqmxs0NZi1lSRqJFAtDk0yG
1S3IxNVHx8P1GeAyh+ANYq9LTSwCUoahCKqRs1VahCzobhthYJHFUUl3TLDJ+ion0NYi
C8KmByDkEyo0/4BOVksu+K/FEXVN1xzxV6PM0Pawm/+Z29O1Hc4M9etTiLCQFKLPcCU/
OUb83VBVVAgQc+5OPku7IKjnKSoBR2kevjjXLhlu72MaqU5WJjxfnGI3FidclS+QSrUp
6hnw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20221208; t=1687176262; x=1689768262;
h=to:subject:message-id:date:from:mime-version:x-gm-message-state
:from:to:cc:subject:date:message-id:reply-to;
bh=/BxCDrhRqnBHrLI9vRv0aBCfQYHKiZXNcbwq8JWLRLI=;
b=hN6HSIL7vVTL5qogILgTOI6oHP60q1jq1URKVtCOEgDcsV/n92w5zEHwMLUkOUkOLi
V0Dstqm2EjqBrWCPg7EafWS1RfTfK3tCO7QxRcWlkZDBlUpvc63UbA4gvEnOe8GX1DE0
AXfTDRqsSgeac2ZdJX4gms/gWkkflBeHPLrCnk3oxdPHu2725nPsLOnjDZ9Op5yvfSbm
B92XEgaxS9Msaklt5U+Mw+Xrd1av2o860HjabBTtaeMryOw0t3tlvN987+7CFmkHf8/X
EULkjm0AdSJJzZ9hu6LgYBXMWzMYoCYNY3Lz3q3iQU/056z5CgZxaTQbPDX7+qn/2klp
Cv8A==
X-Gm-Message-State: AC+VfDzNjcY13RG/DUvFU/O2x5eHRoyGqQO2o6PdGd7MZ5vO0aFgpLBb
u28oP/vaNLYSH8iKiPZ7eZnUuq0sygPI5Ye5sB8=
X-Google-Smtp-Source: ACHHUZ5gJwrphIaNOgzXsfKQpycEw8b5dzkn4jhuv+Uufx7FQOJ2Sf//sM/osUfW36yA56SF2KVjSdx+FhU1C1Vgqfs=
X-Received: by 2002:a17:90a:3ee2:b0:25b:f273:84ca with SMTP id
k89-20020a17090a3ee200b0025bf27384camr7137650pjc.12.1687176262356; Mon, 19
Jun 2023 05:04:22 -0700 (PDT)
MIME-Version: 1.0
From: "LOAN OFFER @2% INTEREST RATE"
Date: Mon, 19 Jun 2023 12:04:15 +0000
Message-ID:
Subject:
To: cteng
c degagne
elizabethp
Content-Type: multipart/alternative; boundary="000000000000ca93fd05fe7a5512"
X-Spam_score: 5.7
X-Spam_score_int: 57
X-Spam_bar: +++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: http://fCz.alonebenefit.homes/34546de4235m342356 http://fCz.alonebenefit.homes/34546de4235m342356
Content analysis details: (5.7 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist
[URI: alonebenefit.homes]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.216.66 listed in list.dnswl.org]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[zaridze2003(at)gmail.com]
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit
[zaridze2003(at)gmail.com]
1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist
[URI: alonebenefit.homes]
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.0 TVD_SPACE_RATIO No description available.
1.2 BODY_SINGLE_URI Message body is only a URI
0.1 URIBL_SBL_A Contains URL's A record listed in the SBL blocklist
[URI: fcz.alonebenefit.homes/194.50.153.72]
[URI: fcz.alonebenefit.homes/194.50.153.72]
-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)
[209.85.216.66 listed in wl.mailspike.net]
-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders
Subject: {SPAM?}
--000000000000ca93fd05fe7a5512
Content-Type: text/plain; charset="UTF-8"
http://fCz.alonebenefit.homes/34546de4235m342356
--000000000000ca93fd05fe7a5512
Content-Type: text/html; charset="UTF-8"
http://fCz.alonebenefit.homes/34546de4235m342356
--000000000000ca93fd05fe7a5512--
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments