4 ms·

Did you put the email and its full headers in the google email analyzer [1] and does it show anything odd or interesting? Another option is to put the email an

Did you put the email and its full headers in the google email analyzer [1] and does it show anything odd or interesting? Another option is to put the email and headers into Spamcop [2] and let them decide if it should be blocked. As to what game they are playing, it's probably just a poorly configured or broken spam script. Assume malfeasance, report them, block them and ignore. If you are feeling adventurous, create a throw away email, wipe all cookies and contact the "company" they are spamming but do not give them your email address or name ... but I would not expect to learn anything. [1] - https://support.google.com/mail/answer/29436?hl=en https://support.google.com/mail/answer/29436?hl=en [2] - https://www.spamcop.net/anonsignup.shtml https://www.spamcop.net/anonsignup.shtml

CharlieDigital 2y ago
Looks normal to my somewhat-trained eyes (removed some long b64 text): Delivered-To: c*****c@gmail.com Received: by 2002:a05:622a:2a0c:b0:467:591a:6631 with SMTP id hc12csp2364502qtb; Tue, 10 Dec 2024 08:59:35 -0800 (PST) X-Google-Smtp-Source: AGHT+IGHrx0n0rF34Mu5kFPt6JBe+K2y/C7fx97S3yJLeeI6O3G9Gg1Ub3IyU1ODpk70l0PnDSPI X-Received: by 2002:a05:6808:1987:b0:3e6:3860:596b with SMTP id 5614622812f47-3eb66db44b0mr4523293b6e.8.1733849975341; Tue, 10 Dec 2024 08:59:35 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1733849975; cv=none; d=google.com; s=arc-20240605; b=TL9EfEp... ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=content-transfer-encoding:mime-version:to:date:subject:reply-to :from:message-id:feedback-id:dkim-signature; bh=sE8MV1f4/vzfiOpmJ7EPLrcEfzhKlTbS2yRqcgTnH9M=; fh=h+pPFj8nziLrXl60oePqBIUnnD7yPF5agewzKiyZPmQ=; b=Il17BTPkoUGrYNB...; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@connect.match.com header.s=102022s2048 header.b=BkIa29w2; spf=pass (google.com: domain of bounces-ma-1-18-73cfea26-0421-45d2-a15f-684ab32f822e@connect.match.com designates 208.83.243.178 as permitted sender) smtp.mailfrom=bounces-MA-1-18-73cfea26-0421-45d2-a15f-684ab32f822e@connect.match.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=connect.match.com Return-Path: <bounces-MA-1-18-73cfea26-0421-45d2-a15f-684ab32f822e@connect.match.com> Received: from f.mx.connect.match.com (f.mx.connect.match.com. [208.83.243.178]) by mx.google.com with ESMTPS id 5614622812f47-3eb46cb80b6si3776262b6e.262.2024.12.10.08.59.35 for <c*****c@gmail.com> (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 10 Dec 2024 08:59:35 -0800 (PST) Received-SPF: pass (google.com: domain of bounces-ma-1-18-73cfea26-0421-45d2-a15f-684ab32f822e@connect.match.com designates 208.83.243.178 as permitted sender) client-ip=208.83.243.178; Authentication-Results: mx.google.com; dkim=pass header.i=@connect.match.com header.s=102022s2048 header.b=BkIa29w2; spf=pass (google.com: domain of bounces-ma-1-18-73cfea26-0421-45d2-a15f-684ab32f822e@connect.match.com designates 208.83.243.178 as permitted sender) smtp.mailfrom=bounces-MA-1-18-73cfea26-0421-45d2-a15f-684ab32f822e@connect.match.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=connect.match.com DKIM-Signature: v=1; a=rsa-sha256; d=connect.match.com; s=102022s2048; c=relaxed/simple; q=dns/txt; i=@connect.match.com; t=1733849975; h=From:Subject:X-Campaign-Data:Date:Feedback-ID; bh=sE8MV1f4/vzfiOpmJ7EPLrcEfzhKlTbS2yRqcgTnH9M=; b=BkIa29w2wCbzGaez/BjEjdxmnmDlaxErYRZS/eY15ltL7Xo2XWaawSuj02QmP4Qo v7Ufl/zYOYDKHZH3MznKkC6Lq3ameafr0dC4WIjJIR1mJDZinrCE3DZfgxs14Yy3 WyGCzvUANAwMKxnIAKCmBGaFcGgSUYSSpWip+mY0QNvWvMb6GUrUqWe2Av+emMx4 HDVkErbJBBGm+fFJbgYZ2qVw73uRPD30IiprRtLtfAoDhb9w6nJaGnJg1QBwknXZ KPA/j6Ww2V1x3FihwktWoOE4T8c2+syPNP8mjgjbLXEi5jAU/N62kaWexNf4z855 xxFyz/LACPmXE/4rb0jsTA==; X-MSFBL: eeQIKvrWqPIJKHYeRzxby9MXM3txIzTV313rEeS8Mpw=|eyJiIjoiVm... Received: from [10.20.29.93] ([10.20.29.93:39710] helo=wa3mama103) by f.mx.connect.match.com (envelope-from <mailer@connect.match.com>) (ecelerity 4.6.0.20098 r(msys-ecelerity:tags/4.6.0-ga^0)) with ESMTP id 6F/2B-01369-77378576; Tue, 10 Dec 2024 10:59:35 -0600 Feedback-ID: MA-1-ENS-18:Matchcom Message-ID: <6F.2B.01369.77378576@wa3shml023.iacp.dc> X-EmailID: 73cfea26-0421-45d2-a15f-684ab32f822e X-eType: emailens X-Campaign-Data: MA-1-12102024-3-ENS-18-73cfea26-0421-45d2-a15f-684ab32f822e-T105935 From: Match <mailer@connect.match.com> Reply-To: donotreply@connect.match.com Subject: John, we’re glad you’re here. Date: Tue, 10 Dec 2024 10:59:35 -0600 To: "c*****c@gmail.com" <c*****c@gmail.com> MIME-Version: 1.0 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: base64 DQoNCg0KDQoNCg0KICAgIA0KICAgIA0KICAgIA0KDQogICAgICAgIA0KICAgICAgICANCiAgICAg... I wouldn't classify it as spam as it is clearly coming from their domains in both cases and look like legitimate account creation emails. I've emailed both companies to notify them that their account creation process seems to be omitting an email verification step (possibly verifying only the phone number).
- LinuxBender 2y ago
  Ah Match... I used to support their backend long long ago. It is likely someone running a script to set up fake accounts using email addresses they acquired. That script probably has an error and re-used an email address. I would just block emails from their domain if you have the option I don't use gmail. You may with to edit your comment to remove the headers all together as they are legit headers from Match.
  - CharlieDigital 2y ago
    Does the process not verify email address ownership? > ...someone running a script to set up fake accounts To what end? How does this scam work (even if I'm not involved?)
    - LinuxBender 2y ago
      Does the process not verify email address ownership? It did not used to for the initial account creation and that is likely all they need. They create a fake profile and put links to some malicious site or other shenanigans that affect Match users. The scam does not actually involve you at all. They will not be able to have a paid account unless something changed but they likely do not need it. There are other things that could be going on but then I would be at risk of defaming people running the site and that's a much longer story. All I can legally say is that you should just block anything coming from them unless you plan on being one of their members. Now if on the other hand you see something from their company on your credit card statement, get your bank and the Federal government involved and not the state of Texas but I do not expect that to happen. Let the feds engage the state. I am not a lawyer and this is not legal advice. There is nothing more I can add to this.

CharlieDigital 2y ago

Looks normal to my somewhat-trained eyes (removed some long b64 text): Delivered-To: c*****c@gmail.com Received: by 2002:a05:622a:2a0c:b0:467:591a:6631 with SMTP id hc12csp2364502qtb; Tue, 10 Dec 2024 08:59:35 -0800 (PST) X-Google-Smtp-Source: AGHT+IGHrx0n0rF34Mu5kFPt6JBe+K2y/C7fx97S3yJLeeI6O3G9Gg1Ub3IyU1ODpk70l0PnDSPI X-Received: by 2002:a05:6808:1987:b0:3e6:3860:596b with SMTP id 5614622812f47-3eb66db44b0mr4523293b6e.8.1733849975341; Tue, 10 Dec 2024 08:59:35 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1733849975; cv=none; d=google.com; s=arc-20240605; b=TL9EfEp... ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=content-transfer-encoding:mime-version:to:date:subject:reply-to :from:message-id:feedback-id:dkim-signature; bh=sE8MV1f4/vzfiOpmJ7EPLrcEfzhKlTbS2yRqcgTnH9M=; fh=h+pPFj8nziLrXl60oePqBIUnnD7yPF5agewzKiyZPmQ=; b=Il17BTPkoUGrYNB...; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@connect.match.com header.s=102022s2048 header.b=BkIa29w2; spf=pass (google.com: domain of bounces-ma-1-18-73cfea26-0421-45d2-a15f-684ab32f822e@connect.match.com designates 208.83.243.178 as permitted sender) smtp.mailfrom=bounces-MA-1-18-73cfea26-0421-45d2-a15f-684ab32f822e@connect.match.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=connect.match.com Return-Path: <bounces-MA-1-18-73cfea26-0421-45d2-a15f-684ab32f822e@connect.match.com> Received: from f.mx.connect.match.com (f.mx.connect.match.com. [208.83.243.178]) by mx.google.com with ESMTPS id 5614622812f47-3eb46cb80b6si3776262b6e.262.2024.12.10.08.59.35 for <c*****c@gmail.com> (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 10 Dec 2024 08:59:35 -0800 (PST) Received-SPF: pass (google.com: domain of bounces-ma-1-18-73cfea26-0421-45d2-a15f-684ab32f822e@connect.match.com designates 208.83.243.178 as permitted sender) client-ip=208.83.243.178; Authentication-Results: mx.google.com; dkim=pass header.i=@connect.match.com header.s=102022s2048 header.b=BkIa29w2; spf=pass (google.com: domain of bounces-ma-1-18-73cfea26-0421-45d2-a15f-684ab32f822e@connect.match.com designates 208.83.243.178 as permitted sender) smtp.mailfrom=bounces-MA-1-18-73cfea26-0421-45d2-a15f-684ab32f822e@connect.match.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=connect.match.com DKIM-Signature: v=1; a=rsa-sha256; d=connect.match.com; s=102022s2048; c=relaxed/simple; q=dns/txt; i=@connect.match.com; t=1733849975; h=From:Subject:X-Campaign-Data:Date:Feedback-ID; bh=sE8MV1f4/vzfiOpmJ7EPLrcEfzhKlTbS2yRqcgTnH9M=; b=BkIa29w2wCbzGaez/BjEjdxmnmDlaxErYRZS/eY15ltL7Xo2XWaawSuj02QmP4Qo v7Ufl/zYOYDKHZH3MznKkC6Lq3ameafr0dC4WIjJIR1mJDZinrCE3DZfgxs14Yy3 WyGCzvUANAwMKxnIAKCmBGaFcGgSUYSSpWip+mY0QNvWvMb6GUrUqWe2Av+emMx4 HDVkErbJBBGm+fFJbgYZ2qVw73uRPD30IiprRtLtfAoDhb9w6nJaGnJg1QBwknXZ KPA/j6Ww2V1x3FihwktWoOE4T8c2+syPNP8mjgjbLXEi5jAU/N62kaWexNf4z855 xxFyz/LACPmXE/4rb0jsTA==; X-MSFBL: eeQIKvrWqPIJKHYeRzxby9MXM3txIzTV313rEeS8Mpw=|eyJiIjoiVm... Received: from [10.20.29.93] ([10.20.29.93:39710] helo=wa3mama103) by f.mx.connect.match.com (envelope-from <mailer@connect.match.com>) (ecelerity 4.6.0.20098 r(msys-ecelerity:tags/4.6.0-ga^0)) with ESMTP id 6F/2B-01369-77378576; Tue, 10 Dec 2024 10:59:35 -0600 Feedback-ID: MA-1-ENS-18:Matchcom Message-ID: <6F.2B.01369.77378576@wa3shml023.iacp.dc> X-EmailID: 73cfea26-0421-45d2-a15f-684ab32f822e X-eType: emailens X-Campaign-Data: MA-1-12102024-3-ENS-18-73cfea26-0421-45d2-a15f-684ab32f822e-T105935 From: Match <mailer@connect.match.com> Reply-To: donotreply@connect.match.com Subject: John, we’re glad you’re here. Date: Tue, 10 Dec 2024 10:59:35 -0600 To: "c*****c@gmail.com" <c*****c@gmail.com> MIME-Version: 1.0 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: base64 DQoNCg0KDQoNCg0KICAgIA0KICAgIA0KICAgIA0KDQogICAgICAgIA0KICAgICAgICANCiAgICAg... I wouldn't classify it as spam as it is clearly coming from their domains in both cases and look like legitimate account creation emails. I've emailed both companies to notify them that their account creation process seems to be omitting an email verification step (possibly verifying only the phone number).

LinuxBender 2y ago
Ah Match... I used to support their backend long long ago. It is likely someone running a script to set up fake accounts using email addresses they acquired. That script probably has an error and re-used an email address. I would just block emails from their domain if you have the option I don't use gmail. You may with to edit your comment to remove the headers all together as they are legit headers from Match.
- CharlieDigital 2y ago
  Does the process not verify email address ownership? > ...someone running a script to set up fake accounts To what end? How does this scam work (even if I'm not involved?)
  - LinuxBender 2y ago
    Does the process not verify email address ownership? It did not used to for the initial account creation and that is likely all they need. They create a fake profile and put links to some malicious site or other shenanigans that affect Match users. The scam does not actually involve you at all. They will not be able to have a paid account unless something changed but they likely do not need it. There are other things that could be going on but then I would be at risk of defaming people running the site and that's a much longer story. All I can legally say is that you should just block anything coming from them unless you plan on being one of their members. Now if on the other hand you see something from their company on your credit card statement, get your bank and the Federal government involved and not the state of Texas but I do not expect that to happen. Let the feds engage the state. I am not a lawyer and this is not legal advice. There is nothing more I can add to this.