Instragram followers spam from Google Gmail
Posted by Dave Yadallee onEnvelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Sun, 16 Mar 2025 12:46:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.1 (FreeBSD))
(envelope-from
id 1ttsz0-000000009Cl-0tYr
for dave@doctor.nl2k.ab.ca;
Sun, 16 Mar 2025 12:45:10 -0600
Resent-From: The Doctor
Resent-Date: Sun, 16 Mar 2025 12:45:10 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-qt1-f198.google.com ([209.85.160.198]:50581)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.98.1 (FreeBSD))
(envelope-from
id 1ttsqn-000000000Jo-32r6
for sales@nk.ca;
Sun, 16 Mar 2025 12:36:51 -0600
Received: by mail-qt1-f198.google.com with SMTP id d75a77b69052e-474f079562dso142221991cf.1
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20230601; t=1742150080; x=1742754880; darn=nk.ca;
h=content-transfer-encoding:to:from:subject:date:message-id
:mime-version:from:to:cc:subject:date:message-id:reply-to;
bh=UI5KNLb4pgzuH8VUQNLB9Zrf5xyJkwkfLJi7bX2uhOk=;
b=YQ4tD57MfG363MS5q8pRsmnqtfM9ZCx14lG0T5j3bI6H/h8Zy/hjx5EKmJWwXxTedD
1Os3Je8FmKTZiV79fIllQZOSUNQshNN4ujdLCi4yDp0EEbN4EPns81XyfdoC99cSlxyX
d07ZxPw+IxKiNoOwhzSBdMPGGwHhTw+5PDuULbQglyKkVR8EDZ50kvE+Nie16Gerb+2P
oYqB/g08RWbCpfv46n/vE8Vb/TMPLUHsEaYbMDSerm3nPKsYhddi6RoYjS7cy+TR4kxq
N0rSPzw6Dntz3JIWnHFX8qPCm1BNB2Zddirj3uV3jW9h4tuDR+/sz+Mquv0HQccWFeCu
r8Lg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20230601; t=1742150080; x=1742754880;
h=content-transfer-encoding:to:from:subject:date:message-id
:mime-version:x-gm-message-state:from:to:cc:subject:date:message-id
:reply-to;
bh=UI5KNLb4pgzuH8VUQNLB9Zrf5xyJkwkfLJi7bX2uhOk=;
b=ptUsh75R4k2aH6yAUEe9obuqYG4SHu0dlihyvI9A9ZD4TldSYbGLGu1qRc9p0zvWoe
q8ioajZ7Y4RsbAjjKQCONihjAXf+youykch/aPeEA44SnORhIntkgEyGsUlQ57zAYNWV
oK68zWXp6lF18kO/4Y5I62+PI5bVdiNKDxiuBnafDeThb/W6ULkw7vWTgyRrMe1iqRg4
nYd+Jd+35flHmrarRAuZ03rgmq3fH6fFun+eZZstvGD4EFdOH+hqj3+NEV50CXXRiKrP
VviKlikmIwm3N2BxfmYwG+XG9HyaJ0n0U3RAoQzI916KKBYasMVSEU/WOZvEXn5l/Xld
uopw==
X-Gm-Message-State: AOJu0Yy45CxatxS5qtJlYZ8IQIAilk2tx5rZ+5kOgZ5NCSzpk27967AG
iEClblsM65xJsSc7aTdFkk110akzIzKKcIaP+tAYEpJmRubAjrYX5Ig8Yhvh5ZLKHNNZNdoZANo
=
X-Google-Smtp-Source: AGHT+IEk4cXuIH3OKgLONTrpvW1LWci9+a1x85N+v7Lr8qemY/NDpAt5ejpPzYim2MAJ+paURNYIlr13nA==
MIME-Version: 1.0
X-Received: by 2002:ac8:5a8a:0:b0:476:923a:ca7b with SMTP id
d75a77b69052e-476c812401fmr162030291cf.1.1742150080259; Sun, 16 Mar 2025
11:34:40 -0700 (PDT)
Message-ID:
Date: Sun, 16 Mar 2025 18:34:40 +0000
Subject: netknowyeg,Specials order
From: kakakmella100@gmail.com
To: sales@nk.ca
Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes
Content-Transfer-Encoding: base64
X-Spam_score: 7.2
X-Spam_score_int: 72
X-Spam_bar: +++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Hello, netknowyeg,Specials order Special For You GET 100K
Followers Instagram NOW !!! Order here : [ https://graminsta.shop/store/InstagramFollowers/?Netknow
Internet Service ]
Content analysis details: (7.2 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[209.85.160.198 listed in will-spam-for-food.eu.org]
[209.85.160.198 listed in will-spam-for-food.eu.org]
[209.85.160.198 listed in will-spam-for-food.eu.org]
[209.85.160.198 listed in will-spam-for-food.eu.org]
[209.85.160.198 listed in will-spam-for-food.eu.org]
[209.85.160.198 listed in will-spam-for-food.eu.org]
[209.85.160.198 listed in will-spam-for-food.eu.org]
[209.85.160.198 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[209.85.160.198 listed in dnsbl.ahbl.org]
[209.85.160.198 listed in dnsbl.ahbl.org]
[209.85.160.198 listed in dnsbl.ahbl.org]
[209.85.160.198 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[209.85.160.198 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[209.85.160.198 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[209.85.160.198 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[209.85.160.198 listed in dnsbl.ahbl.org]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.160.198 listed in list.dnswl.org]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)
[209.85.160.198 listed in wl.mailspike.net]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[kakakmella100(at)gmail.com]
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit
[kakakmella100(at)gmail.com]
2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders
Subject: {SPAM?} netknowyeg,Specials order
SGVsbG8sDQpuZXRrbm93eWVnLFNwZWNpYWxzIG9yZGVyDQoNClNwZWNpYWwgRm9yIFlvdQ0KR0VU
IDEwMEsgRm9sbG93ZXJzIEluc3RhZ3JhbSBOT1cgISEhDQpPcmRlciBoZXJlIDoNCg0KWyBodHRw
czovL2dyYW1pbnN0YS5zaG9wL3N0b3JlL0luc3RhZ3JhbUZvbGxvd2Vycy8/TmV0a25vdyBJbnRl
cm5ldCBTZXJ2aWNlICANCl0NCg0KRG8geW91IGhhdmUgYWJvdXQgWyBuZXRrbm93eWVnIF0gRm9s
bG93ZXJzID8NCkRpc2NvdW50IGZvciBhbGwgc2VydmljZXMgNDAlIFRvZGF5Li4uIQ0KSW5jcmVh
c2UgTm93IC4uISEhDQoNCi0gSW5zdGFudCBTdGFydA0KLSBTYWZlc3QgTWV0aG9kcw0KLSBQcml2
YWN5IFByb3RlY3Rpb24NCi0gU3BlZWQgMjAwSyBGb2xsb3dlcnMvZGF5DQotIEhpZ2ggUXVhbGl0
eSBGb2xsb3dlcnMNCi0gRHJvcC1CYWNrIEd1YXJhbnRlZQ0KLSBUcnVzdGVkIFNlbGxlciB0ZXN0
aW1vbnkNCi0gU3RhcnRpbmcgZ2V0IDEwMEsgRm9sbG93ZXJzIEluc3RhZ3JhbQ0KLSBHdWFyYW50
ZWVkIHRvIGJlIHRoZSBjaGVhcGVzdA0KDQpUaGFuayB5b3UsDQpSZWdhcmRzLA0KDQoNCg0KQ29w
eXJpZ2h0IMKpIDIwMTQgLSAyMDI1IGluc3RhbWVkaWFwcm9tYXgNCg==