How did this email get delivered?

keat63

• September 03, 2019 08:21

Any ideas how this got delievered. It has no from addres, and an incomplete reply to address. Although my spam filters pulled it, how did the server accept it in the first place ? How did it even make it from the sending server. ? Received: from [188.241.xx.xxx] (port=33339 helo=smtp-out.amazonses.com) by myhost.myserver.co.uk with esmtp (Exim 4.92) id 1i56qu-0006QU-QL for me@mydomain.co.uk; Tue, 03 Sep 2019 12:20:00 +0100 From:Green Gold Reply-To: <@investinyou.club> Sender: <*************-------------------------------------- ---------------------------************* > To: "ezfz" X-MSGID: bcdedcj6t Subject: OMG! Cannabis stocks are the way to go in 2019! Be the first to gain from this trend!.. Feedback-ID: bkzcf3saiwjn-2:1:Mailrelay List-Unsubscribe: , List-Unsubscribe: X-Message-Flag: Flag for follow up Content-Transfer-Encoding: 7bit Content-Type: text/html;

SpamAssassin Score	27.42
BAYES_80	4.20	Bayes spam probability is 80 to 95%
BODY_URI_ONLY	1.00	Message body is only a URI in one line of text or for an image
CONTAINS_UNSUBSCRIBE	3.50
DCC_CHECK	2.50	Detected as bulk mail by DCC (dcc-servers.net)
DIGEST_MULTIPLE	0.29	Message hits more than one network digest check
FROM_ADDR_WS	3.00	Malformed From address
HTML_IMAGE_ONLY_12	2.06	HTML: images with 800-1200 bytes of words
HTML_MESSAGE	0.00	HTML included in message
HTML_SHORT_LINK_IMG_1	0.00	HTML is very short with a linked image
KAM_SHORT	0.00	Use of a URL Shortener for very short URL
KAM_STOCKG	3.00	Graphical Pump and Dump Scams
LIST_PARTIAL_SHORT_MSG	2.50	Incomplete mailing list headers + short message
MIME_HTML_ONLY	0.10	Message only has text/html MIME parts
MISSING_DATE	1.36	Missing Date: header
PYZOR_CHECK	1.79	Listed in Pyzor (

• 

  docw

  • September 04, 2019 10:16

  Simple: the mail server for example.com mail server received an email for me@example.com. The spoofed From and Reply-to address are irrelevant, although it did help SpamAssassin identify the email as spam (FROM_ADDR_WS).

  0
• 

  keat63

  • September 05, 2019 07:21

  I though SPF and DKIM was supposed to try and weed this stuff out. I havn't obfuscated this, the following is taken directly from the message headers Reply-To: <@investinyou.club> Sender: <*************-------------------------------------- ---------------------------************* >

  0
• 

  cPanelLauren

  • September 05, 2019 15:39

  Invalid SPF and DKIM will trigger a higher spam score/liklihood of spam but Unless you're rejecting DKIM failures it's not going to fail on the receiving of them.

  0

Please sign in to leave a comment.