Instagram followers spam from Google Gmail

Posted by Dave Yadallee on
Return-path:

Envelope-to: sales@nk.ca

Delivery-date: Thu, 02 May 2024 13:42:00 -0600

Received: from mail-yw1-f197.google.com ([209.85.128.197]:56644)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1s2cIx-00000000Ouw-2HfD

for sales@nk.ca;

Thu, 02 May 2024 13:41:23 -0600

Received: by mail-yw1-f197.google.com with SMTP id 00721157ae682-61df903af62so54137237b3.1

for ; Thu, 02 May 2024 12:39:25 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20230601; t=1714678759; x=1715283559; darn=nk.ca;

h=content-transfer-encoding:to:from:subject:date:message-id

:mime-version:from:to:cc:subject:date:message-id:reply-to;

bh=SY+1I/qjfezyBwFATEahr4j/V/f3t/LiUx/L9JjdTcw=;

b=S5BBbIc3GTL0hKTxl/B7sZ7Ejk+7a1qsXDXjtuOJ14BbQPFUIyuPIJsBpJRFLRVn4Z

AAgjegMkdE3vmmjZRHXAzsWBEb/27WRihZUif1hdCmiSL0ixw8VVCYrI9qG8VmDmJ/ZQ

yxv9na7eNdgMATr7UWR+9+2+qxEzHfZJpl+vF4vhKCP0m6dJ5ACU/vAQSm5bCM9pcHOQ

3kEMMxzK/fO1zqUgVXt6Rm3tEmkSbUBzuKBSOMoMr7NelW1Ted9swN25bD9/7dc88rlI

To7rNCWPWwAwfk661ULAsrIk+PZt4wU0TDce0Kruk2/aX5JFMjA53an18JNae+vtVh3s

brjQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1714678759; x=1715283559;

h=content-transfer-encoding:to:from:subject:date:message-id

:mime-version:x-gm-message-state:from:to:cc:subject:date:message-id

:reply-to;

bh=SY+1I/qjfezyBwFATEahr4j/V/f3t/LiUx/L9JjdTcw=;

b=fosL6aMPR8RnIv6i8muBU5C8MqKdnrxxbEx1HG3lKmFa1ygF3m1jb6GD5B2aYdlMcw

YeFiyQaPEjWJ4deuAjkXDGFUe+BNcooNwL6/rqh0ZwGLrUDByzQR8bLg/IsHVq9ZdxHC

bF4OTbqdPtUFDH5+S6fZHHfK4vq7wmgHAgfwLHgV9zw7ngVjQh5riFU0rI7U+BL2SIC9

iGDhXL5hdOrbrs7YqpjV0S9Gu5gElJ0vYiJGireDvQHHRkSy1kX6JCH1tNhfTeIyu1Dp

cRS8s7nbF0Phe64D/CfH/IfopY17EmzY2VKjUVjBuW0QAs198R0RK6iFpx1Ru6o62ThB

dQIQ==

X-Gm-Message-State: AOJu0YxkAH4jSTyNgKo8Y3kp5CeQXLza+qOY4uWsZ3TXu2tlBBykA7zc

kYhWNVOq1VYzLDMQMHb4uDWqSEiGnJvFOjAMUkHwnNQTN+RDd9u7XBapCT+J3rVlFg+luNmhGKw

=

X-Google-Smtp-Source: AGHT+IEJ3fD7J2mPtVUdlKTxNNiHN3qSfEroVt3ja5h+8+pgaenU/zoWNkvSU8y4gAm3v7IU1swsF8d5yg==

MIME-Version: 1.0

X-Received: by 2002:a05:690c:399:b0:610:cd34:439e with SMTP id

bh25-20020a05690c039900b00610cd34439emr587605ywb.49.1714678759219; Thu, 02

May 2024 12:39:19 -0700 (PDT)

Message-ID:

Date: Thu, 02 May 2024 19:39:19 +0000

Subject: netknowyeg,Increase 5K IG Followers here

From: gerrimauuala@gmail.com

To: sales@nk.ca

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes

Content-Transfer-Encoding: base64

X-Spam_score: 10.2

X-Spam_score_int: 102

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi , Netknow Internet Service Get 100K Followers Instagram

NOW ! Please visit the web page below . [ https://linktr.ee/instamediamax?netknowyeg

]



Content analysis details: (10.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.128.197 listed in dnsbl.ahbl.org]

[209.85.128.197 listed in dnsbl.ahbl.org]

[209.85.128.197 listed in dnsbl.ahbl.org]

[209.85.128.197 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.128.197 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.128.197 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.128.197 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.128.197 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.128.197 listed in will-spam-for-food.eu.org]

[209.85.128.197 listed in will-spam-for-food.eu.org]

[209.85.128.197 listed in will-spam-for-food.eu.org]

[209.85.128.197 listed in will-spam-for-food.eu.org]

[209.85.128.197 listed in will-spam-for-food.eu.org]

[209.85.128.197 listed in will-spam-for-food.eu.org]

[209.85.128.197 listed in will-spam-for-food.eu.org]

[209.85.128.197 listed in will-spam-for-food.eu.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

1.3 RCVD_IN_VALIDITY_RPBL RBL: Relay in Validity RPBL,

https://senderscore.org/blocklistlookup/

[209.85.128.197 listed in bl.score.senderscore.com]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.128.197 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.128.197 listed in wl.mailspike.net]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[gerrimauuala(at)gmail.com]

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

1.0 FREEMAIL_REPLY From and body contain different freemails

Subject: {SPAM?} netknowyeg,Increase 5K IG Followers here

X-Antivirus: AVG (VPS 240502-4, 5/2/2024), Inbound message

X-Antivirus-Status: Clean



SGkgLA0KTmV0a25vdyBJbnRlcm5ldCBTZXJ2aWNlDQoNCg0KR2V0IDEwMEsgRm9sbG93ZXJzIElu

c3RhZ3JhbSBOT1cgIQ0KUGxlYXNlIHZpc2l0IHRoZSB3ZWIgcGFnZSBiZWxvdyAuDQoNClsgaHR0

cHM6Ly9saW5rdHIuZWUvaW5zdGFtZWRpYW1heD9uZXRrbm93eWVnIF0NCg0KRG8geW91IGhhdmUg

YWJvdXQgWyA5NTIgXSBGb2xsb3dlcnMgPw0KU3BlY2lhbHMgIGxpbWl0ZWQgIE9mZiA0MCUgVG9k

YXkuLi4hISENCkluY3JlYXNlIE5vdyAuLiEhIQ0KDQotIGluc3RhbnQgcHJvY2Vzcw0KLSBTYWZl

c3QgTWV0aG9kcw0KLSBQcml2YWN5IFByb3RlY3Rpb24NCi0gU3BlZWQgMTAwSyBGb2xsb3dlcnMv

ZGF5DQotIEhpZ2ggUXVhbGl0eSBGb2xsb3dlcnMgJiBSZWFsDQotIERyb3AtQmFjayBHdWFyYW50

ZWUNCi0gVHJ1c3RlZCBTZWxsZXIgdGVzdGltb255DQotIFN0YXJ0aW5nIGdldCA1SyBGb2xsb3dl

cnMgSW5zdGFncmFtDQotIEd1YXJhbnRlZWQgdG8gYmUgdGhlIGNoZWFwZXN0DQoNClRoYW5rIHlv

dSwNClJlZ2FyZHMsDQpzb2NpYWxpbnN0YW1heEBnbWFpbC5jb20NCg0KQ29weXJpZ2h0IMKpIDIw

MTQgLSAyMDI1IEluc3RhbWVkaWFNQVguIEFsbCBSaWdodHMgUmVzZXJ2ZWQuDQo=

Trackbacks

Trackback specific URI for this entry

This link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.

No Trackbacks

Comments

Display comments as Linear | Threaded

No comments

Add Comment

Enclosing asterisks marks text as bold (*word*), underscore are made via _word_.
Standard emoticons like :-) and ;-) are converted to images.

To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.
CAPTCHA

Enclosing asterisks marks text as bold (*word*), underscore are made via _word_.
Standard emoticons like :-) and ;-) are converted to images.

To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.
CAPTCHA