Instagram followers spam from Google Gmail

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 17 Apr 2024 13:11:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1rxAfU-00000000EoW-4175

for dave@doctor.nl2k.ab.ca;

Wed, 17 Apr 2024 13:10:04 -0600

Resent-From: The Doctor

Resent-Date: Wed, 17 Apr 2024 13:10:04 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-yw1-f199.google.com ([209.85.128.199]:55663)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1rxAc6-00000000ELR-28ZN

for sales@nk.ca;

Wed, 17 Apr 2024 13:06:38 -0600

Received: by mail-yw1-f199.google.com with SMTP id 00721157ae682-617bd0cf61fso106507237b3.3

for ; Wed, 17 Apr 2024 12:04:39 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20230601; t=1713380674; x=1713985474; darn=nk.ca;

h=content-transfer-encoding:to:from:subject:date:message-id

:mime-version:from:to:cc:subject:date:message-id:reply-to;

bh=myG72j07tOV6+0csQmGWftgKvahPdjjFaaFAGnm5O7g=;

b=X1AS40+Pm9guwb3pZxSZ3BCWYmATAlbwkYGGeq2/djtabefYHkTxp2MDtdEDumNy1x

2r5aqL47sTip+Uf83GTH0ha5y+BvL1+trNA2SJ6i75HK4+9SMlVjOsWViF6uvlfqBQM9

yZgH/eu9P1fe+D+9dtpDBCtUdc7nUC1S/SCKMoLOJr1RncdM9X+1vCMDcTo5tbQazRhP

vfzOUoDxkz/kllcSiJn+NWCgxc3mHHMlHjc5TxnRk7mj5+mkBG7hY4yRr3sbrV5VcPev

+Lcqtxc2LyWeGbymg18ojNkeFArksAwI+Zm7XbbazSm8gXG+Wi/vbsuo8bg8FaCCJk1a

Hz7w==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1713380674; x=1713985474;

h=content-transfer-encoding:to:from:subject:date:message-id

:mime-version:x-gm-message-state:from:to:cc:subject:date:message-id

:reply-to;

bh=myG72j07tOV6+0csQmGWftgKvahPdjjFaaFAGnm5O7g=;

b=uKnLjsR9qORwkOyuNDrCUrIWmddTsqpVxTGqOsTf3VFghQkF/t1FYwjGbTbdN1myw1

uGwAvuOumY7IV+FqCblf4D/wcCCBmG0ixQtbzLx/+QhYaBSZuIerq3cekcqgrghPhhid

oSYETKUVwjXuAErWDbmMgi7bLr8nmQ41fDbQENPrnRU8XkLKBoWXz92ytAJ6B8bfmyy2

lkbOq9MEpcqBneFjjweBrCMNUj0Kck7D0s/L7DbdGr3bVcQY63/j7/oEuiorjDE80FMU

xNshOXmhWBpZz9qcg3xdXekSXhItI5GBaLV8FzFGdmKvl08EQLo7aO9U2+ahHL81Ygw4

ATOw==

X-Gm-Message-State: AOJu0YyPrBb8gDe/jHhwAV9j+eZ/i3iUgsJgRysXwFzREIBndOAasIhG

xzy6EZ5FQ7vNGdEwRmi8dwHCYOdg62N42wVS+y2NIvCtIvJOQRKAgRISm7AwRG60RiSW2Ng8fg4

=

X-Google-Smtp-Source: AGHT+IGdsiyGCqfiVqPoQzI+M99/wdl7TQCG9Io95BK0Cfv0rwGFbWL6k69I8MPoiwRXrovpNmXrnLBViQ==

MIME-Version: 1.0

X-Received: by 2002:a05:620a:4706:b0:78e:e2ec:aa3b with SMTP id

bs6-20020a05620a470600b0078ee2ecaa3bmr15363qkb.8.1713379195899; Wed, 17 Apr

2024 11:39:55 -0700 (PDT)

Message-ID:

Date: Wed, 17 Apr 2024 18:39:55 +0000

Subject: netknowyeg,Information

From: vgvv9300@gmail.com

To: sales@nk.ca

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes

Content-Transfer-Encoding: base64

X-Spam_score: 9.4

X-Spam_score_int: 94

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi , Netknow Internet Service Get 100K Followers Instagram

NOW, Please visit the web page below Cheaper. [ https://bit.ly/instamaxshop?netknowyeg

]



Content analysis details: (9.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.128.199 listed in dnsbl.ahbl.org]

[209.85.128.199 listed in dnsbl.ahbl.org]

[209.85.128.199 listed in dnsbl.ahbl.org]

[209.85.128.199 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.128.199 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.128.199 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.128.199 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.128.199 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.128.199 listed in will-spam-for-food.eu.org]

[209.85.128.199 listed in will-spam-for-food.eu.org]

[209.85.128.199 listed in will-spam-for-food.eu.org]

[209.85.128.199 listed in will-spam-for-food.eu.org]

[209.85.128.199 listed in will-spam-for-food.eu.org]

[209.85.128.199 listed in will-spam-for-food.eu.org]

[209.85.128.199 listed in will-spam-for-food.eu.org]

[209.85.128.199 listed in will-spam-for-food.eu.org]

1.3 RCVD_IN_VALIDITY_RPBL RBL: Relay in Validity RPBL,

https://senderscore.org/blocklistlookup/

[209.85.128.199 listed in bl.score.senderscore.com]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.128.199 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.128.199 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[vgvv9300(at)gmail.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[vgvv9300(at)gmail.com]

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

Subject: {SPAM?} netknowyeg,Information



SGkgLA0KTmV0a25vdyBJbnRlcm5ldCBTZXJ2aWNlDQoNCg0KR2V0IDEwMEsgRm9sbG93ZXJzIElu

c3RhZ3JhbSBOT1csDQpQbGVhc2UgdmlzaXQgdGhlIHdlYiBwYWdlIGJlbG93IENoZWFwZXIuDQoN

ClsgaHR0cHM6Ly9iaXQubHkvaW5zdGFtYXhzaG9wP25ldGtub3d5ZWcgXQ0KDQpEbyB5b3UgaGF2

ZSBhYm91dCBbIExlc3MgdGhhbiAxMDBLIF0gRm9sbG93ZXJzID8NCkluY3JlYXNlIE5vdyAuLiEh

ISBPZmYgNDAlIFRvZGF5Li4uISEhDQoNCi0gSW5zdGFudA0KLSBTYWZlc3QgTWV0aG9kcw0KLSBQ

cml2YWN5IFByb3RlY3Rpb24NCi0gU3BlZWQgNTBLIC0gMTAwSyBGb2xsb3dlcnMvZGF5DQotIEhp

Z2ggUXVhbGl0eSBGb2xsb3dlcnMgJiBSZWFsDQotIERyb3AtQmFjayBHdWFyYW50ZWUNCi0gVHJ1

c3RlZA0KLSBTdGFydGluZyBnZXQgNUsgRm9sbG93ZXJzIEluc3RhZ3JhbQ0KDQooIFRocmVhZHMs

IEluc3RhZ3JhbSwgVHdpdHRlciwgWW91dHViZSwgRmFjZWJvb2ssIGV0Yy4gKQ0KDQoNCg0KVGhh

bmsgeW91LA0KUmVnYXJkcywNCg0KDQpDb3B5cmlnaHQgwqkgMjAxNCAtIDIwMjUgSW5zdGFtZWRp

YVByb01BWC4gQWxsIFJpZ2h0cyBSZXNlcnZlZC4NCg==

I2.40KL0LD36.9KIwhoissourceRank13.0MPIN0Summary reportDiagnosisDensity00n/a

Trackbacks

Trackback specific URI for this entry

This link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.

No Trackbacks

Comments

Display comments as Linear | Threaded

No comments

Add Comment

Enclosing asterisks marks text as bold (*word*), underscore are made via _word_.
Standard emoticons like :-) and ;-) are converted to images.

To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.
CAPTCHA

Enclosing asterisks marks text as bold (*word*), underscore are made via _word_.
Standard emoticons like :-) and ;-) are converted to images.

To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.
CAPTCHA