4 ms·
I have retrieved the headers: Return-Path: <barrywvarneyh952@gmail.com> Received: from compute4.internal (compute4.nyi.internal [10.202.2.44]) by
by throw10920 4y ago
I have retrieved the headers:
Return-Path: <barrywvarneyh952@gmail.com>
Received: from compute4.internal (compute4.nyi.internal [10.202.2.44])
by sloti44n40 (Cyrus 3.7.0-alpha0-935-ge4ccd4c47b-fm-20220914.001-ge4ccd4c4) with LMTPA;
Fri, 23 Sep 2022 09:14:21 -0400
X-Cyrus-Session-Id: sloti44n40-1663938861-1037676-2-16521453121443000607
X-Sieve: CMU Sieve 3.0
X-Spam-known-sender: no
X-Spam-sender-reputation: 500 (none)
X-Spam-score: 0.1
X-Spam-hits: DCC_REPUT_13_19 -0.1, FREEMAIL_ENVFROM_END_DIGIT 0.25, FREEMAIL_FROM 0.001,
HTML_MESSAGE 0.001, ME_SENDERREP_NEUTRAL 0.001,
RCVD_IN_DNSWL_NONE -0.0001, RCVD_IN_MSPIKE_H2 -0.001,
SPF_HELO_NONE 0.001, SPF_PASS -0.001, TVD_SPACE_RATIO 0.001,
T_FREEMAIL_DOC_PDF 0.01, LANGUAGES unknown, BAYES_USED none,
SA_VERSION 3.4.6
X-Spam-source: IP='209.85.219.49', Host='mail-qv1-f49.google.com', Country='US',
FromHeader='com', MailFrom='com'
X-Spam-charsets: plain='UTF-8', html='UTF-8'
X-Attached: Details (3).pdf
X-Resolved-to: <throw10920 address>
X-Delivered-to: <throw10920 address>
X-Mail-from: barrywvarneyh952@gmail.com
Received: from mx5 ([10.202.2.204])
by compute4.internal (LMTPProxy); Fri, 23 Sep 2022 09:14:21 -0400
Received: from mx5.messagingengine.com (localhost [127.0.0.1])
by mailmx.nyi.internal (Postfix) with ESMTP id 634BF2720140
for <throw10920 address>; Fri, 23 Sep 2022 09:14:21 -0400 (EDT)
Received: from mx5.messagingengine.com (localhost [127.0.0.1])
by mx5.messagingengine.com (Authentication Milter) with ESMTP
id 56AEB231292;
Fri, 23 Sep 2022 09:14:21 -0400
ARC-Seal: i=1; a=rsa-sha256; cv=none; d=messagingengine.com; s=fm2; t=
1663938861; b=qDtS28CDS2y28h3ycCzz2olah3lAZcdJBi4/I894gWSs2KZIOj
vNX/FQ+GrIpNZJv8kS+8EDKztM5Uk72CdkDUs9SIeTt+Xujswj1PxeW3Pt1y8wtw
edscLRzagS8u88INStmdmu+BELCeckywd/Zd1+6Dx9FUbgMRioGWZfVr1A3WOK3z
WQjw7G4LoAA+rd62+3B1gfYQq1CgMYq+2hDH8+w+k21PZXbgcfGdLh5UKSRjZsvJ
NXfpYl+q7b6CMTp7+G+rwJKQAYNB11ZFCyyZXapRsPLuwDqxD3zpyrHJbkdRT8CU
WXBsFU0+Upmf/MhRfEnivF/RqrH0qmdPXUAg==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=
messagingengine.com; h=mime-version:from:date:message-id:subject
:to:content-type; s=fm2; t=1663938861; bh=mgoaWyWp1yTWBa0JtRKZ3J
G3oT/BJWrtmRX+y6Pw8Ig=; b=sNMnMvPQYLl9OhPIu+/FvA4GQcAIPIxBNTNyIE
tGDrOjDD85df2gsz5dqBQgbLhWWHG6BSROCVxolcMciApfSwo0IFL31MMxLlFyOT
FjVMXTnvnUbqb74pyJAva3DzEBzAg6iEz7gROUmJhxI9TI1jICx8a4t1brm5cmXU
oUOmMASTfD9/PhDsuMD1tilvHzbrjfPOI8T10aPHHcijmmHUGvuy+IozlVVTzfxX
Q9XuwDLs6NiUCNV1nXRa0fW7GK3U/vXqKxa5jYYQ7YxbQSqJ3SVlSimBVZfSxuRa
Vsisua3ZCkDsb7THQ7ZajWcDR7lvADeKST24899ukfXWVHcA==
ARC-Authentication-Results: i=1; mx5.messagingengine.com;
x-csa=none;
x-me-sender=none;
x-ptr=pass smtp.helo=mail-qv1-f49.google.com
policy.ptr=mail-qv1-f49.google.com;
bimi=skipped (DMARC Policy is not at enforcement);
arc=none (no signatures found);
dkim=pass (2048-bit rsa key sha256) header.d=gmail.com
header.i=@gmail.com header.b=h/YxiNwR header.a=rsa-sha256
header.s=20210112 x-bits=2048;
dmarc=pass policy.published-domain-policy=none
policy.published-subdomain-policy=quarantine
policy.applied-disposition=none policy.evaluated-disposition=none
(p=none,sp=quarantine,d=none,d.eval=none) policy.policy-from=p
header.from=gmail.com;
iprev=pass smtp.remote-ip=209.85.219.49 (mail-qv1-f49.google.com);
spf=pass smtp.mailfrom=barrywvarneyh952@gmail.com
smtp.helo=mail-qv1-f49.google.com
X-ME-Authentication-Results: mx5.messagingengine.com;
x-aligned-from=pass (Address match);
x-google-dkim=pass (2048-bit rsa key) header.d=1e100.net
header.i=@1e100.net header.b=iv6O/RRb;
x-return-mx=pass header.domain=gmail.com policy.is_org=yes
(MX Records found: alt4.gmail-smtp-in.l.google.com,gmail-smtp-in.l.google.com,alt2.gmail-smtp-in.l.google.com,alt1.gmail-smtp-in.l.google.com,alt3.gmail-smtp-in.l.google.com);
x-return-mx=pass smtp.domain=gmail.com policy.is_org=yes
(MX Records found: alt2.gmail-smtp-in.l.google.com,alt1.gmail-smtp-in.l.google.com,alt3.gmail-smtp-in.l.google.com,alt4.gmail-smtp-in.l.google.com,gmail-smtp-in.l.google.com);
x-tls=pass smtp.version=TLSv1.3 smtp.cipher=TLS_AES_256_GCM_SHA384
smtp.bits=256/256;
x-vs=clean score=0 state=0
Authentication-Results: mx5.messagingengine.com;
x-csa=none;
x-me-sender=none;
x-ptr=pass smtp.helo=mail-qv1-f49.google.com
policy.ptr=mail-qv1-f49.google.com
Authentication-Results: mx5.messagingengine.com;
bimi=skipped (DMARC Policy is not at enforcement)
Authentication-Results: mx5.messagingengine.com;
arc=none (no signatures found)
Authentication-Results: mx5.messagingengine.com;
dkim=pass (2048-bit rsa key sha256) header.d=gmail.com
header.i=@gmail.com header.b=h/YxiNwR header.a=rsa-sha256
header.s=20210112 x-bits=2048;
dmarc=pass policy.published-domain-policy=none
policy.published-subdomain-policy=quarantine
policy.applied-disposition=none policy.evaluated-disposition=none
(p=none,sp=quarantine,d=none,d.eval=none) policy.policy-from=p
header.from=gmail.com;
iprev=pass smtp.remote-ip=209.85.219.49 (mail-qv1-f49.google.com);
spf=pass smtp.mailfrom=barrywvarneyh952@gmail.com
smtp.helo=mail-qv1-f49.google.com
X-ME-VSCause: gggruggvucftvghtrhhoucdtuddrgedvfedrfeefiedgieefucetufdoteggodetrfdotf
fvucfrrhhofhhilhgvmecuhfgrshhtofgrihhlpdggtfgfnhhsuhgsshgtrhhisggvpdfu
rfetoffkrfgpnffqhgenuceurghilhhouhhtmecufedttdenucenucfjughrpegghfffkf
fuvfgtsehmtderredttdejnecuhfhrohhmpeeurghrrhihficugggrrhhnvgihhhcuoegs
rghrrhihfihvrghrnhgvhihhleehvdesghhmrghilhdrtghomheqnecuggftrfgrthhtvg
hrnhepjeetueehudejtddtueejvdehledttdelieeviefgueelleetvddutdfgleduvdev
necukfhppedvtdelrdekhedrvdduledrgeelnecuvehluhhsthgvrhfuihiivgeptdenuc
frrghrrghmpehinhgvthepvddtledrkeehrddvudelrdegledphhgvlhhopehmrghilhdq
qhhvuddqfhegledrghhoohhglhgvrdgtohhmpdhmrghilhhfrhhomhepoegsrghrrhihfi
hvrghrnhgvhihhleehvdesghhmrghilhdrtghomheq
X-ME-VSScore: 0
X-ME-VSCategory: clean
X-ME-CSA: none
Received-SPF: pass
(gmail.com ... _spf.google.com: Sender is authorized to use 'barrywvarneyh952@gmail.com' in 'mfrom' identity (mechanism 'include:_netblocks.google.com' matched))
receiver=mx5.messagingengine.com;
identity=mailfrom;
envelope-from="barrywvarneyh952@gmail.com";
helo=mail-qv1-f49.google.com;
client-ip=209.85.219.49
Fastmail-MaskedEmail: id=masked-REDACTED; state=enabled
Received: from mail-qv1-f49.google.com (mail-qv1-f49.google.com [209.85.219.49])
(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256)
(No client certificate requested)
by mx5.messagingengine.com (Postfix) with ESMTPS
for <throw10920 address>; Fri, 23 Sep 2022 09:14:21 -0400 (EDT)
Received: by mail-qv1-f49.google.com with SMTP id l1so563450qvu.11
for <throw10920 address>; Fri, 23 Sep 2022 06:14:21 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20210112;
h=to:subject:message-id:date:from:mime-version:from:to:cc:subject
:date;
bh=mgoaWyWp1yTWBa0JtRKZ3JG3oT/BJWrtmRX+y6Pw8Ig=;
b=h/YxiNwRagpULPH2dAAP84uSef6zj0R4UealQrN2jHF5wheHgY9FPOOFuxaZze8sgy
NKx67McMjDbaLZI4Ybqr9I99R5qvJyAGYQaTmz2brz4yXtqeoMA641ekxGmRjsrv82yf
W6ipUTNohrTsAAcvNeE9QUfN7dn7iWgiUzRulWbWIBGWR8JSIA4NN3HWx3vRO/4n/qyi
1ynine1dxG7Qe4PX/HHQobCVaslG+oo1ogNecu8Rq2R0u7yIoB+v28zc98pFF5IszMMA
4L/FhOXU7+L7GbQ0JPoxix790cy4p1rUDLPESDHP2Xcssf9dmPuI8jXlGyjNHwNJOe7n
ZWfQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20210112;
h=to:subject:message-id:date:from:mime-version:x-gm-message-state
:from:to:cc:subject:date;
bh=mgoaWyWp1yTWBa0JtRKZ3JG3oT/BJWrtmRX+y6Pw8Ig=;
b=iv6O/RRbuHD9TQOCuJMwNBdCabYm1I1KsEjfD8W4IxA9Gbd5ZAa2BPQqzZKRAYeZ85
8l1ZZeaS8aAmehs7jRwGOJT5DfK0MZMPQHkOvWrtG8hUexT5A42CA6qzcucKeotzyD1+
/H2C78zxdDSOj4T313h2hHZe+QgeFUCKa47Agm5Hg7YWS4Ivk/GN5q+rPgf96qiMFjPZ
NjUpUt+oaTx5QYEBl1VFg/s2bllSIxAs+avSIATVr6Kk5qkRcGkcB4l7RQ5/MdydVqzn
GBWqOH/3tGa/PcoFWWyQHK5Awp0RCl51874ieWHzEsTbw4vxY4NdWXMhEbVdYNnx1a6E
Og3A==
X-Gm-Message-State: ACrzQf0w3TsrGRPOEfDzfdBI2/rmC0zGH0WSziUrRNf8THrMDa6ThD3J
W026gpn0qliT/A0JT6eA19P1+TbIkepxud+rpCg=
X-Google-Smtp-Source: AMsMyM4jCwL+QF3C+JZWnSqkWjbmCkW7hpRxCD40bhCGLWRp+46CIb2DL4OPAS0OePSQitgavYsgfYNlBUfx7RU31jQ=
X-Received: by 2002:a0c:f18d:0:b0:4ad:1149:3975 with SMTP id
m13-20020a0cf18d000000b004ad11493975mr7062648qvl.24.1663938859522; Fri, 23
Sep 2022 06:14:19 -0700 (PDT)
MIME-Version: 1.0
From: Barryw Varneyh <barrywvarneyh952@gmail.com>
Date: Fri, 23 Sep 2022 18:44:07 +0530
Message-ID: <CA+AZ9Gv3P8JtiMhte5LpG2=AnRJi-3BzFGGrpq+wxhqSVtuwHQ@mail.gmail.com>
Subject: invoice
To: <list of several hundred random domestic email addresses - aol, hotmail, yahoo, icloud, gmail, etc.>
- geocrasher 4y agoOk, so using a fake new gmail address the spammer used an instance hosted at mx5.messagingengine.com (probably a hacked or vulnerable mail server hosted at https://expedient.com/ https://expedient.com/, cloud provider) to send mail via SMTP/gmail to a <list of several hundred random domestic email addresses - aol, hotmail, yahoo, icloud, gmail, etc.> There's nothing to indicate you were specifically targeted, but rather that they guessed your email address. It didn't bounce, so they kept sending to it.
- throw10920 4y ago> rather that they guessed your email address I'm sorry, I don't see how the fact that there are a large number of recipient email addresses provides evidence for the idea that my email address was guessed. A spammer with a list of addresses bought off a marketplace could easily have done the same thing, couldn't they?
- geocrasher 4y agoSure, could have. But spammers are cheap. They're not going to buy addresses when they can guess them. I'm going based off what is most likely based on what I see- a typical spammer doing typical spammer things. You might go look at haveibeenpwned.com and see if your email address is listed there, to see if it's some part of a breach.
- throw10920 4y agohaveibeenpwned.com shows nothing, and I reached out to some of the other addresses on the email and got autoresponders and messages back from real people confirming that they used that email for their Comcast account - so, no, these addresses were not guessed.
- nonasktell 4y agoif you see the other addresses, can you check if they're registered on comcast website? https://login.xfinity.com/login https://login.xfinity.com/login to try to see if it exists if someone got a fresh list of mail addresses, they'd probably test all the mails coming from this source at the same time, could confirm your theory