Grand Piano Spam from Google Gmail
Posted by Dave Yadallee on
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Mon, 19 May 2025 16:28:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))
(envelope-from)
id 1uH8xQ-000000006kp-3DBN
for dave@doctor.nl2k.ab.ca;
Mon, 19 May 2025 16:27:40 -0600
Resent-From: The Doctor
Resent-Date: Mon, 19 May 2025 16:27:40 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-pj1-f42.google.com ([209.85.216.42]:54303)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.98.2 (FreeBSD))
(envelope-from)
id 1uH6ol-00000000PoC-22sU
for root@nk.ca;
Mon, 19 May 2025 14:10:45 -0600
Received: by mail-pj1-f42.google.com with SMTP id 98e67ed59e1d1-30e80f03760so3346240a91.0
for; Mon, 19 May 2025 13:08:42 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20230601; t=1747685316; x=1748290116; darn=nk.ca;
h=reply-to:to:from:subject:content-transfer-encoding:mime-version
:date:message-id:from:to:cc:subject:date:message-id:reply-to;
bh=dQO7pcrLcmXqBzw8hKwFKPZdtbldNqXrLN1WkxXEKrs=;
b=QWOrXD6FHCbaqXNOW+iCTRnMHiASHA2CMGxXUIJ2qxK4SKlzMNCbdzLow0vF7+ap/m
CadXt/2I9lwwmAW57i9wegD6F4Wzx6IyH3fd0krEzHcaFi2lKKovKE2NUzw/cgl+b9yn
KYCgOzybqdyn/qvuezX9kh4krdUo8BwrQr/ZBB9atbYjuoyirW7Zg1h0fXT+Vo2XlxPB
3Q5nk5mUZw1LT6k7uZHslceUX5ZSZtnfloSMT9g9KwCIdChH7PPLII6DIwq8MHDgv6Y4
X5VN8SJrcXDY6Uc80muBeAvsoX6Trx+QML+Y8dSr11DiZbPoesuNCM++bmzsjD4cg9IL
DX7w==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20230601; t=1747685316; x=1748290116;
h=reply-to:to:from:subject:content-transfer-encoding:mime-version
:date:message-id:x-gm-message-state:from:to:cc:subject:date
:message-id:reply-to;
bh=dQO7pcrLcmXqBzw8hKwFKPZdtbldNqXrLN1WkxXEKrs=;
b=cPOqjel3triVlcXDTJx+2oSrCNitLWDiIKdpeilFMfGmS0VV9qQ77KM0JUIXxrL4fI
V+ZQRlqQlcqbA2yKY1d2Y5BCCvIcvAEekAXnB1VVTtGdyIPNsEhL+epYbvf1ElQT74Pn
9aKRqWeW7HwAVS5lV4hckOAPmJ1NCuAesYnXdQVK77RK1yNlqv/HkekJs7qau6vziw3Q
MrZa4glEi6gCJL6FHAPlCYEv3TxC3tb1o6bUgKh4swSyPEA0a1T/bNZ9Mq7Ye1NS0xJy
hGEyXA9C2TYofJbSOFf0WfAqY8//Y964lDtEbXNOw8l5aK3iS8EAEh16Y658/B7bgeix
LBwg==
X-Gm-Message-State: AOJu0Yx2TPb+OgPUY2Uu7WvXsMly5fnl7XrLXVOANyCjsGSTfp4kfXyf
CrAPS7cFmjNSB41ksOmxXNkbL2M8/4vIILJk1Oa47LXeSkgHGvMGehKDEXyAwA==
X-Gm-Gg: ASbGncsDISOpyQc1+k4zfF0qc4MQc/xe8pJ5QtKbc/pXgNZ1UcfG11PzMkA3ZNmHNKq
CvYWoG9hCA+ZisHbpjSDRE1qllL1MYSWH1iOmeKBaUDmW9Gb09pFI0nsKx78ijbklrJebZsNKRh
3FpHh1kgiRnPSVuPgU0xK0xR+4zOEDyzpVcTNp011i8dh1ZGDVsCrqx+KBL3TtqDqlFcRrQPeFq
Yl9NSBXRk4R35WevWQXmsWERksn7j92M/Emj+0zvoFLmv8OUtlSSHQ5y5Vuaso5v8dcM2jSuM4I
rTO6VVlEAWZUvrlUa3GTIJo96574XMP6rgoANAVGuSd3brWGKvSZMY2eW5NNrd7e
X-Google-Smtp-Source: AGHT+IG62tyX2P+EJH4gbie4RR6Y009lKvnVQbtsAMTP5yDEDXMiOiU5ltaSe37jQQy7bDDj0+eVgg==
X-Received: by 2002:a17:90b:4c0f:b0:2f8:49ad:4079 with SMTP id 98e67ed59e1d1-30e830ca01fmr19859310a91.6.1747685316232;
Mon, 19 May 2025 13:08:36 -0700 (PDT)
Received: from [103.237.86.5] ([103.237.86.5])
by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-30f365b2dc3sm68626a91.2.2025.05.19.13.08.35
for
(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
Mon, 19 May 2025 13:08:36 -0700 (PDT)
Message-ID: <682b8fc4.170a0220.638e3.0877@mx.google.com>
Date: Mon, 19 May 2025 13:08:36 -0700 (PDT)
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Subject: Quick Note About a Grand Piano
From: Philippa Dunham
To: root@nk.ca
Reply-To: pilladunham@outlook.com
X-Spam_score: 10.3
X-Spam_score_int: 103
X-Spam_bar: ++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Hello Root, Just wanted to reach out again. I’m following
up to see if you had a chance to read my previous note about my late husband’s
Yamaha piano. It’s a special piece with a lot of meaning, and I’d b [...]
Content analysis details: (10.3 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.216.42 listed in list.dnswl.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[209.85.216.42 listed in dnsbl.ahbl.org]
[209.85.216.42 listed in dnsbl.ahbl.org]
[209.85.216.42 listed in dnsbl.ahbl.org]
[209.85.216.42 listed in dnsbl.ahbl.org]
[103.237.86.5 listed in dnsbl.ahbl.org]
[103.237.86.5 listed in dnsbl.ahbl.org]
[103.237.86.5 listed in dnsbl.ahbl.org]
[103.237.86.5 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[209.85.216.42 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[209.85.216.42 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[209.85.216.42 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[209.85.216.42 listed in dnsbl.ahbl.org]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[103.237.86.5 listed in will-spam-for-food.eu.org]
[103.237.86.5 listed in will-spam-for-food.eu.org]
[103.237.86.5 listed in will-spam-for-food.eu.org]
[103.237.86.5 listed in will-spam-for-food.eu.org]
[103.237.86.5 listed in will-spam-for-food.eu.org]
[103.237.86.5 listed in will-spam-for-food.eu.org]
[103.237.86.5 listed in will-spam-for-food.eu.org]
[103.237.86.5 listed in will-spam-for-food.eu.org]
[209.85.216.42 listed in will-spam-for-food.eu.org]
[209.85.216.42 listed in will-spam-for-food.eu.org]
[209.85.216.42 listed in will-spam-for-food.eu.org]
[209.85.216.42 listed in will-spam-for-food.eu.org]
[209.85.216.42 listed in will-spam-for-food.eu.org]
[209.85.216.42 listed in will-spam-for-food.eu.org]
[209.85.216.42 listed in will-spam-for-food.eu.org]
[209.85.216.42 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL
[103.237.86.5 listed in sbl-xbl.spamhaus.org]
[103.237.86.5 listed in sbl-xbl.spamhaus.org]
2.6 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL
[103.237.86.5 listed in zen.spamhaus.org]
-0.0 SPF_PASS SPF: sender matches SPF record
0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in
headers
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[hossaynizohre(at)gmail.com]
-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)
[209.85.216.42 listed in wl.mailspike.net]
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders
0.0 NO_RDNS2 Sending MTA has no reverse DNS
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
Subject: {SPAM?} Quick Note About a Grand Piano
SGVsbG8gUm9vdCwKCkp1c3Qgd2FudGVkIHRvIHJlYWNoIG91dCBhZ2Fpbi4gSeKAmW0gZm9sbG93
aW5nIHVwIHRvIHNlZSBpZiB5b3UgaGFkIGEgY2hhbmNlIHRvIHJlYWQgbXkgcHJldmlvdXMgbm90
ZSBhYm91dCBteSBsYXRlIGh1c2JhbmTigJlzIFlhbWFoYSBwaWFuby4gSXTigJlzIGEgc3BlY2lh
bCBwaWVjZSB3aXRoIGEgbG90IG9mIG1lYW5pbmcsIGFuZCBJ4oCZZCBiZSBzbyBoYXBweSBpZiBp
dCBlbmRlZCB1cCB3aXRoIHNvbWVvbmUgd2hvIHRydWx5IGFwcHJlY2lhdGVzIG11c2ljLgoKSeKA
mWQgYmUgZGVsaWdodGVkIHRvIHRlbGwgeW91IG1vcmUgYWJvdXQgaXRzIGhpc3RvcnksIGNvbmRp
dGlvbiwgb3IgYW55dGhpbmcgZWxzZSB5b3XigJlkIGxpa2UgdG8ga25vdy4KClRoYW5rcyBhZ2Fp
biBmb3IgeW91ciB0aW1lLCBpdCBtZWFucyBhIGxvdC4KCkJlc3QgcmVnYXJkcywKUGhpbGlwcGEg
RHVuaGFt
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Mon, 19 May 2025 16:28:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))
(envelope-from
id 1uH8xQ-000000006kp-3DBN
for dave@doctor.nl2k.ab.ca;
Mon, 19 May 2025 16:27:40 -0600
Resent-From: The Doctor
Resent-Date: Mon, 19 May 2025 16:27:40 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-pj1-f42.google.com ([209.85.216.42]:54303)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.98.2 (FreeBSD))
(envelope-from
id 1uH6ol-00000000PoC-22sU
for root@nk.ca;
Mon, 19 May 2025 14:10:45 -0600
Received: by mail-pj1-f42.google.com with SMTP id 98e67ed59e1d1-30e80f03760so3346240a91.0
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20230601; t=1747685316; x=1748290116; darn=nk.ca;
h=reply-to:to:from:subject:content-transfer-encoding:mime-version
:date:message-id:from:to:cc:subject:date:message-id:reply-to;
bh=dQO7pcrLcmXqBzw8hKwFKPZdtbldNqXrLN1WkxXEKrs=;
b=QWOrXD6FHCbaqXNOW+iCTRnMHiASHA2CMGxXUIJ2qxK4SKlzMNCbdzLow0vF7+ap/m
CadXt/2I9lwwmAW57i9wegD6F4Wzx6IyH3fd0krEzHcaFi2lKKovKE2NUzw/cgl+b9yn
KYCgOzybqdyn/qvuezX9kh4krdUo8BwrQr/ZBB9atbYjuoyirW7Zg1h0fXT+Vo2XlxPB
3Q5nk5mUZw1LT6k7uZHslceUX5ZSZtnfloSMT9g9KwCIdChH7PPLII6DIwq8MHDgv6Y4
X5VN8SJrcXDY6Uc80muBeAvsoX6Trx+QML+Y8dSr11DiZbPoesuNCM++bmzsjD4cg9IL
DX7w==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20230601; t=1747685316; x=1748290116;
h=reply-to:to:from:subject:content-transfer-encoding:mime-version
:date:message-id:x-gm-message-state:from:to:cc:subject:date
:message-id:reply-to;
bh=dQO7pcrLcmXqBzw8hKwFKPZdtbldNqXrLN1WkxXEKrs=;
b=cPOqjel3triVlcXDTJx+2oSrCNitLWDiIKdpeilFMfGmS0VV9qQ77KM0JUIXxrL4fI
V+ZQRlqQlcqbA2yKY1d2Y5BCCvIcvAEekAXnB1VVTtGdyIPNsEhL+epYbvf1ElQT74Pn
9aKRqWeW7HwAVS5lV4hckOAPmJ1NCuAesYnXdQVK77RK1yNlqv/HkekJs7qau6vziw3Q
MrZa4glEi6gCJL6FHAPlCYEv3TxC3tb1o6bUgKh4swSyPEA0a1T/bNZ9Mq7Ye1NS0xJy
hGEyXA9C2TYofJbSOFf0WfAqY8//Y964lDtEbXNOw8l5aK3iS8EAEh16Y658/B7bgeix
LBwg==
X-Gm-Message-State: AOJu0Yx2TPb+OgPUY2Uu7WvXsMly5fnl7XrLXVOANyCjsGSTfp4kfXyf
CrAPS7cFmjNSB41ksOmxXNkbL2M8/4vIILJk1Oa47LXeSkgHGvMGehKDEXyAwA==
X-Gm-Gg: ASbGncsDISOpyQc1+k4zfF0qc4MQc/xe8pJ5QtKbc/pXgNZ1UcfG11PzMkA3ZNmHNKq
CvYWoG9hCA+ZisHbpjSDRE1qllL1MYSWH1iOmeKBaUDmW9Gb09pFI0nsKx78ijbklrJebZsNKRh
3FpHh1kgiRnPSVuPgU0xK0xR+4zOEDyzpVcTNp011i8dh1ZGDVsCrqx+KBL3TtqDqlFcRrQPeFq
Yl9NSBXRk4R35WevWQXmsWERksn7j92M/Emj+0zvoFLmv8OUtlSSHQ5y5Vuaso5v8dcM2jSuM4I
rTO6VVlEAWZUvrlUa3GTIJo96574XMP6rgoANAVGuSd3brWGKvSZMY2eW5NNrd7e
X-Google-Smtp-Source: AGHT+IG62tyX2P+EJH4gbie4RR6Y009lKvnVQbtsAMTP5yDEDXMiOiU5ltaSe37jQQy7bDDj0+eVgg==
X-Received: by 2002:a17:90b:4c0f:b0:2f8:49ad:4079 with SMTP id 98e67ed59e1d1-30e830ca01fmr19859310a91.6.1747685316232;
Mon, 19 May 2025 13:08:36 -0700 (PDT)
Received: from [103.237.86.5] ([103.237.86.5])
by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-30f365b2dc3sm68626a91.2.2025.05.19.13.08.35
for
(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
Mon, 19 May 2025 13:08:36 -0700 (PDT)
Message-ID: <682b8fc4.170a0220.638e3.0877@mx.google.com>
Date: Mon, 19 May 2025 13:08:36 -0700 (PDT)
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Subject: Quick Note About a Grand Piano
From: Philippa Dunham
To: root@nk.ca
Reply-To: pilladunham@outlook.com
X-Spam_score: 10.3
X-Spam_score_int: 103
X-Spam_bar: ++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Hello Root, Just wanted to reach out again. I’m following
up to see if you had a chance to read my previous note about my late husband’s
Yamaha piano. It’s a special piece with a lot of meaning, and I’d b [...]
Content analysis details: (10.3 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.216.42 listed in list.dnswl.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[209.85.216.42 listed in dnsbl.ahbl.org]
[209.85.216.42 listed in dnsbl.ahbl.org]
[209.85.216.42 listed in dnsbl.ahbl.org]
[209.85.216.42 listed in dnsbl.ahbl.org]
[103.237.86.5 listed in dnsbl.ahbl.org]
[103.237.86.5 listed in dnsbl.ahbl.org]
[103.237.86.5 listed in dnsbl.ahbl.org]
[103.237.86.5 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[209.85.216.42 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[209.85.216.42 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[209.85.216.42 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[209.85.216.42 listed in dnsbl.ahbl.org]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[103.237.86.5 listed in will-spam-for-food.eu.org]
[103.237.86.5 listed in will-spam-for-food.eu.org]
[103.237.86.5 listed in will-spam-for-food.eu.org]
[103.237.86.5 listed in will-spam-for-food.eu.org]
[103.237.86.5 listed in will-spam-for-food.eu.org]
[103.237.86.5 listed in will-spam-for-food.eu.org]
[103.237.86.5 listed in will-spam-for-food.eu.org]
[103.237.86.5 listed in will-spam-for-food.eu.org]
[209.85.216.42 listed in will-spam-for-food.eu.org]
[209.85.216.42 listed in will-spam-for-food.eu.org]
[209.85.216.42 listed in will-spam-for-food.eu.org]
[209.85.216.42 listed in will-spam-for-food.eu.org]
[209.85.216.42 listed in will-spam-for-food.eu.org]
[209.85.216.42 listed in will-spam-for-food.eu.org]
[209.85.216.42 listed in will-spam-for-food.eu.org]
[209.85.216.42 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL
[103.237.86.5 listed in sbl-xbl.spamhaus.org]
[103.237.86.5 listed in sbl-xbl.spamhaus.org]
2.6 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL
[103.237.86.5 listed in zen.spamhaus.org]
-0.0 SPF_PASS SPF: sender matches SPF record
0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in
headers
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[hossaynizohre(at)gmail.com]
-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)
[209.85.216.42 listed in wl.mailspike.net]
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders
0.0 NO_RDNS2 Sending MTA has no reverse DNS
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
Subject: {SPAM?} Quick Note About a Grand Piano
SGVsbG8gUm9vdCwKCkp1c3Qgd2FudGVkIHRvIHJlYWNoIG91dCBhZ2Fpbi4gSeKAmW0gZm9sbG93
aW5nIHVwIHRvIHNlZSBpZiB5b3UgaGFkIGEgY2hhbmNlIHRvIHJlYWQgbXkgcHJldmlvdXMgbm90
ZSBhYm91dCBteSBsYXRlIGh1c2JhbmTigJlzIFlhbWFoYSBwaWFuby4gSXTigJlzIGEgc3BlY2lh
bCBwaWVjZSB3aXRoIGEgbG90IG9mIG1lYW5pbmcsIGFuZCBJ4oCZZCBiZSBzbyBoYXBweSBpZiBp
dCBlbmRlZCB1cCB3aXRoIHNvbWVvbmUgd2hvIHRydWx5IGFwcHJlY2lhdGVzIG11c2ljLgoKSeKA
mWQgYmUgZGVsaWdodGVkIHRvIHRlbGwgeW91IG1vcmUgYWJvdXQgaXRzIGhpc3RvcnksIGNvbmRp
dGlvbiwgb3IgYW55dGhpbmcgZWxzZSB5b3XigJlkIGxpa2UgdG8ga25vdy4KClRoYW5rcyBhZ2Fp
biBmb3IgeW91ciB0aW1lLCBpdCBtZWFucyBhIGxvdC4KCkJlc3QgcmVnYXJkcywKUGhpbGlwcGEg
RHVuaGFt