CAA phish Part 1
Posted by Dave Yadallee on
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Tue, 16 Dec 2025 15:12:00 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))
(envelope-from)
id 1vVdGd-00000000Lom-3Iib
for dave@doctor.nl2k.ab.ca;
Tue, 16 Dec 2025 15:11:39 -0700
Resent-From: The Doctor
Resent-Date: Tue, 16 Dec 2025 15:11:39 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from [84.234.30.186] (port=55101 helo=rayhaddad.com)
by doctor.nl2k.ab.ca with esmtp (Exim 4.98.2 (FreeBSD))
(envelope-from)
id 1vVdCH-00000000LHl-49yh
for doctor@nl2k.ab.ca;
Tue, 16 Dec 2025 15:07:17 -0700
Received: from 10.222.142.148
by atlas310.free.mail.ne1.yahoo.com pod-id NONE with HTTPS; Fri, 16 Aug 2024 05:37:09 +0000
X-Originating-Ip: [147.253.220.180]
Received-SPF: pass (domain of sp.eocampaign1.com designates 147.253.220.180 as permitted sender)
Authentication-Results: atlas310.free.mail.ne1.yahoo.com;
dkim=pass header.i=@sp.eocampaign1.com header.s=scph0920;
dkim=pass header.i=@eu.sparkpostmail2.com header.s=ssp0116;
spf=pass smtp.mailfrom=sp.eocampaign1.com;
dmarc=unknown header.from=fremantleherald.com;
X-Apparently-To: joe.wakersen@yahoo.com; Fri, 16 Aug 2024 05:37:10 +0000
X-YMailISG: D8kDHTUWLDujxpocc3yE7aGPiibHgZUWwgoAh60ZaFJxFFEJ
Zy5T.FgbCtPIm6p1BvETkSqOMFbymcfAeimFshhmY6huEVRGQKcfdmJUi5DF
WWyZnX2iDsoXptNqlev_2n0m4FSY3V57AwsgaybmRAfy.P0wDsjaT1I4q3ja
aY_ZFty.zsqX9uCtHdIXcB3OSHTWp.b1M4CQKal4YmDIEJ.Mrmk.WKIzvP_L
U.FmZ_GmceLC0xnDlLDnGT8iaZfOCyURSoFnsC9qwGNeoJ4pqJQnl19aZZba
.watRy5Jzg.Lc.sGsD0UphOopSVgpXRrGk1b6h2BqsDY.HNhHH7Fg82GPUTK
UFXbGu_mOAfBLZR3keY.ZQ4JkbpuDb.FaIjZXBtwcU0NkLwW01Vyczeh.Jqt
47rHXEpyVtx_UTmRJyr6dVBr2EOnDeRKV7JMvxCwXG6loUe3cUmtukWziLhI
DFO0HmD7kH8MfMXmt4GdLC6gUsyLCWKT9odMBc3CWfhOGwoYZbZboylaeSL0
aSkqHXGZff7bLyzuWc_7F9gtz1nHsxnBOcogHTMooqvurpjye230aKJYTItN
4Ilfml_WdaRCybcGrplHWykx4PjqP5_DIsfJC.PEOo88nGo7M9Sce4DxqObG
4aJa7Mbmy9w8w1db0Y_0Xa703_NKLZXYJLKEw4QymkUzdRTGLi35raOo0LBN
YD4KRLLcLEHa1NRdMLVNUucylUphu5F.L.oTyGQsUCyKCyFMQPShRuiLXUTt
.8IAqRscgr.FnTS7LeJKh7purakSf6kYzcA7BZBrVYcwbcm1tkN5FiKSWT5A
b9Vu5XzK4s3pEeo_awmhpMxD94EjAX7aONKYIDQFjMVX6CO9nM7rIoH.neP9
_pwHzsn8d0KhUAAJv8QLwIg3iW5kIkA0yrvoiL6puF0lpoBXu0KMzKBejYRe
5C6pALLnnOEz_DpHd4oXG5c7jAMKXbqwEND4K45m6RTBd.owvs05vYSbuU_H
xVvjLLKJ44OGUsgBGWI32nh6wQBPDc2D.Ke59SMm6CY86Kww7OCfGY.Y_9IX
YX.1YOO38ncNMdGFuOluwtPAylzMCdL_4A3uT2W.R_muDgj17..VJkhtf8mv
pNbSvetMw6lYCcB7uyiTTz1tgvXcj.5fne8Eejr_8BoRFPupoFyAQ6CeMf1A
48qWt2xl80LRrlps6oby8BkudCEaC7tipu4emkr8S5oA7SPep5eMy9iUV4os
4wbzcwcTPTd2JC6ITZJKIb.V.c_ExJrRnyF6gzCQjofHkFJTCG4snF_zvzhS
suay3EOVkeALKfpXsOvjalHoeViRcko.3PxvwTPohpH.T4RyziL_iSWdrAd5
xsPi0t31df6nGDuwJgPEFEfnBQ--
Received: from 147.253.220.180 (EHLO mta-253-220-180.emailoctopus.com.sparkpostmail.com)
by 10.222.142.148 with SMTPs
(version=TLS1_2 cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256);
Fri, 16 Aug 2024 05:37:09 +0000
X-MSFBL: z8ck42fwNnb+tsU2HEBPSQG+SXQ0vnlGTddoOUKz8TE=|eyJtZXNzYWdlX2lkIjo
iNjZiYzg0ZTViZTY2YzZlOTZmZDkiLCJ0ZW5hbnRfaWQiOiJzcGNldSIsInN1YmF
jY291bnRfaWQiOiIzNjYyMSIsInIiOiJqb2Uud2FrZXJzZW5AeWFob28uY29tIiw
iY3VzdG9tZXJfaWQiOiIxODczIn0=
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sp.eocampaign1.com;
s=scph0920; t=1723786628; i=@sp.eocampaign1.com;
bh=kaW53h0moNGz7W65BJyr4F5Uu25jKMnoFNcahJnWd1E=;
h=From:To:Subject:List-Unsubscribe:List-Unsubscribe-Post:Date:
Message-ID:Content-Type:From:To:Cc:Subject;
b=pYhS1I5RV9dfApRJBkN68T3bANkNKhF61DZv1nEDodcJYkeaNHu/xV0sQH6C81s7U
4g5v9eCYylxQ5Hc/jKdYw6wo1cfnYbFTKJNNm1ZUeZMyuNcUDXkK3YmE38DLc6Jlp5
B95bVgPJYrJWfVm9aVt/VIZEcTY3rYmR6v4Ceh7o=
DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=eu.sparkpostmail2.com;
s=ssp0116; t=1723786628; i=@eu.sparkpostmail2.com;
bh=kaW53h0moNGz7W65BJyr4F5Uu25jKMnoFNcahJnWd1E=;
h=From:To:Subject:List-Unsubscribe:List-Unsubscribe-Post:Date:
Message-ID:Content-Type:From:To:Cc:Subject;
b=IyqsEosDO/4EtDwKsTE2NnhPuGzE6+W3odZjZn7ybRIEuok1oGqASr0yWINZtIWl0
YtDaxEwBDABsv1ViXnfDCPMVtIW1gPi8YQ9eVxm17R0Y3t3oQ51EkQQfWD/nO7s87R
PdnB1PKnNoaogp5haPxa5+bTVyPdNzE29F5K+hdE=
From: CAA Special Survey Access Granted
To: doctor@nl2k.ab.ca
Subject: doctor, Act Fast: Only a Few Slots Remain!
X-Entity-Ref-Id: 3d399e1a-db38-48ea-87e2-4c9f9f4c0c07
X-EmailOctopus-Parent-Id: 2475ab2e-5b90-11ef-a4fb-b1888d7b73b6
X-EmailOctopus-Parent-Type-Id: campaign
X-EmailOctopus-List-Id: 874d40b2-3765-11ef-a78b-fb3aafa3750b
X-EmailOctopus-List-Contact-Id: 659d1368-53ba-11ef-b067-cdf63223277b
X-EmailOctopus-Started-Preparing-At: 2024-08-16T05:35:02+00:00
X-EmailOctopus-Sent-At: 2024-08-16T05:37:08+00:00
X-EmailOctopus-Team-Id: a9b87556-3763-11ef-8fd1-fb3aafa3750b
X-EmailOctopus-Version: 4
List-Unsubscribe:
List-Unsubscribe-Post: List-Unsubscribe=One-Click
Sender: noreply@sp.eocampaign1.com
MIME-Version: 1.0
Date: Tue, 16 Dec 2025 16:03:58 -0600
Message-ID: <2039634423ff9efee3297655272982c996d3267f65@sp.eocampaign1.com>
Content-Type: multipart/alternative; boundary=h7hQwmWe
X-Spam_score: 33.0
X-Spam_score_int: 330
X-Spam_bar: +++++++++++++++++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Read them right here! тАМ тАМ тАМ тАМ тАМ тАМ тАМ тАМ тАМ
тАМ тАМ тАМ тАМ тАМ тАМ тАМ тАМ тАМ тАМ тАМ тАМ тАМ тАМ тАМ тАМ тАМ тАМ тАМ
тАМ тАМ тАМ тАМ тАМ тАМ тАМ тАМ тАМ тАМ тАМ тАМ тАМ тАМ тАМ тАМ тА [...]
Content analysis details: (33.0 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[147.253.220.180 listed in will-spam-for-food.eu.org]
[147.253.220.180 listed in will-spam-for-food.eu.org]
[147.253.220.180 listed in will-spam-for-food.eu.org]
[147.253.220.180 listed in will-spam-for-food.eu.org]
[147.253.220.180 listed in will-spam-for-food.eu.org]
[147.253.220.180 listed in will-spam-for-food.eu.org]
[147.253.220.180 listed in will-spam-for-food.eu.org]
[147.253.220.180 listed in will-spam-for-food.eu.org]
[84.234.30.186 listed in will-spam-for-food.eu.org]
[84.234.30.186 listed in will-spam-for-food.eu.org]
[84.234.30.186 listed in will-spam-for-food.eu.org]
[84.234.30.186 listed in will-spam-for-food.eu.org]
[84.234.30.186 listed in will-spam-for-food.eu.org]
[84.234.30.186 listed in will-spam-for-food.eu.org]
[84.234.30.186 listed in will-spam-for-food.eu.org]
[84.234.30.186 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[147.253.220.180 listed in dnsbl.ahbl.org]
[147.253.220.180 listed in dnsbl.ahbl.org]
[147.253.220.180 listed in dnsbl.ahbl.org]
[147.253.220.180 listed in dnsbl.ahbl.org]
[84.234.30.186 listed in dnsbl.ahbl.org]
[84.234.30.186 listed in dnsbl.ahbl.org]
[84.234.30.186 listed in dnsbl.ahbl.org]
[84.234.30.186 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[147.253.220.180 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[147.253.220.180 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[147.253.220.180 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[147.253.220.180 listed in dnsbl.ahbl.org]
1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist
[URI: eocampaign1.com]
0.0 SPF_HELO_FAIL SPF: HELO does not match SPF record (fail)
[SPF failed: Rejected by SPF record.]
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
0.1 DKIM_INVALID DKIM or DK signature exists, but is not valid
15 GR_DOMAIN_SPARKP1 Received contains spammer id (sparkp)
0.7 LOCALPART_IN_SUBJECT Local part of To: address appears in Subject
0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail
domains are different
0.6 J_CHICKENPOX_19 BODY: 1alpha-pock-9alpha
2.3 MANGLED_EMAIL BODY: mangled email
0.3 LONGWORD BODY: Uses overlong words
0.6 MEGALONGWORD BODY: Uses really overlong words
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 T_KAM_HTML_FONT_INVALID BODY: Test for Invalidly Named or Formatted
Colors in HTML
0.0 AC_BR_BONANZA RAW: Too many newlines in a row... spammy template
1.3 RDNS_NONE Delivered to internal network by a host with no rDNS
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
1.5 IMPRONONCABLE_2 Too much mixed numbers and lower-case letters
3.0 TO_NAME_SUBJ_NO_RDNS Recipient username in subject + no rDNS
0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!
0.0 UNPARSEABLE_RELAY Informational: message has unparseable relay lines
Subject: {SPAM?} doctor, Act Fast: Only a Few Slots Remain!
--h7hQwmWe
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain; charset="utf-8"
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Tue, 16 Dec 2025 15:12:00 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))
(envelope-from
id 1vVdGd-00000000Lom-3Iib
for dave@doctor.nl2k.ab.ca;
Tue, 16 Dec 2025 15:11:39 -0700
Resent-From: The Doctor
Resent-Date: Tue, 16 Dec 2025 15:11:39 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from [84.234.30.186] (port=55101 helo=rayhaddad.com)
by doctor.nl2k.ab.ca with esmtp (Exim 4.98.2 (FreeBSD))
(envelope-from
id 1vVdCH-00000000LHl-49yh
for doctor@nl2k.ab.ca;
Tue, 16 Dec 2025 15:07:17 -0700
Received: from 10.222.142.148
by atlas310.free.mail.ne1.yahoo.com pod-id NONE with HTTPS; Fri, 16 Aug 2024 05:37:09 +0000
X-Originating-Ip: [147.253.220.180]
Received-SPF: pass (domain of sp.eocampaign1.com designates 147.253.220.180 as permitted sender)
Authentication-Results: atlas310.free.mail.ne1.yahoo.com;
dkim=pass header.i=@sp.eocampaign1.com header.s=scph0920;
dkim=pass header.i=@eu.sparkpostmail2.com header.s=ssp0116;
spf=pass smtp.mailfrom=sp.eocampaign1.com;
dmarc=unknown header.from=fremantleherald.com;
X-Apparently-To: joe.wakersen@yahoo.com; Fri, 16 Aug 2024 05:37:10 +0000
X-YMailISG: D8kDHTUWLDujxpocc3yE7aGPiibHgZUWwgoAh60ZaFJxFFEJ
Zy5T.FgbCtPIm6p1BvETkSqOMFbymcfAeimFshhmY6huEVRGQKcfdmJUi5DF
WWyZnX2iDsoXptNqlev_2n0m4FSY3V57AwsgaybmRAfy.P0wDsjaT1I4q3ja
aY_ZFty.zsqX9uCtHdIXcB3OSHTWp.b1M4CQKal4YmDIEJ.Mrmk.WKIzvP_L
U.FmZ_GmceLC0xnDlLDnGT8iaZfOCyURSoFnsC9qwGNeoJ4pqJQnl19aZZba
.watRy5Jzg.Lc.sGsD0UphOopSVgpXRrGk1b6h2BqsDY.HNhHH7Fg82GPUTK
UFXbGu_mOAfBLZR3keY.ZQ4JkbpuDb.FaIjZXBtwcU0NkLwW01Vyczeh.Jqt
47rHXEpyVtx_UTmRJyr6dVBr2EOnDeRKV7JMvxCwXG6loUe3cUmtukWziLhI
DFO0HmD7kH8MfMXmt4GdLC6gUsyLCWKT9odMBc3CWfhOGwoYZbZboylaeSL0
aSkqHXGZff7bLyzuWc_7F9gtz1nHsxnBOcogHTMooqvurpjye230aKJYTItN
4Ilfml_WdaRCybcGrplHWykx4PjqP5_DIsfJC.PEOo88nGo7M9Sce4DxqObG
4aJa7Mbmy9w8w1db0Y_0Xa703_NKLZXYJLKEw4QymkUzdRTGLi35raOo0LBN
YD4KRLLcLEHa1NRdMLVNUucylUphu5F.L.oTyGQsUCyKCyFMQPShRuiLXUTt
.8IAqRscgr.FnTS7LeJKh7purakSf6kYzcA7BZBrVYcwbcm1tkN5FiKSWT5A
b9Vu5XzK4s3pEeo_awmhpMxD94EjAX7aONKYIDQFjMVX6CO9nM7rIoH.neP9
_pwHzsn8d0KhUAAJv8QLwIg3iW5kIkA0yrvoiL6puF0lpoBXu0KMzKBejYRe
5C6pALLnnOEz_DpHd4oXG5c7jAMKXbqwEND4K45m6RTBd.owvs05vYSbuU_H
xVvjLLKJ44OGUsgBGWI32nh6wQBPDc2D.Ke59SMm6CY86Kww7OCfGY.Y_9IX
YX.1YOO38ncNMdGFuOluwtPAylzMCdL_4A3uT2W.R_muDgj17..VJkhtf8mv
pNbSvetMw6lYCcB7uyiTTz1tgvXcj.5fne8Eejr_8BoRFPupoFyAQ6CeMf1A
48qWt2xl80LRrlps6oby8BkudCEaC7tipu4emkr8S5oA7SPep5eMy9iUV4os
4wbzcwcTPTd2JC6ITZJKIb.V.c_ExJrRnyF6gzCQjofHkFJTCG4snF_zvzhS
suay3EOVkeALKfpXsOvjalHoeViRcko.3PxvwTPohpH.T4RyziL_iSWdrAd5
xsPi0t31df6nGDuwJgPEFEfnBQ--
Received: from 147.253.220.180 (EHLO mta-253-220-180.emailoctopus.com.sparkpostmail.com)
by 10.222.142.148 with SMTPs
(version=TLS1_2 cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256);
Fri, 16 Aug 2024 05:37:09 +0000
X-MSFBL: z8ck42fwNnb+tsU2HEBPSQG+SXQ0vnlGTddoOUKz8TE=|eyJtZXNzYWdlX2lkIjo
iNjZiYzg0ZTViZTY2YzZlOTZmZDkiLCJ0ZW5hbnRfaWQiOiJzcGNldSIsInN1YmF
jY291bnRfaWQiOiIzNjYyMSIsInIiOiJqb2Uud2FrZXJzZW5AeWFob28uY29tIiw
iY3VzdG9tZXJfaWQiOiIxODczIn0=
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sp.eocampaign1.com;
s=scph0920; t=1723786628; i=@sp.eocampaign1.com;
bh=kaW53h0moNGz7W65BJyr4F5Uu25jKMnoFNcahJnWd1E=;
h=From:To:Subject:List-Unsubscribe:List-Unsubscribe-Post:Date:
Message-ID:Content-Type:From:To:Cc:Subject;
b=pYhS1I5RV9dfApRJBkN68T3bANkNKhF61DZv1nEDodcJYkeaNHu/xV0sQH6C81s7U
4g5v9eCYylxQ5Hc/jKdYw6wo1cfnYbFTKJNNm1ZUeZMyuNcUDXkK3YmE38DLc6Jlp5
B95bVgPJYrJWfVm9aVt/VIZEcTY3rYmR6v4Ceh7o=
DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=eu.sparkpostmail2.com;
s=ssp0116; t=1723786628; i=@eu.sparkpostmail2.com;
bh=kaW53h0moNGz7W65BJyr4F5Uu25jKMnoFNcahJnWd1E=;
h=From:To:Subject:List-Unsubscribe:List-Unsubscribe-Post:Date:
Message-ID:Content-Type:From:To:Cc:Subject;
b=IyqsEosDO/4EtDwKsTE2NnhPuGzE6+W3odZjZn7ybRIEuok1oGqASr0yWINZtIWl0
YtDaxEwBDABsv1ViXnfDCPMVtIW1gPi8YQ9eVxm17R0Y3t3oQ51EkQQfWD/nO7s87R
PdnB1PKnNoaogp5haPxa5+bTVyPdNzE29F5K+hdE=
From: CAA Special Survey Access Granted
To: doctor@nl2k.ab.ca
Subject: doctor, Act Fast: Only a Few Slots Remain!
X-Entity-Ref-Id: 3d399e1a-db38-48ea-87e2-4c9f9f4c0c07
X-EmailOctopus-Parent-Id: 2475ab2e-5b90-11ef-a4fb-b1888d7b73b6
X-EmailOctopus-Parent-Type-Id: campaign
X-EmailOctopus-List-Id: 874d40b2-3765-11ef-a78b-fb3aafa3750b
X-EmailOctopus-List-Contact-Id: 659d1368-53ba-11ef-b067-cdf63223277b
X-EmailOctopus-Started-Preparing-At: 2024-08-16T05:35:02+00:00
X-EmailOctopus-Sent-At: 2024-08-16T05:37:08+00:00
X-EmailOctopus-Team-Id: a9b87556-3763-11ef-8fd1-fb3aafa3750b
X-EmailOctopus-Version: 4
List-Unsubscribe:
List-Unsubscribe-Post: List-Unsubscribe=One-Click
Sender: noreply@sp.eocampaign1.com
MIME-Version: 1.0
Date: Tue, 16 Dec 2025 16:03:58 -0600
Message-ID: <2039634423ff9efee3297655272982c996d3267f65@sp.eocampaign1.com>
Content-Type: multipart/alternative; boundary=h7hQwmWe
X-Spam_score: 33.0
X-Spam_score_int: 330
X-Spam_bar: +++++++++++++++++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Read them right here! тАМ тАМ тАМ тАМ тАМ тАМ тАМ тАМ тАМ
тАМ тАМ тАМ тАМ тАМ тАМ тАМ тАМ тАМ тАМ тАМ тАМ тАМ тАМ тАМ тАМ тАМ тАМ тАМ
тАМ тАМ тАМ тАМ тАМ тАМ тАМ тАМ тАМ тАМ тАМ тАМ тАМ тАМ тАМ тАМ тА [...]
Content analysis details: (33.0 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[147.253.220.180 listed in will-spam-for-food.eu.org]
[147.253.220.180 listed in will-spam-for-food.eu.org]
[147.253.220.180 listed in will-spam-for-food.eu.org]
[147.253.220.180 listed in will-spam-for-food.eu.org]
[147.253.220.180 listed in will-spam-for-food.eu.org]
[147.253.220.180 listed in will-spam-for-food.eu.org]
[147.253.220.180 listed in will-spam-for-food.eu.org]
[147.253.220.180 listed in will-spam-for-food.eu.org]
[84.234.30.186 listed in will-spam-for-food.eu.org]
[84.234.30.186 listed in will-spam-for-food.eu.org]
[84.234.30.186 listed in will-spam-for-food.eu.org]
[84.234.30.186 listed in will-spam-for-food.eu.org]
[84.234.30.186 listed in will-spam-for-food.eu.org]
[84.234.30.186 listed in will-spam-for-food.eu.org]
[84.234.30.186 listed in will-spam-for-food.eu.org]
[84.234.30.186 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[147.253.220.180 listed in dnsbl.ahbl.org]
[147.253.220.180 listed in dnsbl.ahbl.org]
[147.253.220.180 listed in dnsbl.ahbl.org]
[147.253.220.180 listed in dnsbl.ahbl.org]
[84.234.30.186 listed in dnsbl.ahbl.org]
[84.234.30.186 listed in dnsbl.ahbl.org]
[84.234.30.186 listed in dnsbl.ahbl.org]
[84.234.30.186 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[147.253.220.180 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[147.253.220.180 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[147.253.220.180 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[147.253.220.180 listed in dnsbl.ahbl.org]
1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist
[URI: eocampaign1.com]
0.0 SPF_HELO_FAIL SPF: HELO does not match SPF record (fail)
[SPF failed: Rejected by SPF record.]
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
0.1 DKIM_INVALID DKIM or DK signature exists, but is not valid
15 GR_DOMAIN_SPARKP1 Received contains spammer id (sparkp)
0.7 LOCALPART_IN_SUBJECT Local part of To: address appears in Subject
0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail
domains are different
0.6 J_CHICKENPOX_19 BODY: 1alpha-pock-9alpha
2.3 MANGLED_EMAIL BODY: mangled email
0.3 LONGWORD BODY: Uses overlong words
0.6 MEGALONGWORD BODY: Uses really overlong words
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 T_KAM_HTML_FONT_INVALID BODY: Test for Invalidly Named or Formatted
Colors in HTML
0.0 AC_BR_BONANZA RAW: Too many newlines in a row... spammy template
1.3 RDNS_NONE Delivered to internal network by a host with no rDNS
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
1.5 IMPRONONCABLE_2 Too much mixed numbers and lower-case letters
3.0 TO_NAME_SUBJ_NO_RDNS Recipient username in subject + no rDNS
0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!
0.0 UNPARSEABLE_RELAY Informational: message has unparseable relay lines
Subject: {SPAM?} doctor, Act Fast: Only a Few Slots Remain!
--h7hQwmWe
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain; charset="utf-8"