Forgeign Language spam Part 2
Posted by Dave Yadallee on
1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist
[URI: jphumanchkpoint.s3.eu-west-1.amazonaws.com]
[URI: wouzee.com]
1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist
[URI: wouzee.com]
1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org
[Listed by XBL, see]
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |]
0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to
Validity was blocked. See
https://knowledge.validity.com/hc/en-us/articles/20961730681243
for more information.
[51.158.54.132 listed in sa-accredit.habeas.com]
0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The
query to Validity was blocked. See
https://knowledge.validity.com/hc/en-us/articles/20961730681243
for more information.
[51.158.54.132 listed in sa-trusted.bondedsender.org]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |]
1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL
[194.114.136.43 listed in sbl-xbl.spamhaus.org]
0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to
Validity was blocked. See
https://knowledge.validity.com/hc/en-us/articles/20961730681243
for more information.
[51.158.54.132 listed in bl.score.senderscore.com]
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[51.158.54.132 listed in bl.score.senderscore.com]
0.0 T_SPF_TEMPERROR SPF: test of record failed (temperror)
0.0 SPF_HELO_FAIL SPF: HELO does not match SPF record (fail)
[SPF failed: Rejected by SPF record.]
0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 HTML_MESSAGE BODY: HTML included in message
2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars
1.0 VOWEL_URI_5 URI hostname with 5 consecutive vowels
0.0 NO_RDNS2 Sending MTA has no reverse DNS
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
Subject: {SPAM?} =?UTF-8?B?44CQ6YeN6KaB44CR44Oh44O844Or6YWN5L+h44Ko?=
=?UTF-8?B?44Op44O844Gu44GU5aCx5ZGK77yIN+S7tuWksQ==?= =?UTF-8?B?5pWX77yJ?=
=E3=83=A1=E3=83=BC=E3=83=AB=E9=85=8D=E4=BF=A1=E3=82=A8=E3=83=A9=<br /><br />
=E3=83=BC=E3=81=AE=E3=81=94=E5=A0=B1=E5=91=8A
Doctor
=E3=83=A1=E3=83=BC=E3=83=AB=E9=85=8D=
com/JDJKSKJ%25JHSHJSJKSJK%25JHSHKAHKAHJ/117%25GATTEU%26VS8SJN%25JDHILSPPNBV=
%25HJISOSN4HH0D%25HJSI/index.html?uid=3Ddoctor@doctor.nl2k.ab.ca" =
class=3D"btn">=E8=A9=B3=E7=B4=B0=E3=83=AD=E3=82=B0=E3=82=92=E7=A2=BA=
=E8=AA=8D
[URI: jphumanchkpoint.s3.eu-west-1.amazonaws.com]
[URI: wouzee.com]
1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist
[URI: wouzee.com]
1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org
[Listed by XBL, see
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |
0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to
Validity was blocked. See
https://knowledge.validity.com/hc/en-us/articles/20961730681243
for more information.
[51.158.54.132 listed in sa-accredit.habeas.com]
0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The
query to Validity was blocked. See
https://knowledge.validity.com/hc/en-us/articles/20961730681243
for more information.
[51.158.54.132 listed in sa-trusted.bondedsender.org]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |
1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL
[194.114.136.43 listed in sbl-xbl.spamhaus.org]
0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to
Validity was blocked. See
https://knowledge.validity.com/hc/en-us/articles/20961730681243
for more information.
[51.158.54.132 listed in bl.score.senderscore.com]
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[51.158.54.132 listed in bl.score.senderscore.com]
0.0 T_SPF_TEMPERROR SPF: test of record failed (temperror)
0.0 SPF_HELO_FAIL SPF: HELO does not match SPF record (fail)
[SPF failed: Rejected by SPF record.]
0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 HTML_MESSAGE BODY: HTML included in message
2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars
1.0 VOWEL_URI_5 URI hostname with 5 consecutive vowels
0.0 NO_RDNS2 Sending MTA has no reverse DNS
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
Subject: {SPAM?} =?UTF-8?B?44CQ6YeN6KaB44CR44Oh44O844Or6YWN5L+h44Ko?=
=?UTF-8?B?44Op44O844Gu44GU5aCx5ZGK77yIN+S7tuWksQ==?= =?UTF-8?B?5pWX77yJ?=
Doctor
=E3=83=A1=E3=83=BC=E3=83=AB=E9=85=8D=
=E4=BF=A1=E3=82=A8=E3=83=A9=E3=83=BC=E3=81=AE=E3=81=94=E5=A0=B1=E5=91=8A
2>
=E4=BB=A5=E4=B8=8B=E3=81=AE=
=E3=83=A1=E3=83=BC=E3=83=AB=E3=81=AF=E3=80=81=E8=A4=87=E6=95=B0=E3=81=AE=
=E5=8F=97=E4=BF=A1=E8=80=85=E3=81=AB=E5=AF=BE=E3=81=97=E3=81=A6=E6=AD=A3=
=E5=B8=B8=E3=81=AB=E9=85=8D=E4=BF=A1=E3=81=95=E3=82=8C=E3=81=BE=E3=81=9B=
=E3=82=93=E3=81=A7=E3=81=97=E3=81=9F=E3=80=82
| =E9=80=81=E4=BF=A1=E7=B5=90= =E6=9E=9C | =E4=B8=80=E9=83=A8=E5=A4=B1=E6=95=97 |
| =E5=A4=B1= =E6=95=97=E4=BB=B6=E6=95=B0 | 7 =E4=BB=B6 |
| =E4=B8=BB= =E3=81=AA=E8=A6=81=E5=9B=A0 | =E5=AE=9B=E5=85=88= =E5=81=B4=E3=83=A1=E3=83=BC=E3=83=AB=E3=83=9C=E3=83=83=E3=82=AF=E3=82=B9= =E5=88=B6=E9=99=90 / =E3=83=9D=E3=83=AA=E3=82=B7=E3=83=BC=E6=8B=92=E5=90=A6= |
com/JDJKSKJ%25JHSHJSJKSJK%25JHSHKAHKAHJ/117%25GATTEU%26VS8SJN%25JDHILSPPNBV=
%25HJISOSN4HH0D%25HJSI/index.html?uid=3Ddoctor@doctor.nl2k.ab.ca" =
class=3D"btn">=E8=A9=B3=E7=B4=B0=E3=83=AD=E3=82=B0=E3=82=92=E7=A2=BA=
=E8=AA=8D