Menu
Reply
Highlighted
  • 426
  • 14
  • 46
Fibre optic
911 Views
Message 31 of 58
Flag for a moderator

Re: Receiving old Emails

 

It's been suggested that these are old spam emails originally sent on the 26/07/19 being resent. However I have just received one entitled "Special offer for Black Friday", to do with a high street store gift card, which suggests to me that its current.

0 Kudos
Reply
Highlighted
  • 18.6K
  • 1.09K
  • 8K
Very Insightful Person
Very Insightful Person
896 Views
Message 32 of 58
Flag for a moderator

Re: Receiving old Emails

Why don't you read the headers for yourself.

Here's one I had:

Return-Path: <qsnwvqywxankgfe61513g@icloud.com>
Delivered-To: myaddress@blueyonder.co.uk
Received: from md10.tb.ukmail.iss.local ([212.54.57.68])
	by mc8.tb.ukmail.iss.local with LMTP id SD+pAQl01l0NaQAAVqD7fw
	for <myaddress@blueyonder.co.uk>; Thu, 21 Nov 2019 12:24:57 +0100
Received: from smtpclienthelo ([212.54.57.68])
	by md10.tb.ukmail.iss.local with LMTP id MBcCJQh01l1nBQAAnwjGaw
	; Thu, 21 Nov 2019 12:24:57 +0100
Authentication-Results: ukmail.iss.as9143.net;
 spf=softfail (139.99.210.35;icloud.com);
 dkim=fail header.d=secondstreetmail.com (signature verification failed);
 dmarc=none header.from=tribbmvpw.com (dis=no_record);
X-Env-Mailfrom: qsnwvqywxankgfe61513g@icloud.com
X-Env-Rcptto: myaddress@blueyonder.co.uk
X-SourceIP: 139.99.210.35
X-CNFS-Analysis: v=2.3 cv=cJCeTWWN c=1 sm=1 tr=0 cx=a_idp_d
 a=2632wEr23gZEmZ0Khz+QQg==:117 a=2632wEr23gZEmZ0Khz+QQg==:17
 a=IkcTkHD0fZMA:10 a=0o9FgrsRnhwA:10 a=8KdYJt9WxkgA:10 a=BxqbEYVhHxkA:10
 a=YdHkc8AeAAAA:8 a=ahIOzXzBGzZcxZIE5qgA:9 a=XoLZAW8Dr3sSJhOV:21
 a=frz4AuCg-hUA:10 a=_W_S_7VecoQA:10 a=QEXdDO2ut3YA:10 a=-FEs8UIgK8oA:10
 a=NWVoK91CQyQA:10 a=MJ0OcRSNrvWSIU-ZXB9m:22
Received: from turn-girlmaybe.org ([139.99.210.35])
	by mx1.tb.ukmail.iss.as9143.net with ESMTP
	id XkUSinIye3aVYXkV5iLeLx; Thu, 21 Nov 2019 12:19:52 +0100
Return-Path: <headlines@triblive.com>
Delivered-To: 0D5u27Z90HyxBqQ@comcast.net
Received: from dovdir1-asb-05o.email.comcast.net ([96.114.154.181])    6d7242eb83c1e7a47de48e21c6757765
	by dovback1-asb-21o.email.comcast.net with LMTP id 0ICZM+sGO13mPQAADPwQFg
	for <0D5u27Z90HyxBqQ@comcast.net>; Fri, 26 Jul 2019 13:58:04 +0000
Received: from dovpxy-asc-11o.email.comcast.net ([96.114.154.181])
	by dovdir1-asb-05o.email.comcast.net with LMTP id INBZM+sGO13GNwAA4zo6kw
	; Fri, 26 Jul 2019 13:58:04 +0000
Received: from resimta-po-34v.sys.comcast.net ([96.114.154.181])      6d7242eb83c1e7a47de48e21c6757765      
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	by dovpxy-asc-11o.email.comcast.net with LMTP id KFyGMeMGO136GgAAQOHv/A
	; Fri, 26 Jul 2019 13:58:03 +0000
Received: from mail211.secondstreetmail.com ([168.245.151.211])
	by resimta-po-34v.sys.comcast.net with ESMTP
	id r0J4hr7u5t7SUr0jBhg1c0; Fri, 26 Jul 2019 13:57:51 +0000
X-CAA-SPAM: F00000
X-Xfinity-VAAS: gggruggvucftvghtrhhoucdtuddrgeduvddrkeeggdejudcutefuodetggdotefrodftvfcurfhrohhfihhlvgemucevohhmtggrshhtqdftvghsihenuceurghilhhouhhtmecufedttdenucdnofetkffnkffpifculddujedmnecujfgurhepphforhfhvffkfffugggtsegrtderreertdejnecuhfhrohhmpedfvfhrihgsnffkggfgucfjvggrughlihhnvghsfdcuoehhvggrughlihhnvghssehtrhhisghlihhvvgdrtghomheqnecuffhomhgrihhnpehsvggtohhnughsthhrvggvthgrphhprdgtohhmnecukfhppeduieekrddvgeehrdduhedurddvuddunecurfgrrhgrmhephhgvlhhopehmrghilhdvuddurdhsvggtohhnughsthhrvggvthhmrghilhdrtghomhdpihhnvghtpeduieekrddvgeehrdduhedurddvuddupdhmrghilhhfrhhomhephhgvrggulhhinhgvshesthhrihgslhhivhgvrdgtohhmpdhrtghpthhtohepthgrthhirghnrghmtggtrggsvgestghomhgtrghsthdrnhgvthenucevlhhushhtvghrufhiiigvpedt
X-Xfinity-CCat: promotional
X-Xfinity-VMeta: sc=17;st=mce
X-Xfinity-Message-Heuristics: IPv6:N;TLS=1;SPF=1;DMARC=
Authentication-Results: resimta-po-34v.sys.comcast.net;
	dkim=pass header.d=secondstreetmail.com header.i=@secondstreetmail.com
 header.b=MDNLuc00
domainkey-signature: a=rsa-sha1; c=nofws; s=ssm; d=secondstreetmail.com; q=dns; 
	h=reply-to:from:to:message-id:date:subject:mime-version:content-type; 
	b=nuudvFvrq/gCD3f7ZKX+53voJbSi3OLC7ww/sgJLNxd/nrAMV3P2nH4j+b3cGycxBX4Q4Sqp6vWA8WIJ6NTUk6JZnAUnxptyLpoeQFBjb4L3I+HhAJOGnSfjzVK8CY9R3xTi38ZxAPtOZuxNKECC4637QWwTPUAES3IR2l+Yu73DZ4a8SsSoEFGcHqBEC15PEt7n9rbh7AumY/vKnV/XbhulxgV4vTxcDDp6wfOyYCHiEaYinXPyAjvJyL+GZMW3xvBqksXNTV5IitSn7jq9g5/DfG5A1Urskqzqc+M/4a8toCccku7o7IkEvsC9IPAa1Qp8zGMIkdFoUY03Wp5HQQ==;
DKIM-Signature: v=1; a=rsa-sha256; d=secondstreetmail.com;i=@secondstreetmail.com;s=ssm;
	c=relaxed/relaxed; q=dns/txt; t=1564149471;
	h=content-type:mime-version:subject:date:message-id:to:from:reply-to:x-feedback-id;
	bh=3a+R7kLaTfbM7Ki7NNR3uZ7OcvCmwIUo5WqdQX0EsKk=;
	b=MDNLuc00SnDmriU1mvJ7NG2bhvpiUe1sFPaGxEJ4AwYLGJNC4Vw80c4mLSVvbalIXWm7r1Fs4vAELRJ9yJpK2ejbfc9T3to1rA5YdLIXlZMZlvB/6sKUB7FO4anEIhU4p4FyB2ws4moAADvdg9Ld6pIIJvqx/SW6UsuNUEOq1qSHS7c65AUYCgWSzIaBYeSR406K47RkFxkoWB+9VOW5rN0fFW1e/O8ESjb7IinJ1lLZljpw31bTRGIB85xTpCHRK6aUAcJFhoI35jzMM2GHIdpDZPIvFO4B9IeIq9G3akqObn9wZMsG8BY903RAhtESL+bqkiGfLGcw7Ma/PXq99A==
Precedence: bulk
X-Mailer: Second Street Mail (https://secondstreet.com)
X-Feedback-ID: 1193943:M1909367:batch:2ndStreetMail
From: Black Friday deal  <headlines@tribbmvpw.com>
To: "Tim Dutton" <0D5u27Z90HyxBqQ@comcast.net>
Message-ID: <144522@EBlastEngine.com>
Date: Fri, 26 Jul 2019 06:00:32 -0500
Subject: Tim Dutton, your Primark shopping voucher is waiting for you!
MIME-Version: 1.0
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: 7bit

Lets take a look at each part.

First the headers that are part of the mail itself.

From: Black Friday deal  <headlines@tribbmvpw.com>
To: "Tim Dutton" <0D5u27Z90HyxBqQ@comcast.net>
Message-ID: <144522@EBlastEngine.com>
Date: Fri, 26 Jul 2019 06:00:32 -0500
Subject: Tim Dutton, your Primark shopping voucher is waiting for you!
MIME-Version: 1.0
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: 7bit

Now all of these could actually be spoofed.  However I have reason to believe that the mail was originally sent to a comcast.net address and then subsequently lifted from the comcast server and modified.

Why?  Well lets take a look at the first set of delivery headers.  We work from the bottom up.

Delivered-To: 0D5u27Z90HyxBqQ@comcast.net
Received: from dovdir1-asb-05o.email.comcast.net ([96.114.154.181])    6d7242eb83c1e7a47de48e21c6757765
	by dovback1-asb-21o.email.comcast.net with LMTP id 0ICZM+sGO13mPQAADPwQFg
	for <0D5u27Z90HyxBqQ@comcast.net>; Fri, 26 Jul 2019 13:58:04 +0000
Received: from dovpxy-asc-11o.email.comcast.net ([96.114.154.181])
	by dovdir1-asb-05o.email.comcast.net with LMTP id INBZM+sGO13GNwAA4zo6kw
	; Fri, 26 Jul 2019 13:58:04 +0000
Received: from resimta-po-34v.sys.comcast.net ([96.114.154.181])      6d7242eb83c1e7a47de48e21c6757765      
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	by dovpxy-asc-11o.email.comcast.net with LMTP id KFyGMeMGO136GgAAQOHv/A
	; Fri, 26 Jul 2019 13:58:03 +0000
Received: from mail211.secondstreetmail.com ([168.245.151.211])
	by resimta-po-34v.sys.comcast.net with ESMTP
	id r0J4hr7u5t7SUr0jBhg1c0; Fri, 26 Jul 2019 13:57:51 +0000
X-CAA-SPAM: F00000
X-Xfinity-VAAS: gggruggvucftvghtrhhoucdtuddrgeduvddrkeeggdejudcutefuodetggdotefrodftvfcurfhrohhfihhlvgemucevohhmtggrshhtqdftvghsihenuceurghilhhouhhtmecufedttdenucdnofetkffnkffpifculddujedmnecujfgurhepphforhfhvffkfffugggtsegrtderreertdejnecuhfhrohhmpedfvfhrihgsnffkggfgucfjvggrughlihhnvghsfdcuoehhvggrughlihhnvghssehtrhhisghlihhvvgdrtghomheqnecuffhomhgrihhnpehsvggtohhnughsthhrvggvthgrphhprdgtohhmnecukfhppeduieekrddvgeehrdduhedurddvuddunecurfgrrhgrmhephhgvlhhopehmrghilhdvuddurdhsvggtohhnughsthhrvggvthhmrghilhdrtghomhdpihhnvghtpeduieekrddvgeehrdduhedurddvuddupdhmrghilhhfrhhomhephhgvrggulhhinhgvshesthhrihgslhhivhgvrdgtohhmpdhrtghpthhtohepthgrthhirghnrghmtggtrggsvgestghomhgtrghsthdrnhgvthenucevlhhushhtvghrufhiiigvpedt
X-Xfinity-CCat: promotional
X-Xfinity-VMeta: sc=17;st=mce
X-Xfinity-Message-Heuristics: IPv6:N;TLS=1;SPF=1;DMARC=
Authentication-Results: resimta-po-34v.sys.comcast.net;
	dkim=pass header.d=secondstreetmail.com header.i=@secondstreetmail.com
 header.b=MDNLuc00
domainkey-signature: a=rsa-sha1; c=nofws; s=ssm; d=secondstreetmail.com; q=dns; 
	h=reply-to:from:to:message-id:date:subject:mime-version:content-type; 
	b=nuudvFvrq/gCD3f7ZKX+53voJbSi3OLC7ww/sgJLNxd/nrAMV3P2nH4j+b3cGycxBX4Q4Sqp6vWA8WIJ6NTUk6JZnAUnxptyLpoeQFBjb4L3I+HhAJOGnSfjzVK8CY9R3xTi38ZxAPtOZuxNKECC4637QWwTPUAES3IR2l+Yu73DZ4a8SsSoEFGcHqBEC15PEt7n9rbh7AumY/vKnV/XbhulxgV4vTxcDDp6wfOyYCHiEaYinXPyAjvJyL+GZMW3xvBqksXNTV5IitSn7jq9g5/DfG5A1Urskqzqc+M/4a8toCccku7o7IkEvsC9IPAa1Qp8zGMIkdFoUY03Wp5HQQ==;
DKIM-Signature: v=1; a=rsa-sha256; d=secondstreetmail.com;i=@secondstreetmail.com;s=ssm;
	c=relaxed/relaxed; q=dns/txt; t=1564149471;
	h=content-type:mime-version:subject:date:message-id:to:from:reply-to:x-feedback-id;
	bh=3a+R7kLaTfbM7Ki7NNR3uZ7OcvCmwIUo5WqdQX0EsKk=;
	b=MDNLuc00SnDmriU1mvJ7NG2bhvpiUe1sFPaGxEJ4AwYLGJNC4Vw80c4mLSVvbalIXWm7r1Fs4vAELRJ9yJpK2ejbfc9T3to1rA5YdLIXlZMZlvB/6sKUB7FO4anEIhU4p4FyB2ws4moAADvdg9Ld6pIIJvqx/SW6UsuNUEOq1qSHS7c65AUYCgWSzIaBYeSR406K47RkFxkoWB+9VOW5rN0fFW1e/O8ESjb7IinJ1lLZljpw31bTRGIB85xTpCHRK6aUAcJFhoI35jzMM2GHIdpDZPIvFO4B9IeIq9G3akqObn9wZMsG8BY903RAhtESL+bqkiGfLGcw7Ma/PXq99A==
Precedence: bulk
X-Mailer: Second Street Mail (https://secondstreet.com)
X-Feedback-ID: 1193943:M1909367:batch:2ndStreetMail

 Of importance here is this line

Authentication-Results: resimta-po-34v.sys.comcast.net;
	dkim=pass header.d=secondstreetmail.com header.i=@secondstreetmail.com
 header.b=MDNLuc00

Note: for DKIM to pass the body, DKIM header and fields specified in the DKIM header cannot be altered.  So when the mail was received at the Comcast server, it was intact.

Note: the dates on each received line:

Fri, 26 Jul 2019 13:57:51 +0000

Finally we see this part:

Return-Path: <headlines@triblive.com>
Delivered-To: 0D5u27Z90HyxBqQ@comcast.net

Which always appears at the end of an email chain.

Reading upwards then we suddenly see this:

Return-Path: <qsnwvqywxankgfe61513g@icloud.com>
Delivered-To: myaddress@blueyonder.co.uk
Received: from md10.tb.ukmail.iss.local ([212.54.57.68])
	by mc8.tb.ukmail.iss.local with LMTP id SD+pAQl01l0NaQAAVqD7fw
	for <myaddress@blueyonder.co.uk>; Thu, 21 Nov 2019 12:24:57 +0100
Received: from smtpclienthelo ([212.54.57.68])
	by md10.tb.ukmail.iss.local with LMTP id MBcCJQh01l1nBQAAnwjGaw
	; Thu, 21 Nov 2019 12:24:57 +0100
Authentication-Results: ukmail.iss.as9143.net;
 spf=softfail (139.99.210.35;icloud.com);
 dkim=fail header.d=secondstreetmail.com (signature verification failed);
 dmarc=none header.from=tribbmvpw.com (dis=no_record);
X-Env-Mailfrom: qsnwvqywxankgfe61513g@icloud.com
X-Env-Rcptto: myaddress@blueyonder.co.uk
X-SourceIP: 139.99.210.35
X-CNFS-Analysis: v=2.3 cv=cJCeTWWN c=1 sm=1 tr=0 cx=a_idp_d
 a=2632wEr23gZEmZ0Khz+QQg==:117 a=2632wEr23gZEmZ0Khz+QQg==:17
 a=IkcTkHD0fZMA:10 a=0o9FgrsRnhwA:10 a=8KdYJt9WxkgA:10 a=BxqbEYVhHxkA:10
 a=YdHkc8AeAAAA:8 a=ahIOzXzBGzZcxZIE5qgA:9 a=XoLZAW8Dr3sSJhOV:21
 a=frz4AuCg-hUA:10 a=_W_S_7VecoQA:10 a=QEXdDO2ut3YA:10 a=-FEs8UIgK8oA:10
 a=NWVoK91CQyQA:10 a=MJ0OcRSNrvWSIU-ZXB9m:22
Received: from turn-girlmaybe.org ([139.99.210.35])
	by mx1.tb.ukmail.iss.as9143.net with ESMTP
	id XkUSinIye3aVYXkV5iLeLx; Thu, 21 Nov 2019 12:19:52 +0100

Now this shows Virgin Media's server receiving the mail from a non Comcast server.

Lets look at the authentication results again:

Authentication-Results: ukmail.iss.as9143.net;
 spf=softfail (139.99.210.35;icloud.com);
 dkim=fail header.d=secondstreetmail.com (signature verification failed);

Well we see the sender address is different to the From: address.  More importantly we wee a DKIM fail.

This means that in between arriving at the Comcast server and being re-sent to my address, something has changed.  Certainly It's no big stretch to assume that at least one of the changes is the From: address - especially as the display part reads "Black Friday Deal"  As well as some changes to the body to make it relevant.

Looking at the server domain - turn-girlmaybe.org does not exist.

This particular server appears to be hosted with OVH

IP:	139.99.210.35
Decimal:	2338574883
Hostname:	ns569095.ip-139-99-210.net
ASN:	16276
ISP:	OVH Hosting
Organization:	OVH Hosting

However similar mails are also coming from AWS servers as well.

Note the dates on the second send:

Thu, 21 Nov 2019 12:24:57 +0100

Outlook and other mail clients use the Date: header to display the date in the mail, although they will show the date received in the folder list.

outlookspam.PNG

The folder list shows that the mail was received today even though the date on the mail itself is still reading July 26th

Tim

I'm a Very Insightful Person, I'm here to share knowledge, I don't work for Virgin Media. Learn more

Have I helped? Click Mark as Helpful Answer or use Kudos to say thanks

Highlighted
  • 3
  • 0
  • 1
Tuning in
872 Views
Message 33 of 58
Flag for a moderator

Re: Receiving old Emails

Yes.

Black Friday deal received but also a group of 26 July emails marked as read.

Thank you for stripping the email info down but what does it mean. How do we stop them?

Thank you.

Best wishes

Al

0 Kudos
Reply
Highlighted
  • 426
  • 14
  • 46
Fibre optic
830 Views
Message 34 of 58
Flag for a moderator

Re: Receiving old Emails

 

It's being looked into.

0 Kudos
Reply
Highlighted
  • 4
  • 0
  • 0
Joining in
804 Views
Message 35 of 58
Flag for a moderator

Re: Receiving old Emails

Hi Forum team

I did set up a filter but not exactly as suggested. I went for;-

Condition - Set date - Is exactly - 26/7/2019

Actions - File into - Select folder - Trash

I had to set up a second rule as I have just started to get emails dated 23/4/2019 as well. I hope they don't start to change their prefered date to often as I will need to keep setting rules. Is it possible to set a rule for "Condition - Set date - Prior to - one week ago or similar" & would that remove existing emails or just new ones?

Thanks John

 
0 Kudos
Reply
Highlighted
  • 5.18K
  • 578
  • 1.83K
Very Insightful Person
Very Insightful Person
788 Views
Message 36 of 58
Flag for a moderator

Re: Receiving old Emails


@jf012b4318 wrote:

I had to set up a second rule as I have just started to get emails dated 23/4/2019 as well. I hope they don't start to change their prefered date to often as I will need to keep setting rules. Is it possible to set a rule for "Condition - Set date - Prior to - one week ago or similar" & would that remove existing emails or just new ones?

The spamming process is automated so it is likely the date will change; if you find yourself handling more than a handful of misidentified emails with filter rules on a regular basis then it is probably time to look for a new email service provider.

There is no such condition and filter rules are not retrospective.

0 Kudos
Reply
Highlighted
  • 35
  • 0
  • 1
Tuning in
712 Views
Message 37 of 58
Flag for a moderator

Re: Receiving old Emails

headers251119.jpgI have been receiving these too, these are the headers for the ones that arrived today

0 Kudos
Reply
Highlighted
  • 35
  • 0
  • 1
Tuning in
734 Views
Message 38 of 58
Flag for a moderator

Re: Receiving old Emails

I have been receiving these too, here are the headers from today's.headers251119.jpg

0 Kudos
Reply
Highlighted
  • 5.18K
  • 578
  • 1.83K
Very Insightful Person
Very Insightful Person
727 Views
Message 39 of 58
Flag for a moderator

Re: Receiving old Emails

Create a filter rule with a regular expression (Regex) matching condition of Jamesf.*comcast.net to filter these messages.

0 Kudos
Reply
Highlighted
  • 230
  • 7
  • 132
Superfast
699 Views
Message 40 of 58
Flag for a moderator

Re: Receiving old Emails

I'm also getting a stream of emails similar to these. Here's a header from one recent example (my email edited out)...

Return-Path: &lt;vijbobagcpdqx77872f@icloud.com&gt;
Delivered-To: my.email@ntlworld.com
Received: from md7.tb.ukmail.iss.local ([212.54.57.72])
 by mc46.tb.ukmail.iss.local with LMTP id mI+/BArG2125GQAANm/VTw
 for &lt;my.email@ntlworld.com&gt;; Mon, 25 Nov 2019 13:16:10 +0100
Received: from smtpclienthelo ([212.54.57.72])
 by md7.tb.ukmail.iss.local with LMTP id yMKyCAnG211dBQAAKMCudg
 ; Mon, 25 Nov 2019 13:16:10 +0100
Authentication-Results: ukmail.iss.as9143.net;
 spf=softfail (45.56.166.12;icloud.com);
 dkim=fail header.d=secondstreetmail.com (signature verification failed);
 dmarc=fail header.from=hokdmt.latimes.com (p=none sp=none dis=monitor);
X-Env-Mailfrom: vijbobagcpdqx77872f@icloud.com
X-Env-Rcptto: my.email@ntlworld.com
X-SourceIP: 45.56.166.12
X-CNFS-Analysis: v=2.3 cv=M+4z1B4s c=1 sm=1 tr=0 cx=a_idp_d
 a=AjLRJP3c3YZwB8p27Y2O6Q==:117 a=AjLRJP3c3YZwB8p27Y2O6Q==:17
 a=IkcTkHD0fZMA:10 a=0o9FgrsRnhwA:10 a=8KdYJt9WxkgA:10 a=BxqbEYVhHxkA:10
 a=ahJGfKD2AAAA:8 a=-RgF3vYmXuG2igedFnYA:9 a=h0Mvd5NLqPyXipwI:21
 a=_W_S_7VecoQA:10 a=QEXdDO2ut3YA:10 a=_DqyLHTs3AUA:10 a=-FEs8UIgK8oA:10
 a=NWVoK91CQyQA:10 a=hT597QTedlWboT8Vr5Ya:22 a=pHzHmUro8NiASowvMSCR:22
 a=xoEH_sTeL_Rfw54TyV31:22
Received: from head0executivebad.de ([45.56.166.12])
 by mx5.tb.ukmail.iss.as9143.net with ESMTP
 id ZDCqiZRYlRKqoZDCqiAooc; Mon, 25 Nov 2019 13:11:05 +0100
Return-Path: &lt;headlines@hokdmt.latimes.com&gt;
Delivered-To: J63j3utETMYvJ4B@comcast.net
Received: from dovdir1-asb-05o.email.comcast.net 
([96.114.154.181])J63j3utETMYvJ4B
 by dovback1-asb-21o.email.comcast.net with LMTP id 0ICZM+sGO13mPQAADPwQFg
 for &lt;J63j3utETMYvJ4B@comcast.net&gt;; Fri, 26 Jul 2019 13:58:04 +0000
Received: from dovpxy-asc-11o.email.comcast.net ([96.114.154.181])
 by dovdir1-asb-05o.email.comcast.net with LMTP id INBZM+sGO13GNwAA4zo6kw
 ; Fri, 26 Jul 2019 13:58:04 +0000
Received: from resimta-po-34v.sys.comcast.net ([96.114.154.181]) 
5050fb5e4e175998834b5b10366605c6
 (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
 by dovpxy-asc-11o.email.comcast.net with LMTP id KFyGMeMGO136GgAAQOHv/A
 ; Fri, 26 Jul 2019 13:58:03 +0000
Received: from mail211.secondstreetmail.com ([168.245.151.211])
 by resimta-po-34v.sys.comcast.net with ESMTP
 id r0J4hr7u5t7SUr0jBhg1c0; Fri, 26 Jul 2019 13:57:51 +0000
X-CAA-SPAM: F00000
X-Xfinity-VAAS: 
gggruggvucftvghtrhhoucdtuddrgeduvddrkeeggdejudcutefuodetggdotefrodftvfcurfhrohhfihhlvgemucevohhmtggrshhtqdftvghsihenuceurghilhhouhhtmecufedttdenucdnofetkffnkffpifculddujedmnecujfgurhepphforhfhvffkfffugggtsegrtderreertdejnecuhfhrohhmpedfvfhrihgsnffkggfgucfjvggrughlihhnvghsfdcuoehhvggrughlihhnvghssehtrhhisghlihhvvgdrtghomheqnecuffhomhgrihhnpehsvggtohhnughsthhrvggvthgrphhprdgtohhmnecukfhppeduieekrddvgeehrdduhedurddvuddunecurfgrrhgrmhephhgvlhhopehmrghilhdvuddurdhsvggtohhnughsthhrvggvthhmrghilhdrtghomhdpihhnvghtpeduieekrddvgeehrdduhedurddvuddupdhmrghilhhfrhhomhephhgvrggulhhinhgvshesthhrihgslhhivhgvrdgtohhmpdhrtghpthhtohepthgrthhirghnrghmtggtrggsvgestghomhgtrghsthdrnhgvthenucevlhhushhtvghrufhiiigvpedt
X-Xfinity-CCat: promotional
X-Xfinity-VMeta: sc=17;st=mce
X-Xfinity-Message-Heuristics: IPv6:N;TLS=1;SPF=1;DMARC=
Authentication-Results: resimta-po-34v.sys.comcast.net;
 dkim=pass header.d=secondstreetmail.com header.i=@secondstreetmail.com
 header.b=MDNLuc00
domainkey-signature: a=rsa-sha1; c=nofws; s=ssm; d=secondstreetmail.com; q=dns;
 h=reply-to:from:to:message-id:date:subject:mime-version:content-type;
 
b=nuudvFvrq/gCD3f7ZKX+53voJbSi3OLC7ww/sgJLNxd/nrAMV3P2nH4j+b3cGycxBX4Q4Sqp6vWA8WIJ6NTUk6JZnAUnxptyLpoeQFBjb4L3I+HhAJOGnSfjzVK8CY9R3xTi38ZxAPtOZuxNKECC4637QWwTPUAES3IR2l+Yu73DZ4a8SsSoEFGcHqBEC15PEt7n9rbh7AumY/vKnV/XbhulxgV4vTxcDDp6wfOyYCHiEaYinXPyAjvJyL+GZMW3xvBqksXNTV5IitSn7jq9g5/DfG5A1Urskqzqc+M/4a8toCccku7o7IkEvsC9IPAa1Qp8zGMIkdFoUY03Wp5HQQ==;
DKIM-Signature: v=1; a=rsa-sha256; 
d=secondstreetmail.com;i=@secondstreetmail.com;s=ssm;
 c=relaxed/relaxed; q=dns/txt; t=1564149471;
 
h=content-type:mime-version:subject:date:message-id:to:from:reply-to:x-feedback-id;
 bh=3a+R7kLaTfbM7Ki7NNR3uZ7OcvCmwIUo5WqdQX0EsKk=;
 
b=MDNLuc00SnDmriU1mvJ7NG2bhvpiUe1sFPaGxEJ4AwYLGJNC4Vw80c4mLSVvbalIXWm7r1Fs4vAELRJ9yJpK2ejbfc9T3to1rA5YdLIXlZMZlvB/6sKUB7FO4anEIhU4p4FyB2ws4moAADvdg9Ld6pIIJvqx/SW6UsuNUEOq1qSHS7c65AUYCgWSzIaBYeSR406K47RkFxkoWB+9VOW5rN0fFW1e/O8ESjb7IinJ1lLZljpw31bTRGIB85xTpCHRK6aUAcJFhoI35jzMM2GHIdpDZPIvFO4B9IeIq9G3akqObn9wZMsG8BY903RAhtESL+bqkiGfLGcw7Ma/PXq99A==
Precedence: bulk
X-Mailer: Second Street Mail (https://secondstreet.com)
X-Feedback-ID: 1193943:M1909367:batch:2ndStreetMail
From: Free Life Insurance Quotes &lt;headlines@hokdmt.latimes.com&gt;
To: &quot;Dr Booth&quot; &lt;J63j3utETMYvJ4B@comcast.net&gt;
Message-ID: &lt;297984@EBlastEngine.com&gt;
Date: Fri, 26 Jul 2019 06:00:32 -0500
Subject: Get Up To &Atilde;&#130;&Acirc;&pound; 220,880 Life Insurance From Only &Atilde;&#130;&Acirc;&pound; 10 per month
MIME-Version: 1.0
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: 7bit
X-CMAE-Envelope: 
MS4wfIzYphcoSSzCRHKSIgexRw23lFmW5UVK09FBsRNwkkekQ2jnqPIyh+JkWAbkxKfm0i75jIin2qRcwkH7GDBd7OrjPEe+0sZ8eeGKqXwWRAOK3Ah+PNKl
 
Y+5197b5eBwXIuXejYez1sEfruTffF7zVhj8K4WqgLeTRGj12bkHq7qmGsjZyUkoK3h8y/0vxRyEHbNwkmdAv+LOwC3bD1s2Hqk=


--- Forwarded message ---
From: Free Life Insurance Quotes headlines@hokdmt.latimes.com
Date: 25 November 2019 12:16:10 pm
Subject: Get Up To &Acirc;&pound; 220,880 Life Insurance From Only &Acirc;&pound; 10 per month
To: Dr Booth J63j3utETMYvJ4B@comcast.net



Save Your Money Yoday! Get Up To &Acirc;&pound;220,880 Life Insurance From Only &Acirc;&pound;10 per 
month!


You may unsubscribe at any time. Unsubscribe
Physical Address
3201 W Hillsborough Ave
Ste 153201-1212
Tampa, FL 33684



The advertiser does not manage your subscription.
If you prefer not to receive further communication please unsubscribe  here
Or write to: PO Box 34407, Little Rock, Arkansas, 72203-4407

bydoO6UZi91Yoq5hj0r0TJeV6 UX2E124hpKi73Pswa2WiRybUSfi36t 
u92dq7q4lupfktST9Jg hece5I9H2b6NDiMlJaOX4be27b 
M1C895xctWcwXWRqSB81OFA1jn76m8Key6yA7 386I57SsN140951a0T5dxeJYVVJ1fo46LsClx 
oD2X7o3XkHWI1UWx68KV57a66cduxSpv8w8t1Q9h 18R3mo8KSbB5oERU5A97xr8LQbHmPIZRm 
kLTC8r2Pt521b8x7E3alaq6 4zyt3xMdU40fEcm3WDj0OUY8Q760N19BFI 54zCkvfJdR65JUE 
q5gwOc6T54rECT 3x97NcH9J5HPp4a5n9S5f2k4eMIntOQ ANy0Fi454dBK9 fLGjP8Zm4PpBHy 
wWg3Y4tbX6sOLUtMG261v7Hg5 3R9EgwQ7rtf30ZG8KjV2Y046JS5x5c7 
Vs2ssP2wm6gb9kUwrV oLMCw2Jaj0n0ov KUvvRa1l83T3H dgLP0F6g2Pw9u643rELu5u 
SIe1j5lSvvEZGEcvN1qE ZHOgdxw3h575Cvv70p17A6Fydq 72rJ1a3I02dVk91zAb6 
8s5w2f7617UX 8zf48ZQmHgRQV311 7my8B5jp4N69fETB gK5js334O5NDhD1U8Y6zS8Y 
4sxTsL0UD1QsWg j3Tbkr02d194 90vB1cJu4izkwly7Oxey cZflnK240Qyyeyi8 
ZKuIH7C94VK3uA8 IkKX7d4hIkxc BUXpn7vT1Ip 2BRR0mXCsfyJ2o VS4F8vvEr1vz 
Gn7g0cHkYGV T7wUtm0Nl7xQ YN8LNm1XKg4

 There's plenty of others I've been receiving lately -Trib° being commonly seen in lots of alleged sender addresses. I'll forward them on privately and unedited, if required.

I'm also trying to get to the bottom of reporting issues (multiple bounces involved in the spam with difficulty identifying the line relevant to reporting to SpamCop) with this & other recent spam emails via SpamCop, here -

http://forum.spamcop.net/topic/29869-no-source-ip-address-found-cannot-proceed/

 

0 Kudos
Reply