You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Niamh Holding <ni...@fullbore.co.uk> on 2025/01/29 08:23:52 UTC
Fake paypal email triggers -7.5 USER_IN_DEF_DKIM_WL From: address is in the default DKIM
Hello
Given the From: address can be so easily faked is a rule testing its validity a great idea?
Headers-
Return-Path: <bo...@smpn7wonogiri.sch.id>
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on iron.holtain.net
X-Spam-Level:
X-Spam-Status: No, score=-6.5 required=4.5 autolearn=no autolearn_force=no
X-Spam-Report:
* 0.0 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
* [40.93.128.29 listed in wl.mailspike.net]
* -0.0 SPF_PASS SPF: sender matches SPF record
* 0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
* mail domains are different
* -0.0 SPF_HELO_PASS SPF: HELO matches SPF record
* -7.5 USER_IN_DEF_DKIM_WL From: address is in the default DKIM
* welcome-list
* 0.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
* 0.0 HTML_MESSAGE BODY: HTML included in message
* 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily
* valid
* -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from
* author's domain
* -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
* 1.3 RCVD_IN_VALIDITY_RPBL RBL: Relay in Validity RPBL,
* https://senderscore.org/blocklistlookup/
* [40.93.128.29 listed in bl.score.senderscore.com]
* -0.0 T_SCC_BODY_TEXT_LINE No description available.
* 1.0 POSSIBLE_PAYPAL_PHISH_03 Claims to be from paypal, sent to
* Microsoft365 domain - likely fraud if you don't use MSFT365!
* 0.0 T_REMOTE_IMAGE Message contains an external image
* -1.3 DKIMWL_WL_HIGH DKIMwl.org - High trust sender
X-Spam-Relays-Untrusted: [ ip=40.93.128.29
rdns=mail-eastasiaazlp17011029.outbound.protection.outlook.com
helo=HK3PR03CU002.outbound.protection.outlook.com by=iron.holtain.net
ident= envfrom= intl=0 id=8EA1DC000546 auth= msa=0 ] [
ip=2603:1096:405:8e::12 rdns=TYSPR04MB8220.apcprd04.prod.outlook.com
helo=TYSPR04MB8220.apcprd04.prod.outlook.com
by=TYZPR04MB7906.apcprd04.prod.outlook.com ident= envfrom= intl=0
id=15.20.8377.21 auth= msa=0 ] [ ip=2603:1096:820:11b::9
rdns=KL1PR04MB7539.apcprd04.prod.outlook.com
helo=KL1PR04MB7539.apcprd04.prod.outlook.com
by=TYSPR04MB8220.apcprd04.prod.outlook.com ident= envfrom= intl=0
id=15.20.8377.21 auth= msa=0 ] [ ip=fe80::b078:df3:b558:4f13 rdns=
helo=KL1PR04MB7539.apcprd04.prod.outlook.com
by=KL1PR04MB7539.apcprd04.prod.outlook.com ident= envfrom= intl=0 id=
auth= msa=0 ] [ ip=2603:1096:4:b8::34
rdns=SGXP274CA0022.SGPP274.PROD.OUTLOOK.COM
helo=SGXP274CA0022.SGPP274.PROD.OUTLOOK.COM
by=TYZPR04MB7271.apcprd04.prod.outlook.com ident= envfrom= intl=0
id=15.20.8377.21 auth= msa=0 ] [ ip=2603:1096:4:b8:cafe::6f
rdns=SG2PEPF000B66CE.apcprd03.prod.outlook.com
helo=SG2PEPF000B66CE.apcprd03.prod.outlook.com
by=SGXP274CA0022.outlook.office365.com ident= envfrom= intl=0
id=15.20.8398.17 auth= msa=0 ] [ ip=2a01:111:f403:48::209
rdns=EUR03-VI1-obe.outbound.protection.outlook.com
helo=EUR03-VI1-obe.outbound.protection.outlook.com
by=SG2PEPF000B66CE.mail.protection.outlook.com ident= envfrom= intl=0
id=15.20.8398.14 auth= msa=0 ] [ ip=2603:10a6:5:10::31
rdns=DB7P192MB0331.EURP192.PROD.OUTLOOK.COM
helo=DB7P192MB0331.EURP192.PROD.OUTLOOK.COM
by=AS8P192MB2065.EURP192.PROD.OUTLOOK.COM ident= envfrom= intl=0
id=15.20.8377.22 auth= msa=0 ] [ ip=fe80::306f:e2a6:6620:fff0 rdns=
helo=DB7P192MB0331.EURP192.PROD.OUTLOOK.COM
by=DB7P192MB0331.EURP192.PROD.OUTLOOK.COM ident= envfrom= intl=0 id=
auth= msa=0 ] [ ip=2603:10a6:10:120::12
rdns=DB8PR06CA0038.eurprd06.prod.outlook.com
helo=DB8PR06CA0038.eurprd06.prod.outlook.com
by=PAWP192MB2250.EURP192.PROD.OUTLOOK.COM ident= envfrom= intl=0
id=15.20.8377.22 auth= msa=0 ] [ ip=2603:10a6:10:120:cafe::e9
rdns=DU2PEPF00028CFD.eurprd03.prod.outlook.com
helo=DU2PEPF00028CFD.eurprd03.prod.outlook.com
by=DB8PR06CA0038.outlook.office365.com ident= envfrom= intl=0
id=15.20.8377.22 auth= msa=0 ] [ ip=66.211.170.90
rdns=mx4.phx.paypal.com helo=mx4.phx.paypal.com
by=DU2PEPF00028CFD.mail.protection.outlook.com ident= envfrom= intl=0
id=15.20.8398.14 auth= msa=0 ]
X-Spam-Language: en
X-Spam-DKIM-i: @paypal.com
X-Spam-DKIM-d: paypal.com
X-Original-To: niamh@fullbore.co.uk
Delivered-To: niamh.fullbore@iron.holtain.net
Received-SPF: Pass (mailfrom) identity=mailfrom; client-ip=40.93.128.29; helo=hk3pr03cu002.outbound.protection.outlook.com; envelope-from=bounces+srs=4a6bc=uu@smpn7wonogiri.sch.id; receiver=<UNKNOWN>
DMARC-Filter: OpenDMARC Filter v1.4.2 iron.holtain.net 8EA1DC000546
Authentication-Results: iron.holtain.net; dmarc=pass (p=reject dis=none) header.from=paypal.com
Authentication-Results: iron.holtain.net; spf=pass smtp.mailfrom=smpn7wonogiri.sch.id
DKIM-Filter: OpenDKIM Filter v2.11.0 iron.holtain.net 8EA1DC000546
Authentication-Results: iron.holtain.net;
dkim=pass (2048-bit key, unprotected) header.d=paypal.com header.i=@paypal.com header.a=rsa-sha256 header.s=pp-dkim1 header.b=Ti5ZlN8t
Received: from HK3PR03CU002.outbound.protection.outlook.com (mail-eastasiaazlp17011029.outbound.protection.outlook.com [40.93.128.29])
by iron.holtain.net (Postfix) with ESMTPS id 8EA1DC000546
for <ni...@fullbore.co.uk>; Tue, 28 Jan 2025 18:08:36 +0000 (GMT)
Received: from TYSPR04MB8220.apcprd04.prod.outlook.com (2603:1096:405:8e::12)
by TYZPR04MB7906.apcprd04.prod.outlook.com (2603:1096:405:a9::11) with
Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8377.21; Tue, 28 Jan
2025 18:08:28 +0000
Received: from KL1PR04MB7539.apcprd04.prod.outlook.com (2603:1096:820:11b::9)
by TYSPR04MB8220.apcprd04.prod.outlook.com (2603:1096:405:8e::12) with
Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8377.21; Tue, 28 Jan
2025 18:08:00 +0000
Received: from KL1PR04MB7539.apcprd04.prod.outlook.com
([fe80::b078:df3:b558:4f13]) by KL1PR04MB7539.apcprd04.prod.outlook.com
([fe80::b078:df3:b558:4f13%3]) with mapi id 15.20.8377.021; Tue, 28 Jan 2025
18:07:59 +0000
Received: from SGXP274CA0022.SGPP274.PROD.OUTLOOK.COM (2603:1096:4:b8::34) by
TYZPR04MB7271.apcprd04.prod.outlook.com (2603:1096:400:44f::6) with Microsoft
SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id
15.20.8377.21; Tue, 28 Jan 2025 17:50:17 +0000
Received: from SG2PEPF000B66CE.apcprd03.prod.outlook.com
(2603:1096:4:b8:cafe::6f) by SGXP274CA0022.outlook.office365.com
(2603:1096:4:b8::34) with Microsoft SMTP Server (version=TLS1_3,
cipher=TLS_AES_256_GCM_SHA384) id 15.20.8398.17 via Frontend Transport; Tue,
28 Jan 2025 17:50:17 +0000
Authentication-Results: spf=softfail (sender IP is 2a01:111:f403:48::209)
smtp.mailfrom=euroland.fr; dkim=pass (signature was verified)
header.d=paypal.com;dmarc=pass action=none header.from=paypal.com;
Received-SPF: SoftFail (protection.outlook.com: domain of transitioning
euroland.fr discourages use of 2a01:111:f403:48::209 as permitted sender)
Received: from EUR03-VI1-obe.outbound.protection.outlook.com
(2a01:111:f403:48::209) by SG2PEPF000B66CE.mail.protection.outlook.com
(2603:1096:f:fff5:0:1:0:5) with Microsoft SMTP Server (version=TLS1_3,
cipher=TLS_AES_256_GCM_SHA384) id 15.20.8398.14 via Frontend Transport; Tue,
28 Jan 2025 17:50:16 +0000
Received: from DB7P192MB0331.EURP192.PROD.OUTLOOK.COM (2603:10a6:5:10::31) by
AS8P192MB2065.EURP192.PROD.OUTLOOK.COM (2603:10a6:20b:5bd::19) with Microsoft
SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id
15.20.8377.22; Tue, 28 Jan 2025 17:50:13 +0000
Received: from DB7P192MB0331.EURP192.PROD.OUTLOOK.COM
([fe80::306f:e2a6:6620:fff0]) by DB7P192MB0331.EURP192.PROD.OUTLOOK.COM
([fe80::306f:e2a6:6620:fff0%5]) with mapi id 15.20.8377.021; Tue, 28 Jan 2025
17:50:13 +0000
Received: from DB8PR06CA0038.eurprd06.prod.outlook.com (2603:10a6:10:120::12)
by PAWP192MB2250.EURP192.PROD.OUTLOOK.COM (2603:10a6:102:34e::21) with
Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8377.22; Tue, 28 Jan
2025 17:49:51 +0000
Received: from DU2PEPF00028CFD.eurprd03.prod.outlook.com
(2603:10a6:10:120:cafe::e9) by DB8PR06CA0038.outlook.office365.com
(2603:10a6:10:120::12) with Microsoft SMTP Server (version=TLS1_3,
cipher=TLS_AES_256_GCM_SHA384) id 15.20.8377.22 via Frontend Transport; Tue,
28 Jan 2025 17:49:51 +0000
Authentication-Results-Original: spf=pass (sender IP is 66.211.170.90)
smtp.mailfrom=paypal.com; dkim=pass (signature was verified)
header.d=paypal.com;dmarc=pass action=none header.from=paypal.com;
Received-SPF: Pass (protection.outlook.com: domain of paypal.com designates
66.211.170.90 as permitted sender) receiver=protection.outlook.com;
client-ip=66.211.170.90; helo=mx4.phx.paypal.com; pr=C
Received: from mx4.phx.paypal.com (66.211.170.90) by
DU2PEPF00028CFD.mail.protection.outlook.com (10.167.242.181) with Microsoft
SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id
15.20.8398.14 via Frontend Transport; Tue, 28 Jan 2025 17:49:50 +0000
DKIM-Signature: v=1; a=rsa-sha256; d=paypal.com; s=pp-dkim1; c=relaxed/relaxed;
q=dns/txt; i=@paypal.com; t=1738086589;
h=From:From:Subject:Date:To:MIME-Version:Content-Type;
bh=x4gXgJPzgMJS4s6SslPDX50DN37l6UgxYv1Fke0blj4=;
b=Ti5ZlN8t9vOP4oHPw6S7EFSv5qCloXAAcGFhN1UUYPh8b+kHEbenBvfdHtOlBzCF
7lCfc0LH2NGC6vIhFkmbmn490P6XkzLMgQwi9IcUaQTZrUIeD8r5YPRT5b/Y4RmA
VqAbuOE/7S20QxDlpoCqOprRhS/39AvB5W/QuCyzPn6uf+IjwQjyd7f8imwXsGGD
O+hiNma12uuMIgpeuAdk5PNYrZJv9UZA6Ta9OZP1LyowQPFIdPaIJf4ACHUkBGaa
fChq5r8wr7lBUGY/5ft8dfpmzcj3QiEcytLWYQ4niDlTJAMZcPI3OSuoyiwXjFJq
yuYqt5ZZhMyeauUvreQNbw==;
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html; charset="UTF-8"
Date: Tue, 28 Jan 2025 09:49:49 -0800
Message-ID: <AD...@ccg01mail06>
MIME-Version: 1.0
From: "service@paypal.com" <se...@paypal.com>
To: Sharon Turner <or...@Euroland.onmicrosoft.com>
Subject: You've sent a money request
X-MaxCode-Template: RT000241
X-PP-Priority: 0-paypal-false
PP-Correlation-Id: f388091b585de
X-PP-Email-transmission-Id: 44cd845b-dda0-11ef-bbbe-0f3c32714b27
X-PP-REQUESTED-TIME: 1738086577206
X-Email-Type-Id: RT000241
AMQ-Delivery-Message-Id: nullval
X-XPT-XSL-Name: nullval
X-EOPAttributedMessage: 1
X-MS-TrafficTypeDiagnostic:
DU2PEPF00028CFD:EE_|PAWP192MB2250:EE_|AS8P192MB2065:EE_|SG2PEPF000B66CE:EE_|TYZPR04MB7271:EE_|TYSPR04MB8220:EE_|TYZPR04MB7906:EE_
X-MS-Office365-Filtering-Correlation-Id: 198a6f79-7e5b-4b79-7cbb-08dd3fc43981
X-Moderation-Data: 1/28/2025 5:50:06 PM
X-LD-Processed: 597638ac-1f39-416f-b8b6-2a57af6395fe,ExtAddr
X-Auto-Response-Suppress: DR, OOF, AutoReply
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AS8P192MB2065
X-EOPTenantAttributedMessage: 7ab5503a-6b18-41b1-ab89-bb02ef5b5daf:0
X-MS-Exchange-Transport-CrossTenantHeadersStripped: SG2PEPF000B66CE.apcprd03.prod.outlook.com
X-MS-Exchange-Transport-CrossTenantHeadersPromoted: SG2PEPF000B66CE.apcprd03.prod.outlook.com
X-MS-PublicTrafficType: Email
X-MS-Office365-Filtering-Correlation-Id-Prvs:
5c11a4de-9c64-4aae-d96a-08dd3fc42a48
X-Moderation-Data: 1/28/2025 6:07:58 PM
X-LD-Processed: 7ab5503a-6b18-41b1-ab89-bb02ef5b5daf,ExtAddr,ExtAddr
X-OriginatorOrg: smpn7wonogiri.sch.id
X-MS-Exchange-CrossTenant-Network-Message-Id: 198a6f79-7e5b-4b79-7cbb-08dd3fc43981
X-MS-Exchange-CrossTenant-Id: 7ab5503a-6b18-41b1-ab89-bb02ef5b5daf
X-MS-Exchange-CrossTenant-AuthSource: SG2PEPF000B66CE.apcprd03.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: Internet
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 28 Jan 2025 18:07:59.9852
(UTC)
X-MS-Exchange-Transport-CrossTenantHeadersStamped: TYZPR04MB790
--
Best regards,
Niamh mailto:niamh@fullbore.co.uk
Re: Fake paypal email triggers -7.5 USER_IN_DEF_DKIM_WL From: address is in the default DKIM
Posted by Greg Troxel <gd...@lexort.com>.
Niamh Holding <ni...@fullbore.co.uk> writes:
> Hello Greg,
>
> Wednesday, January 29, 2025, 12:28:13 PM, you wrote:
>
> GT> - 1) this email was emitted from paypal's mail system
> GT> - 2) paypal's DKIM signing key is compromised
> GT> - 3) spamassassin is misparsing DKIM
> GT> - 4) something else
>
> GT> I would take the message and run it through SA with -D -t.
> GT> I am guessing we are in case 1.
>
> GT> To be clear: if this is case 1, then it is not true that "the From:
> GT> address [is] faked".
>
> I'm 99.9% sure paypal doesn't use outlook.com to deliver emails.
>
> X-Spam-Relays-Untrusted: [ ip=13.110.227.172 rdns=mta58.emails.paypal.com
> helo=mta58.emails.paypal.com by=iron.holtain.net ident= envfrom=
> intl=0 id=EEC48C00559A auth= msa=0 ]
It doesn't in general, but it seems
someone has set up a MS account to forward to others
someone has caused paypal to send an *authentic, DKIM-signed* message
from paypal's systems to that MS account (with phishing content)
You having an example of (legit) paypal mail direct to you doesn't argue
that this isn't case 1.
Re: Fake paypal email triggers -7.5 USER_IN_DEF_DKIM_WL From: address is in the default DKIM
Posted by Niamh Holding <ni...@fullbore.co.uk>.
Hello Greg,
Wednesday, January 29, 2025, 12:28:13 PM, you wrote:
GT> - 1) this email was emitted from paypal's mail system
GT> - 2) paypal's DKIM signing key is compromised
GT> - 3) spamassassin is misparsing DKIM
GT> - 4) something else
GT> I would take the message and run it through SA with -D -t.
GT> I am guessing we are in case 1.
GT> To be clear: if this is case 1, then it is not true that "the From:
GT> address [is] faked".
I'm 99.9% sure paypal doesn't use outlook.com to deliver emails.
X-Spam-Relays-Untrusted: [ ip=13.110.227.172 rdns=mta58.emails.paypal.com
helo=mta58.emails.paypal.com by=iron.holtain.net ident= envfrom=
intl=0 id=EEC48C00559A auth= msa=0 ]
--
Best regards,
Niamh mailto:niamh@fullbore.co.uk
Re: Fake paypal email triggers -7.5 USER_IN_DEF_DKIM_WL From: address is in the default DKIM
Posted by joe a <jo...@j4computers.com>.
On 1/29/2025 07:28:13, Greg Troxel wrote:
> Niamh Holding<ni...@fullbore.co.uk> writes:
>
>> Given the From: address can be so easily faked is a rule testing its validity a great idea?
> This seems tricky to figure out.
>
> The message's routing is obviously very sketchy.
>
> But, it also appears that spamassassin has validated the DKIM signature
> from paypal.com. So the key question is whether
>
> - 1) this email was emitted from paypal's mail system
> - 2) paypal's DKIM signing key is compromised
> - 3) spamassassin is misparsing DKIM
> - 4) something else
>
> I would take the message and run it through SA with -D -t.
> I am guessing we are in case 1.
>
> To be clear: if this is case 1, then it is not true that "the From:
> address [is] faked".
>
>
> If paypal is emitting user-generated content with DKIM signatures, then
> they should be summarily removed from DKIM WL. The point of those WL
> entries are to cover mail that is really from those companies, believed
> to be essentially never spam.
>
> Also there is DKIMWL at high, and if you have a message with a valid
> DKIM signature reporting it there as well would be good.
FWIW, I have seen these in several messages of this type:
. . .
* -7.5 USER_IN_DEF_DKIM_WL From: address is in the default DKIM
. . .
* 0.0 POSSIBLE_PAYPAL_PHISH_02 Claims to be from paypal but not
* processed by any paypal MTA
* 1.0 POSSIBLE_PAYPAL_PHISH_03 Claims to be from paypal, sent to
* Microsoft365 domain - likely fraud if you don't use MSFT365!
Re: Fake paypal email triggers -7.5 USER_IN_DEF_DKIM_WL From: address is in the default DKIM
Posted by Greg Troxel <gd...@lexort.com>.
Niamh Holding <ni...@fullbore.co.uk> writes:
> Given the From: address can be so easily faked is a rule testing its validity a great idea?
This seems tricky to figure out.
The message's routing is obviously very sketchy.
But, it also appears that spamassassin has validated the DKIM signature
from paypal.com. So the key question is whether
- 1) this email was emitted from paypal's mail system
- 2) paypal's DKIM signing key is compromised
- 3) spamassassin is misparsing DKIM
- 4) something else
I would take the message and run it through SA with -D -t.
I am guessing we are in case 1.
To be clear: if this is case 1, then it is not true that "the From:
address [is] faked".
If paypal is emitting user-generated content with DKIM signatures, then
they should be summarily removed from DKIM WL. The point of those WL
entries are to cover mail that is really from those companies, believed
to be essentially never spam.
Also there is DKIMWL at high, and if you have a message with a valid
DKIM signature reporting it there as well would be good.
Re: Fake paypal email triggers -7.5 USER_IN_DEF_DKIM_WL From: address is in the default DKIM
Posted by Niamh Holding <ni...@fullbore.co.uk>.
Hello Tom,
Thursday, January 30, 2025, 1:47:40 AM, you wrote:
TWvu> Also, I noticed Spamassassin 3.4.6 is being used. Would Spamassassin 4.0 have done a better job at processing these headers?
Under CentOS 9 that's the version one gets with dnf install spamassassin.
--
Best regards,
Niamh mailto:niamh@fullbore.co.uk
Re: Fake paypal email triggers -7.5 USER_IN_DEF_DKIM_WL From: address is in the default DKIM
Posted by Dave Funk <db...@engineering.uiowa.edu>.
In part because headers added by servers not trusted by local SA may be
considered advisory but not trusted for hard local judgements.
IE a remote MTA server can put anything in the headers that they want, only
trust what you find from your local trusted MTA
On Wed, 29 Jan 2025, Tom Williams via users wrote:
> Hi! Casual observer here, but I have a question about the headers.
>
> On 1/29/25 12:23 AM, Niamh Holding wrote:
>
> (snip)
>
>> Authentication-Results: spf=softfail (sender IP is 2a01:111:f403:48::209)
>> smtp.mailfrom=euroland.fr; dkim=pass (signature was verified)
>> header.d=paypal.com;dmarc=pass action=none header.from=paypal.com;
>> Received-SPF: SoftFail (protection.outlook.com: domain of transitioning
>> euroland.fr discourages use of 2a01:111:f403:48::209 as permitted sender)
>
> (snip)
>
> Why wouldn't the SPF softfail messages not trigger some kind of rule?
> Especially the "discourages use of" message. Also, I noticed
> Spamassassin 3.4.6 is being used. Would Spamassassin 4.0 have done a better
> job at processing these headers?
>
> Thanks!
>
> Tom
>
>
--
Dave Funk University of Iowa
<dbfunk (at) engineering.uiowa.edu> College of Engineering
319/335-5751 FAX: 319/384-0549 1256 Seamans Center, 103 S Capitol St.
Sys_admin/Postmaster/cell_admin Iowa City, IA 52242-1527
#include <std_disclaimer.h>
Better is not better, 'standard' is better. B{
Re: Fake paypal email triggers -7.5 USER_IN_DEF_DKIM_WL From: address is in the default DKIM
Posted by Tom Williams via users <us...@spamassassin.apache.org>.
Hi! Casual observer here, but I have a question about the headers.
On 1/29/25 12:23 AM, Niamh Holding wrote:
(snip)
> Authentication-Results: spf=softfail (sender IP is 2a01:111:f403:48::209)
> smtp.mailfrom=euroland.fr; dkim=pass (signature was verified)
> header.d=paypal.com;dmarc=pass action=none header.from=paypal.com;
> Received-SPF: SoftFail (protection.outlook.com: domain of transitioning
> euroland.fr discourages use of 2a01:111:f403:48::209 as permitted sender)
(snip)
Why wouldn't the SPF softfail messages not trigger some kind of rule?
Especially the "discourages use of" message. Also, I noticed
Spamassassin 3.4.6 is being used. Would Spamassassin 4.0 have done a
better job at processing these headers?
Thanks!
Tom
Re: Fake paypal email triggers -7.5 USER_IN_DEF_DKIM_WL From: address is in the default DKIM
Posted by Rupert Gallagher <ru...@protonmail.com>.
https://mxtoolbox.com/Public/Tools/EmailHeaders.aspx?huid=561ac22d-1661-421c-85c3-52f68d2f46cb
-------- Original Message --------
> Given the From: address can be so easily faked is a rule testing its validity a great idea?
Re: Fake paypal email triggers -7.5 USER_IN_DEF_DKIM_WL From: address is in the default DKIM
Posted by joe a <jo...@j4computers.com>.
On 2/6/2025 10:38:01, Bill Cole wrote:
> On 2025-02-06 at 09:59:14 UTC-0500 (Thu, 6 Feb 2025 14:59:14 +0000)
> Niamh Holding <ni...@fullbore.co.uk>
> is rumored to have said:
>
>> Hello Giovanni,
>>
>> Thursday, January 30, 2025, 2:28:18 PM, you wrote:
>>
>> gpi> Paypal[.]com has been removed from default WL in November
>> (https://github.com/apache/spamassassin/commit/76906e0c7c064391bf832b3eb885ae74aed6c8b5)
>> gpi> With updated rules USER_IN_DEF_DKIM_WL should not hit.
>>
>> Though paypal.de still hits this rule as of yesterday.
>
>
> Fixed. Should be in the distributed rules in a few days:
>
> # svn commit -m "remove Paypal ccTLD domains from welcomelist"
> Authentication realm: <https://svn.apache.org:443> ASF Committers
> Password for 'billcole': ***************
>
> Sending 60_welcomelist_dkim.cf
> Sending 60_welcomelist_spf.cf
> Transmitting file data ..done
> Committing transaction...
> Committed revision 1923613.
FYI, I also hit this morning and am in USA (no further comment) with
default for sa-update, which shows nothing to change.
(sorry for the off list reply earlier)
Re: Fake paypal email triggers -7.5 USER_IN_DEF_DKIM_WL From: address is in the default DKIM
Posted by Bill Cole <sa...@billmail.scconsult.com>.
On 2025-02-06 at 09:59:14 UTC-0500 (Thu, 6 Feb 2025 14:59:14 +0000)
Niamh Holding <ni...@fullbore.co.uk>
is rumored to have said:
> Hello Giovanni,
>
> Thursday, January 30, 2025, 2:28:18 PM, you wrote:
>
> gpi> Paypal[.]com has been removed from default WL in November
> (https://github.com/apache/spamassassin/commit/76906e0c7c064391bf832b3eb885ae74aed6c8b5)
> gpi> With updated rules USER_IN_DEF_DKIM_WL should not hit.
>
> Though paypal.de still hits this rule as of yesterday.
Fixed. Should be in the distributed rules in a few days:
# svn commit -m "remove Paypal ccTLD domains from welcomelist"
Authentication realm: <https://svn.apache.org:443> ASF Committers
Password for 'billcole': ***************
Sending 60_welcomelist_dkim.cf
Sending 60_welcomelist_spf.cf
Transmitting file data ..done
Committing transaction...
Committed revision 1923613.
--
Bill Cole
bill@scconsult.com or billcole@apache.org
(AKA @grumpybozo@toad.social and many *@billmail.scconsult.com
addresses)
Not Currently Available For Hire
Re: Fake paypal email triggers -7.5 USER_IN_DEF_DKIM_WL From: address is in the default DKIM
Posted by Niamh Holding <ni...@fullbore.co.uk>.
Hello Giovanni,
Thursday, January 30, 2025, 2:28:18 PM, you wrote:
gpi> Paypal[.]com has been removed from default WL in November (https://github.com/apache/spamassassin/commit/76906e0c7c064391bf832b3eb885ae74aed6c8b5)
gpi> With updated rules USER_IN_DEF_DKIM_WL should not hit.
Though paypal.de still hits this rule as of yesterday.
--
Best regards,
Niamh mailto:niamh@fullbore.co.uk
Re: Fake paypal email triggers -7.5 USER_IN_DEF_DKIM_WL From: address is in the default DKIM
Posted by Niamh Holding <ni...@fullbore.co.uk>.
Hello Greg,
Thursday, January 30, 2025, 2:45:09 PM, you wrote:
GT> Thanks. I should have looked in current data. People using old
GT> distribution-provided SA is a real problem, but one that doesn't seem
GT> fixable.
Ah, I had the wrong path in crontab to sa-update
This should sort the updates-
23 4 * * * /usr/bin/sa-update -D --channel updates.spamassassin.org && systemctl restart spamassassin
--
Best regards,
Niamh mailto:niamh@fullbore.co.uk
Re: Fake paypal email triggers -7.5 USER_IN_DEF_DKIM_WL From: address is in the default DKIM
Posted by Greg Troxel <gd...@lexort.com>.
giovanni@paclan.it writes:
> Paypal[.]com has been removed from default WL in November (https://github.com/apache/spamassassin/commit/76906e0c7c064391bf832b3eb885ae74aed6c8b5)
> With updated rules USER_IN_DEF_DKIM_WL should not hit.
Thanks. I should have looked in current data. People using old
distribution-provided SA is a real problem, but one that doesn't seem
fixable.
Re: Fake paypal email triggers -7.5 USER_IN_DEF_DKIM_WL From: address is in the default DKIM
Posted by gi...@paclan.it.
On 1/30/25 1:53 AM, Greg Troxel wrote:
> Mark London <mr...@psfc.mit.edu> writes:
>
>> Alan, you’ve pointed out the issue with the scam emails. Specifically
>> with the phone number. Venmo emails are doing something similar. I’m
>> sure thst PayPal and Venmo will not do anything to stop these. PayPal
>> knows about it. They have warnings on their website about the
>> scams. That’s all they will do.
>
> If paypal is allowing user-generated content to leave @paypal.com with
> valid DKIM, then they should be immediately removed from default WL.
> The usual responsible practice is to have a separate domain for customer
> mails and company-originated mail. E.g. verizon.com vs verizon.net,
> google.com vs gmail.com.
Paypal[.]com has been removed from default WL in November (https://github.com/apache/spamassassin/commit/76906e0c7c064391bf832b3eb885ae74aed6c8b5)
With updated rules USER_IN_DEF_DKIM_WL should not hit.
Regards
Giovanni
Re: Fake paypal email triggers -7.5 USER_IN_DEF_DKIM_WL From: address is in the default DKIM
Posted by Greg Troxel <gd...@lexort.com>.
Mark London <mr...@psfc.mit.edu> writes:
> Alan, you’ve pointed out the issue with the scam emails. Specifically
> with the phone number. Venmo emails are doing something similar. I’m
> sure thst PayPal and Venmo will not do anything to stop these. PayPal
> knows about it. They have warnings on their website about the
> scams. That’s all they will do.
If paypal is allowing user-generated content to leave @paypal.com with
valid DKIM, then they should be immediately removed from default WL.
The usual responsible practice is to have a separate domain for customer
mails and company-originated mail. E.g. verizon.com vs verizon.net,
google.com vs gmail.com.
Re: Fake paypal email triggers -7.5 USER_IN_DEF_DKIM_WL From: address is in the default DKIM
Posted by Mark London <mr...@psfc.mit.edu>.
Alan, you’ve pointed out the issue with the scam emails. Specifically with the phone number. Venmo emails are doing something similar. I’m sure thst PayPal and Venmo will not do anything to stop these. PayPal knows about it. They have warnings on their website about the scams. That’s all they will do.
My community never gets such requests and invoices from PayPal. My spam rule leans heavily on the phone number. But my rule is probably too strict for other communities.
> On Jan 29, 2025, at 11:23 AM, Alan via users <us...@spamassassin.apache.org> wrote:
> trigger sufficient anxiety that the recipient calls the phone number in the message, which connects them to a scammer. It will get worse, and then hopefully the folks at PayPal will find a way to eliminate it (they could refuse to send a phone number in the message, for example)
Re: Fake paypal email triggers -7.5 USER_IN_DEF_DKIM_WL From: address is in the default DKIM
Posted by Alan Hodgson <ah...@lists.simkin.ca>.
On Wed, 2025-01-29 at 11:23 -0500, Alan via users wrote:
>
> As far as I can tell, they're valid notifications from PayPal, and
> probably useful for legitimate purposes. What the messages are
> doing is attempting to trigger sufficient anxiety that the
> recipient calls the phone number in the message, which connects
> them to a scammer. It will get worse, and then hopefully the folks
> at PayPal will find a way to eliminate it (they could refuse to
> send a phone number in the message, for example).
If they're letting third parties provide any of the content in the
email, it'll get abused.
Re: Fake paypal email triggers -7.5 USER_IN_DEF_DKIM_WL From: address is in the default DKIM
Posted by "Anne P. Mitchell, Esq." <am...@isipp.com>.
> On Jan 29, 2025, at 9:23 AM, Alan via users <us...@spamassassin.apache.org> wrote:
>
> As far as I can tell, they're valid notifications from PayPal, and probably useful for legitimate purposes. What the messages are doing is attempting to trigger sufficient anxiety that the recipient calls the phone number in the message, which connects them to a scammer. It will get worse, and then hopefully the folks at PayPal will find a way to eliminate it (they could refuse to send a phone number in the message, for example).
One thing I have noted that they all have in common (so far at least) is that the 1 prefix of the phone number is actually an uppercase i (so "I" not "1"), so that spam filters can identify the scams by filtering on "Call-I("
Anne
--
Anne P. Mitchell, Esq.
Email Law & Policy Attorney
Legislative Advisor
Author: Section 6 of the CAN-SPAM Act of 2003 (the Federal email marketing law)
CEO Institute for Social Internet Public Policy
Board of Directors, Denver Internet Exchange
Dean Emeritus, Cyberlaw & Cybersecurity, Lincoln Law School
Prof. Emeritus, Lincoln Law School
Chair Emeritus, Asilomar Microcomputer Workshop
Counsel Emeritus, eMail Abuse Prevention System (MAPS)
Re: Fake paypal email triggers -7.5 USER_IN_DEF_DKIM_WL From: address is in the default DKIM
Posted by Max Erenburg via users <us...@spamassassin.apache.org>.
Can anyone who may have worked at MS, AWS, Google speak to whether these giants with their Ai actually scan outbound email from their very own relay/edge servers? Or do they forgo doing so because its their “customers” emails?
Sent from my iPhone
> On Feb 7, 2025, at 1:12 PM, Kris Deugau <kd...@vianet.ca> wrote:
>
> Dave Funk wrote:
>> The examples of this scam that I've seen use that same PayPal comment tactic but then route it to an Office-365 mailbox which has a redirect to the victim's address.
>> So the resultant message has both PayPal & O-365 valid DKIM signatures; not to mention the multiple KB of O-365 header cruft which makes it hard to trace the original source.
>
> Just to throw some extra, um, "joy" into this conversation...
>
> I've just seen a sample, received directly by our spam filter tuning role account, that first travelled through a Google account (probably GMail, if I've unwound the headers right), which forwarded to the compromised/scammer-owned M365 tenant, which forwarded to us (and who knows who all else.
>
> I'll report it to PayPal, Google, and MS, but watch as nothing happens...
>
> GNGGNGNGNGNNNNNNNNNGGH.....
>
> -kgd
Re: Fake paypal email triggers -7.5 USER_IN_DEF_DKIM_WL From: address is in the default DKIM
Posted by John Hardin <jh...@impsec.org>.
On Fri, 7 Feb 2025, Kris Deugau wrote:
> Dave Funk wrote:
>>
>> The examples of this scam that I've seen use that same PayPal comment
>> tactic but then route it to an Office-365 mailbox which has a redirect to
>> the victim's address.
>> So the resultant message has both PayPal & O-365 valid DKIM signatures;
>> not to mention the multiple KB of O-365 header cruft which makes it hard
>> to trace the original source.
>
> Just to throw some extra, um, "joy" into this conversation...
>
> I've just seen a sample, received directly by our spam filter tuning role
> account, that first travelled through a Google account (probably GMail, if
> I've unwound the headers right), which forwarded to the
> compromised/scammer-owned M365 tenant, which forwarded to us (and who knows
> who all else.
>
> I'll report it to PayPal, Google, and MS, but watch as nothing happens...
>
> GNGGNGNGNGNNNNNNNNNGGH.....
>
> -kgd
These sort of shenanigans are fairly easy to spot, but... if the masscheck
corpora don't have sufficient examples of them, or potentially worse do
have examples of them that are misclassified as ham, then those rules will
never be published with scores high enough to make a difference unless the
scores are set manually, which increases their FP risk.
I'd ask all who are doing masschecks to review their corpora of Paypal
messages to see whether these messages, and Paypal messages with
obfuscated phone numbers, are misclassified as ham.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
Win95: Where do you want to go today?
Vista: Where will Microsoft allow you to go today?
-----------------------------------------------------------------------
4 days until Abraham Lincoln's and Charles Darwin's 216th Birthdays
Re: Fake paypal email triggers -7.5 USER_IN_DEF_DKIM_WL From: address is in the default DKIM
Posted by Kris Deugau <kd...@vianet.ca>.
Dave Funk wrote:
>
> The examples of this scam that I've seen use that same PayPal comment
> tactic but then route it to an Office-365 mailbox which has a redirect
> to the victim's address.
> So the resultant message has both PayPal & O-365 valid DKIM signatures;
> not to mention the multiple KB of O-365 header cruft which makes it hard
> to trace the original source.
Just to throw some extra, um, "joy" into this conversation...
I've just seen a sample, received directly by our spam filter tuning
role account, that first travelled through a Google account (probably
GMail, if I've unwound the headers right), which forwarded to the
compromised/scammer-owned M365 tenant, which forwarded to us (and who
knows who all else.
I'll report it to PayPal, Google, and MS, but watch as nothing happens...
GNGGNGNGNGNNNNNNNNNGGH.....
-kgd
Re: Fake paypal email triggers -7.5 USER_IN_DEF_DKIM_WL From: address is in the default DKIM
Posted by Dave Funk <db...@engineering.uiowa.edu>.
The examples of this scam that I've seen use that same PayPal comment tactic but
then route it to an Office-365 mailbox which has a redirect to the victim's
address.
So the resultant message has both PayPal & O-365 valid DKIM signatures; not to
mention the multiple KB of O-365 header cruft which makes it hard to trace the
original source.
They tend to fall into two general themes:
1) call us NOW or we're going to auto-charge your account
2) Oopsies, you were miss-charged, call us to get this charge refunded to your
account.
In most cases all the usual PayPal & O-365 checks pass with flying colors, it's
just the text comment that has the scam payload.
As our organization is heavily invested in Microsoft/O-365 we get tons of valid
necessary communications from O-365 so I cannot block/penalize O-365 messages.
Thus even Bayes training on this scam garbage doesn't help me, I get 1000x legit
O-365 messages to each such scam.
Ugg.
On Wed, 29 Jan 2025, Alan via users wrote:
>
> As far as I can tell, they're valid notifications from PayPal, and probably useful for legitimate purposes. What the messages are
> doing is attempting to trigger sufficient anxiety that the recipient calls the phone number in the message, which connects them
> to a scammer. It will get worse, and then hopefully the folks at PayPal will find a way to eliminate it (they could refuse to
> send a phone number in the message, for example).
>
> On 2025-01-29 03:47, Mark London wrote:
> This my pet peeve. I set USER_IN_DEF_DKIM_WL to 0.001 a long time ago, and it hasn't affected me at all.
>
> But my view is probably not mainstream.
>
> As an aside, I've added rules to filter for the recent fake requests for money, that abuse that feature, which exists
> on PAYPAL and VENMO. Rules can be easily created to detect these fake requests, if you look at some the examples
> that come through. They aren't very sophisticated. FWIW.
>
> Now I'll go back into hiding, - Mark
>
> On 1/29/2025 3:23 AM, Niamh Holding wrote:
> Hello
>
> Given the From: address can be so easily faked is a rule testing its validity a great idea?
>
>
> Headers-
>
> Return-Path: <bo...@smpn7wonogiri.sch.id>
> X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on iron.holtain.net
> X-Spam-Level:
> X-Spam-Status: No, score=-6.5 required=4.5 autolearn=no autolearn_force=no
> X-Spam-Report:
> * 0.0 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
> * [40.93.128.29 listed in wl.mailspike.net]
> * -0.0 SPF_PASS SPF: sender matches SPF record
> * 0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
> * mail domains are different
> * -0.0 SPF_HELO_PASS SPF: HELO matches SPF record
> * -7.5 USER_IN_DEF_DKIM_WL From: address is in the default DKIM
> * welcome-list
> * 0.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
> * 0.0 HTML_MESSAGE BODY: HTML included in message
> * 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily
> * valid
> * -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from
> * author's domain
> * -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
> * 1.3 RCVD_IN_VALIDITY_RPBL RBL: Relay in Validity RPBL,
> * https://senderscore.org/blocklistlookup/
> * [40.93.128.29 listed in bl.score.senderscore.com]
> * -0.0 T_SCC_BODY_TEXT_LINE No description available.
> * 1.0 POSSIBLE_PAYPAL_PHISH_03 Claims to be from paypal, sent to
> * Microsoft365 domain - likely fraud if you don't use MSFT365!
> * 0.0 T_REMOTE_IMAGE Message contains an external image
> * -1.3 DKIMWL_WL_HIGH DKIMwl.org - High trust sender
> X-Spam-Relays-Untrusted: [ ip=40.93.128.29
> rdns=mail-eastasiaazlp17011029.outbound.protection.outlook.com
> helo=HK3PR03CU002.outbound.protection.outlook.com by=iron.holtain.net
> ident= envfrom= intl=0 id=8EA1DC000546 auth= msa=0 ] [
> ip=2603:1096:405:8e::12 rdns=TYSPR04MB8220.apcprd04.prod.outlook.com
> helo=TYSPR04MB8220.apcprd04.prod.outlook.com
> by=TYZPR04MB7906.apcprd04.prod.outlook.com ident= envfrom= intl=0
> id=15.20.8377.21 auth= msa=0 ] [ ip=2603:1096:820:11b::9
> rdns=KL1PR04MB7539.apcprd04.prod.outlook.com
> helo=KL1PR04MB7539.apcprd04.prod.outlook.com
> by=TYSPR04MB8220.apcprd04.prod.outlook.com ident= envfrom= intl=0
> id=15.20.8377.21 auth= msa=0 ] [ ip=fe80::b078:df3:b558:4f13 rdns=
> helo=KL1PR04MB7539.apcprd04.prod.outlook.com
> by=KL1PR04MB7539.apcprd04.prod.outlook.com ident= envfrom= intl=0 id=
> auth= msa=0 ] [ ip=2603:1096:4:b8::34
> rdns=SGXP274CA0022.SGPP274.PROD.OUTLOOK.COM
> helo=SGXP274CA0022.SGPP274.PROD.OUTLOOK.COM
> by=TYZPR04MB7271.apcprd04.prod.outlook.com ident= envfrom= intl=0
> id=15.20.8377.21 auth= msa=0 ] [ ip=2603:1096:4:b8:cafe::6f
> rdns=SG2PEPF000B66CE.apcprd03.prod.outlook.com
> helo=SG2PEPF000B66CE.apcprd03.prod.outlook.com
> by=SGXP274CA0022.outlook.office365.com ident= envfrom= intl=0
> id=15.20.8398.17 auth= msa=0 ] [ ip=2a01:111:f403:48::209
> rdns=EUR03-VI1-obe.outbound.protection.outlook.com
> helo=EUR03-VI1-obe.outbound.protection.outlook.com
> by=SG2PEPF000B66CE.mail.protection.outlook.com ident= envfrom= intl=0
> id=15.20.8398.14 auth= msa=0 ] [ ip=2603:10a6:5:10::31
> rdns=DB7P192MB0331.EURP192.PROD.OUTLOOK.COM
> helo=DB7P192MB0331.EURP192.PROD.OUTLOOK.COM
> by=AS8P192MB2065.EURP192.PROD.OUTLOOK.COM ident= envfrom= intl=0
> id=15.20.8377.22 auth= msa=0 ] [ ip=fe80::306f:e2a6:6620:fff0 rdns=
> helo=DB7P192MB0331.EURP192.PROD.OUTLOOK.COM
> by=DB7P192MB0331.EURP192.PROD.OUTLOOK.COM ident= envfrom= intl=0 id=
> auth= msa=0 ] [ ip=2603:10a6:10:120::12
> rdns=DB8PR06CA0038.eurprd06.prod.outlook.com
> helo=DB8PR06CA0038.eurprd06.prod.outlook.com
> by=PAWP192MB2250.EURP192.PROD.OUTLOOK.COM ident= envfrom= intl=0
> id=15.20.8377.22 auth= msa=0 ] [ ip=2603:10a6:10:120:cafe::e9
> rdns=DU2PEPF00028CFD.eurprd03.prod.outlook.com
> helo=DU2PEPF00028CFD.eurprd03.prod.outlook.com
> by=DB8PR06CA0038.outlook.office365.com ident= envfrom= intl=0
> id=15.20.8377.22 auth= msa=0 ] [ ip=66.211.170.90
> rdns=mx4.phx.paypal.com helo=mx4.phx.paypal.com
> by=DU2PEPF00028CFD.mail.protection.outlook.com ident= envfrom= intl=0
> id=15.20.8398.14 auth= msa=0 ]
> X-Spam-Language: en
> X-Spam-DKIM-i: @paypal.com
> X-Spam-DKIM-d: paypal.com
> X-Original-To: niamh@fullbore.co.uk
> Delivered-To: niamh.fullbore@iron.holtain.net
> Received-SPF: Pass (mailfrom) identity=mailfrom; client-ip=40.93.128.29;
> helo=hk3pr03cu002.outbound.protection.outlook.com;
> envelope-from=bounces+srs=4a6bc=uu@smpn7wonogiri.sch.id; receiver=<UNKNOWN>
> DMARC-Filter: OpenDMARC Filter v1.4.2 iron.holtain.net 8EA1DC000546
> Authentication-Results: iron.holtain.net; dmarc=pass (p=reject dis=none) header.from=paypal.com
> Authentication-Results: iron.holtain.net; spf=pass smtp.mailfrom=smpn7wonogiri.sch.id
> DKIM-Filter: OpenDKIM Filter v2.11.0 iron.holtain.net 8EA1DC000546
> Authentication-Results: iron.holtain.net;
> dkim=pass (2048-bit key, unprotected) header.d=paypal.com header.i=@paypal.com
> header.a=rsa-sha256 header.s=pp-dkim1 header.b=Ti5ZlN8t
> Received: from HK3PR03CU002.outbound.protection.outlook.com
> (mail-eastasiaazlp17011029.outbound.protection.outlook.com [40.93.128.29])
> by iron.holtain.net (Postfix) with ESMTPS id 8EA1DC000546
> for <ni...@fullbore.co.uk>; Tue, 28 Jan 2025 18:08:36 +0000 (GMT)
> Received: from TYSPR04MB8220.apcprd04.prod.outlook.com (2603:1096:405:8e::12)
> by TYZPR04MB7906.apcprd04.prod.outlook.com (2603:1096:405:a9::11) with
> Microsoft SMTP Server (version=TLS1_2,
> cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8377.21; Tue, 28 Jan
> 2025 18:08:28 +0000
> Received: from KL1PR04MB7539.apcprd04.prod.outlook.com (2603:1096:820:11b::9)
> by TYSPR04MB8220.apcprd04.prod.outlook.com (2603:1096:405:8e::12) with
> Microsoft SMTP Server (version=TLS1_2,
> cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8377.21; Tue, 28 Jan
> 2025 18:08:00 +0000
> Received: from KL1PR04MB7539.apcprd04.prod.outlook.com
> ([fe80::b078:df3:b558:4f13]) by KL1PR04MB7539.apcprd04.prod.outlook.com
> ([fe80::b078:df3:b558:4f13%3]) with mapi id 15.20.8377.021; Tue, 28 Jan 2025
> 18:07:59 +0000
> Received: from SGXP274CA0022.SGPP274.PROD.OUTLOOK.COM (2603:1096:4:b8::34) by
> TYZPR04MB7271.apcprd04.prod.outlook.com (2603:1096:400:44f::6) with Microsoft
> SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id
> 15.20.8377.21; Tue, 28 Jan 2025 17:50:17 +0000
> Received: from SG2PEPF000B66CE.apcprd03.prod.outlook.com
> (2603:1096:4:b8:cafe::6f) by SGXP274CA0022.outlook.office365.com
> (2603:1096:4:b8::34) with Microsoft SMTP Server (version=TLS1_3,
> cipher=TLS_AES_256_GCM_SHA384) id 15.20.8398.17 via Frontend Transport; Tue,
> 28 Jan 2025 17:50:17 +0000
> Authentication-Results: spf=softfail (sender IP is 2a01:111:f403:48::209)
> smtp.mailfrom=euroland.fr; dkim=pass (signature was verified)
> header.d=paypal.com;dmarc=pass action=none header.from=paypal.com;
> Received-SPF: SoftFail (protection.outlook.com: domain of transitioning
> euroland.fr discourages use of 2a01:111:f403:48::209 as permitted sender)
> Received: from EUR03-VI1-obe.outbound.protection.outlook.com
> (2a01:111:f403:48::209) by SG2PEPF000B66CE.mail.protection.outlook.com
> (2603:1096:f:fff5:0:1:0:5) with Microsoft SMTP Server (version=TLS1_3,
> cipher=TLS_AES_256_GCM_SHA384) id 15.20.8398.14 via Frontend Transport; Tue,
> 28 Jan 2025 17:50:16 +0000
> Received: from DB7P192MB0331.EURP192.PROD.OUTLOOK.COM (2603:10a6:5:10::31) by
> AS8P192MB2065.EURP192.PROD.OUTLOOK.COM (2603:10a6:20b:5bd::19) with Microsoft
> SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id
> 15.20.8377.22; Tue, 28 Jan 2025 17:50:13 +0000
> Received: from DB7P192MB0331.EURP192.PROD.OUTLOOK.COM
> ([fe80::306f:e2a6:6620:fff0]) by DB7P192MB0331.EURP192.PROD.OUTLOOK.COM
> ([fe80::306f:e2a6:6620:fff0%5]) with mapi id 15.20.8377.021; Tue, 28 Jan 2025
> 17:50:13 +0000
> Received: from DB8PR06CA0038.eurprd06.prod.outlook.com (2603:10a6:10:120::12)
> by PAWP192MB2250.EURP192.PROD.OUTLOOK.COM (2603:10a6:102:34e::21) with
> Microsoft SMTP Server (version=TLS1_2,
> cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8377.22; Tue, 28 Jan
> 2025 17:49:51 +0000
> Received: from DU2PEPF00028CFD.eurprd03.prod.outlook.com
> (2603:10a6:10:120:cafe::e9) by DB8PR06CA0038.outlook.office365.com
> (2603:10a6:10:120::12) with Microsoft SMTP Server (version=TLS1_3,
> cipher=TLS_AES_256_GCM_SHA384) id 15.20.8377.22 via Frontend Transport; Tue,
> 28 Jan 2025 17:49:51 +0000
> Authentication-Results-Original: spf=pass (sender IP is 66.211.170.90)
> smtp.mailfrom=paypal.com; dkim=pass (signature was verified)
> header.d=paypal.com;dmarc=pass action=none header.from=paypal.com;
> Received-SPF: Pass (protection.outlook.com: domain of paypal.com designates
> 66.211.170.90 as permitted sender) receiver=protection.outlook.com;
> client-ip=66.211.170.90; helo=mx4.phx.paypal.com; pr=C
> Received: from mx4.phx.paypal.com (66.211.170.90) by
> DU2PEPF00028CFD.mail.protection.outlook.com (10.167.242.181) with Microsoft
> SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id
> 15.20.8398.14 via Frontend Transport; Tue, 28 Jan 2025 17:49:50 +0000
> DKIM-Signature: v=1; a=rsa-sha256; d=paypal.com; s=pp-dkim1; c=relaxed/relaxed;
> q=dns/txt; i=@paypal.com; t=1738086589;
> h=From:From:Subject:Date:To:MIME-Version:Content-Type;
> bh=x4gXgJPzgMJS4s6SslPDX50DN37l6UgxYv1Fke0blj4=;
> b=Ti5ZlN8t9vOP4oHPw6S7EFSv5qCloXAAcGFhN1UUYPh8b+kHEbenBvfdHtOlBzCF
> 7lCfc0LH2NGC6vIhFkmbmn490P6XkzLMgQwi9IcUaQTZrUIeD8r5YPRT5b/Y4RmA
> VqAbuOE/7S20QxDlpoCqOprRhS/39AvB5W/QuCyzPn6uf+IjwQjyd7f8imwXsGGD
> O+hiNma12uuMIgpeuAdk5PNYrZJv9UZA6Ta9OZP1LyowQPFIdPaIJf4ACHUkBGaa
> fChq5r8wr7lBUGY/5ft8dfpmzcj3QiEcytLWYQ4niDlTJAMZcPI3OSuoyiwXjFJq
> yuYqt5ZZhMyeauUvreQNbw==;
> Content-Transfer-Encoding: quoted-printable
> Content-Type: text/html; charset="UTF-8"
> Date: Tue, 28 Jan 2025 09:49:49 -0800
> Message-ID: <AD...@ccg01mail06>
> MIME-Version: 1.0
> From: "service@paypal.com" <se...@paypal.com>
> To: Sharon Turner <or...@Euroland.onmicrosoft.com>
> Subject: You've sent a money request
> X-MaxCode-Template: RT000241
> X-PP-Priority: 0-paypal-false
> PP-Correlation-Id: f388091b585de
> X-PP-Email-transmission-Id: 44cd845b-dda0-11ef-bbbe-0f3c32714b27
> X-PP-REQUESTED-TIME: 1738086577206
> X-Email-Type-Id: RT000241
> AMQ-Delivery-Message-Id: nullval
> X-XPT-XSL-Name: nullval
> X-EOPAttributedMessage: 1
> X-MS-TrafficTypeDiagnostic:
> DU2PEPF00028CFD:EE_|PAWP192MB2250:EE_|AS8P192MB2065:EE_|SG2PEPF000B66CE:EE_|TYZPR04MB7271:EE_|TYSPR04MB8220:EE_|TYZPR04MB7906:EE
> _
> X-MS-Office365-Filtering-Correlation-Id: 198a6f79-7e5b-4b79-7cbb-08dd3fc43981
> X-Moderation-Data: 1/28/2025 5:50:06 PM
> X-LD-Processed: 597638ac-1f39-416f-b8b6-2a57af6395fe,ExtAddr
> X-Auto-Response-Suppress: DR, OOF, AutoReply
> X-MS-Exchange-Transport-CrossTenantHeadersStamped: AS8P192MB2065
> X-EOPTenantAttributedMessage: 7ab5503a-6b18-41b1-ab89-bb02ef5b5daf:0
> X-MS-Exchange-Transport-CrossTenantHeadersStripped: SG2PEPF000B66CE.apcprd03.prod.outlook.com
> X-MS-Exchange-Transport-CrossTenantHeadersPromoted: SG2PEPF000B66CE.apcprd03.prod.outlook.com
> X-MS-PublicTrafficType: Email
> X-MS-Office365-Filtering-Correlation-Id-Prvs:
> 5c11a4de-9c64-4aae-d96a-08dd3fc42a48
> X-Moderation-Data: 1/28/2025 6:07:58 PM
> X-LD-Processed: 7ab5503a-6b18-41b1-ab89-bb02ef5b5daf,ExtAddr,ExtAddr
> X-OriginatorOrg: smpn7wonogiri.sch.id
> X-MS-Exchange-CrossTenant-Network-Message-Id: 198a6f79-7e5b-4b79-7cbb-08dd3fc43981
> X-MS-Exchange-CrossTenant-Id: 7ab5503a-6b18-41b1-ab89-bb02ef5b5daf
> X-MS-Exchange-CrossTenant-AuthSource: SG2PEPF000B66CE.apcprd03.prod.outlook.com
> X-MS-Exchange-CrossTenant-AuthAs: Anonymous
> X-MS-Exchange-CrossTenant-FromEntityHeader: Internet
> X-MS-Exchange-CrossTenant-OriginalArrivalTime: 28 Jan 2025 18:07:59.9852
> (UTC)
> X-MS-Exchange-Transport-CrossTenantHeadersStamped: TYZPR04MB790
>
>
> --
> For SpamAssassin Users List
>
>
--
Dave Funk University of Iowa
<dbfunk (at) engineering.uiowa.edu> College of Engineering
319/335-5751 FAX: 319/384-0549 1256 Seamans Center, 103 S Capitol St.
Sys_admin/Postmaster/cell_admin Iowa City, IA 52242-1527
#include <std_disclaimer.h>
Better is not better, 'standard' is better. B{
Re: Fake paypal email triggers -7.5 USER_IN_DEF_DKIM_WL From: address is in the default DKIM
Posted by Alan via users <us...@spamassassin.apache.org>.
As far as I can tell, they're valid notifications from PayPal, and
probably useful for legitimate purposes. What the messages are doing is
attempting to trigger sufficient anxiety that the recipient calls the
phone number in the message, which connects them to a scammer. It will
get worse, and then hopefully the folks at PayPal will find a way to
eliminate it (they could refuse to send a phone number in the message,
for example).
On 2025-01-29 03:47, Mark London wrote:
> This my pet peeve. I set USER_IN_DEF_DKIM_WL to 0.001 a long time
> ago, and it hasn't affected me at all.
>
> But my view is probably not mainstream.
>
> As an aside, I've added rules to filter for the recent fake requests
> for money, that abuse that feature, which exists on PAYPAL and VENMO.
> Rules can be easily created to detect these fake requests, if you look
> at some the examples that come through. They aren't very
> sophisticated. FWIW.
>
> Now I'll go back into hiding, - Mark
>
> On 1/29/2025 3:23 AM, Niamh Holding wrote:
>> Hello
>>
>> Given the From: address can be so easily faked is a rule testing its
>> validity a great idea?
>>
>>
>> Headers-
>>
>> Return-Path: <bo...@smpn7wonogiri.sch.id>
>> X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
>> iron.holtain.net
>> X-Spam-Level:
>> X-Spam-Status: No, score=-6.5 required=4.5 autolearn=no
>> autolearn_force=no
>> X-Spam-Report:
>> * 0.0 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
>> * [40.93.128.29 listed in wl.mailspike.net]
>> * -0.0 SPF_PASS SPF: sender matches SPF record
>> * 0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom
>> 2nd level
>> * mail domains are different
>> * -0.0 SPF_HELO_PASS SPF: HELO matches SPF record
>> * -7.5 USER_IN_DEF_DKIM_WL From: address is in the default DKIM
>> * welcome-list
>> * 0.1 MIME_HTML_ONLY BODY: Message only has text/html MIME
>> parts
>> * 0.0 HTML_MESSAGE BODY: HTML included in message
>> * 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not
>> necessarily
>> * valid
>> * -0.1 DKIM_VALID_AU Message has a valid DKIM or DK
>> signature from
>> * author's domain
>> * -0.1 DKIM_VALID Message has at least one valid DKIM or DK
>> signature
>> * 1.3 RCVD_IN_VALIDITY_RPBL RBL: Relay in Validity RPBL,
>> * https://senderscore.org/blocklistlookup/
>> * [40.93.128.29 listed in bl.score.senderscore.com]
>> * -0.0 T_SCC_BODY_TEXT_LINE No description available.
>> * 1.0 POSSIBLE_PAYPAL_PHISH_03 Claims to be from paypal,
>> sent to
>> * Microsoft365 domain - likely fraud if you don't use
>> MSFT365!
>> * 0.0 T_REMOTE_IMAGE Message contains an external image
>> * -1.3 DKIMWL_WL_HIGH DKIMwl.org - High trust sender
>> X-Spam-Relays-Untrusted: [ ip=40.93.128.29
>> rdns=mail-eastasiaazlp17011029.outbound.protection.outlook.com
>> helo=HK3PR03CU002.outbound.protection.outlook.com
>> by=iron.holtain.net
>> ident= envfrom= intl=0 id=8EA1DC000546 auth= msa=0 ] [
>> ip=2603:1096:405:8e::12
>> rdns=TYSPR04MB8220.apcprd04.prod.outlook.com
>> helo=TYSPR04MB8220.apcprd04.prod.outlook.com
>> by=TYZPR04MB7906.apcprd04.prod.outlook.com ident= envfrom=
>> intl=0
>> id=15.20.8377.21 auth= msa=0 ] [ ip=2603:1096:820:11b::9
>> rdns=KL1PR04MB7539.apcprd04.prod.outlook.com
>> helo=KL1PR04MB7539.apcprd04.prod.outlook.com
>> by=TYSPR04MB8220.apcprd04.prod.outlook.com ident= envfrom=
>> intl=0
>> id=15.20.8377.21 auth= msa=0 ] [ ip=fe80::b078:df3:b558:4f13
>> rdns=
>> helo=KL1PR04MB7539.apcprd04.prod.outlook.com
>> by=KL1PR04MB7539.apcprd04.prod.outlook.com ident= envfrom=
>> intl=0 id=
>> auth= msa=0 ] [ ip=2603:1096:4:b8::34
>> rdns=SGXP274CA0022.SGPP274.PROD.OUTLOOK.COM
>> helo=SGXP274CA0022.SGPP274.PROD.OUTLOOK.COM
>> by=TYZPR04MB7271.apcprd04.prod.outlook.com ident= envfrom=
>> intl=0
>> id=15.20.8377.21 auth= msa=0 ] [ ip=2603:1096:4:b8:cafe::6f
>> rdns=SG2PEPF000B66CE.apcprd03.prod.outlook.com
>> helo=SG2PEPF000B66CE.apcprd03.prod.outlook.com
>> by=SGXP274CA0022.outlook.office365.com ident= envfrom= intl=0
>> id=15.20.8398.17 auth= msa=0 ] [ ip=2a01:111:f403:48::209
>> rdns=EUR03-VI1-obe.outbound.protection.outlook.com
>> helo=EUR03-VI1-obe.outbound.protection.outlook.com
>> by=SG2PEPF000B66CE.mail.protection.outlook.com ident=
>> envfrom= intl=0
>> id=15.20.8398.14 auth= msa=0 ] [ ip=2603:10a6:5:10::31
>> rdns=DB7P192MB0331.EURP192.PROD.OUTLOOK.COM
>> helo=DB7P192MB0331.EURP192.PROD.OUTLOOK.COM
>> by=AS8P192MB2065.EURP192.PROD.OUTLOOK.COM ident= envfrom=
>> intl=0
>> id=15.20.8377.22 auth= msa=0 ] [
>> ip=fe80::306f:e2a6:6620:fff0 rdns=
>> helo=DB7P192MB0331.EURP192.PROD.OUTLOOK.COM
>> by=DB7P192MB0331.EURP192.PROD.OUTLOOK.COM ident= envfrom=
>> intl=0 id=
>> auth= msa=0 ] [ ip=2603:10a6:10:120::12
>> rdns=DB8PR06CA0038.eurprd06.prod.outlook.com
>> helo=DB8PR06CA0038.eurprd06.prod.outlook.com
>> by=PAWP192MB2250.EURP192.PROD.OUTLOOK.COM ident= envfrom=
>> intl=0
>> id=15.20.8377.22 auth= msa=0 ] [ ip=2603:10a6:10:120:cafe::e9
>> rdns=DU2PEPF00028CFD.eurprd03.prod.outlook.com
>> helo=DU2PEPF00028CFD.eurprd03.prod.outlook.com
>> by=DB8PR06CA0038.outlook.office365.com ident= envfrom= intl=0
>> id=15.20.8377.22 auth= msa=0 ] [ ip=66.211.170.90
>> rdns=mx4.phx.paypal.com helo=mx4.phx.paypal.com
>> by=DU2PEPF00028CFD.mail.protection.outlook.com ident=
>> envfrom= intl=0
>> id=15.20.8398.14 auth= msa=0 ]
>> X-Spam-Language: en
>> X-Spam-DKIM-i: @paypal.com
>> X-Spam-DKIM-d: paypal.com
>> X-Original-To: niamh@fullbore.co.uk
>> Delivered-To: niamh.fullbore@iron.holtain.net
>> Received-SPF: Pass (mailfrom) identity=mailfrom;
>> client-ip=40.93.128.29;
>> helo=hk3pr03cu002.outbound.protection.outlook.com;
>> envelope-from=bounces+srs=4a6bc=uu@smpn7wonogiri.sch.id;
>> receiver=<UNKNOWN>
>> DMARC-Filter: OpenDMARC Filter v1.4.2 iron.holtain.net 8EA1DC000546
>> Authentication-Results: iron.holtain.net; dmarc=pass (p=reject
>> dis=none) header.from=paypal.com
>> Authentication-Results: iron.holtain.net; spf=pass
>> smtp.mailfrom=smpn7wonogiri.sch.id
>> DKIM-Filter: OpenDKIM Filter v2.11.0 iron.holtain.net 8EA1DC000546
>> Authentication-Results: iron.holtain.net;
>> dkim=pass (2048-bit key, unprotected) header.d=paypal.com
>> header.i=@paypal.com header.a=rsa-sha256 header.s=pp-dkim1
>> header.b=Ti5ZlN8t
>> Received: from HK3PR03CU002.outbound.protection.outlook.com
>> (mail-eastasiaazlp17011029.outbound.protection.outlook.com
>> [40.93.128.29])
>> by iron.holtain.net (Postfix) with ESMTPS id 8EA1DC000546
>> for <ni...@fullbore.co.uk>; Tue, 28 Jan 2025 18:08:36 +0000
>> (GMT)
>> Received: from TYSPR04MB8220.apcprd04.prod.outlook.com
>> (2603:1096:405:8e::12)
>> by TYZPR04MB7906.apcprd04.prod.outlook.com (2603:1096:405:a9::11) with
>> Microsoft SMTP Server (version=TLS1_2,
>> cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8377.21;
>> Tue, 28 Jan
>> 2025 18:08:28 +0000
>> Received: from KL1PR04MB7539.apcprd04.prod.outlook.com
>> (2603:1096:820:11b::9)
>> by TYSPR04MB8220.apcprd04.prod.outlook.com (2603:1096:405:8e::12) with
>> Microsoft SMTP Server (version=TLS1_2,
>> cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8377.21;
>> Tue, 28 Jan
>> 2025 18:08:00 +0000
>> Received: from KL1PR04MB7539.apcprd04.prod.outlook.com
>> ([fe80::b078:df3:b558:4f13]) by
>> KL1PR04MB7539.apcprd04.prod.outlook.com
>> ([fe80::b078:df3:b558:4f13%3]) with mapi id 15.20.8377.021; Tue, 28
>> Jan 2025
>> 18:07:59 +0000
>> Received: from SGXP274CA0022.SGPP274.PROD.OUTLOOK.COM
>> (2603:1096:4:b8::34) by
>> TYZPR04MB7271.apcprd04.prod.outlook.com (2603:1096:400:44f::6) with
>> Microsoft
>> SMTP Server (version=TLS1_2,
>> cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id
>> 15.20.8377.21; Tue, 28 Jan 2025 17:50:17 +0000
>> Received: from SG2PEPF000B66CE.apcprd03.prod.outlook.com
>> (2603:1096:4:b8:cafe::6f) by SGXP274CA0022.outlook.office365.com
>> (2603:1096:4:b8::34) with Microsoft SMTP Server (version=TLS1_3,
>> cipher=TLS_AES_256_GCM_SHA384) id 15.20.8398.17 via Frontend
>> Transport; Tue,
>> 28 Jan 2025 17:50:17 +0000
>> Authentication-Results: spf=softfail (sender IP is
>> 2a01:111:f403:48::209)
>> smtp.mailfrom=euroland.fr; dkim=pass (signature was verified)
>> header.d=paypal.com;dmarc=pass action=none header.from=paypal.com;
>> Received-SPF: SoftFail (protection.outlook.com: domain of transitioning
>> euroland.fr discourages use of 2a01:111:f403:48::209 as permitted
>> sender)
>> Received: from EUR03-VI1-obe.outbound.protection.outlook.com
>> (2a01:111:f403:48::209) by SG2PEPF000B66CE.mail.protection.outlook.com
>> (2603:1096:f:fff5:0:1:0:5) with Microsoft SMTP Server (version=TLS1_3,
>> cipher=TLS_AES_256_GCM_SHA384) id 15.20.8398.14 via Frontend
>> Transport; Tue,
>> 28 Jan 2025 17:50:16 +0000
>> Received: from DB7P192MB0331.EURP192.PROD.OUTLOOK.COM
>> (2603:10a6:5:10::31) by
>> AS8P192MB2065.EURP192.PROD.OUTLOOK.COM (2603:10a6:20b:5bd::19) with
>> Microsoft
>> SMTP Server (version=TLS1_2,
>> cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id
>> 15.20.8377.22; Tue, 28 Jan 2025 17:50:13 +0000
>> Received: from DB7P192MB0331.EURP192.PROD.OUTLOOK.COM
>> ([fe80::306f:e2a6:6620:fff0]) by
>> DB7P192MB0331.EURP192.PROD.OUTLOOK.COM
>> ([fe80::306f:e2a6:6620:fff0%5]) with mapi id 15.20.8377.021; Tue,
>> 28 Jan 2025
>> 17:50:13 +0000
>> Received: from DB8PR06CA0038.eurprd06.prod.outlook.com
>> (2603:10a6:10:120::12)
>> by PAWP192MB2250.EURP192.PROD.OUTLOOK.COM (2603:10a6:102:34e::21) with
>> Microsoft SMTP Server (version=TLS1_2,
>> cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8377.22;
>> Tue, 28 Jan
>> 2025 17:49:51 +0000
>> Received: from DU2PEPF00028CFD.eurprd03.prod.outlook.com
>> (2603:10a6:10:120:cafe::e9) by DB8PR06CA0038.outlook.office365.com
>> (2603:10a6:10:120::12) with Microsoft SMTP Server (version=TLS1_3,
>> cipher=TLS_AES_256_GCM_SHA384) id 15.20.8377.22 via Frontend
>> Transport; Tue,
>> 28 Jan 2025 17:49:51 +0000
>> Authentication-Results-Original: spf=pass (sender IP is 66.211.170.90)
>> smtp.mailfrom=paypal.com; dkim=pass (signature was verified)
>> header.d=paypal.com;dmarc=pass action=none header.from=paypal.com;
>> Received-SPF: Pass (protection.outlook.com: domain of paypal.com
>> designates
>> 66.211.170.90 as permitted sender) receiver=protection.outlook.com;
>> client-ip=66.211.170.90; helo=mx4.phx.paypal.com; pr=C
>> Received: from mx4.phx.paypal.com (66.211.170.90) by
>> DU2PEPF00028CFD.mail.protection.outlook.com (10.167.242.181) with
>> Microsoft
>> SMTP Server (version=TLS1_2,
>> cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id
>> 15.20.8398.14 via Frontend Transport; Tue, 28 Jan 2025 17:49:50 +0000
>> DKIM-Signature: v=1; a=rsa-sha256; d=paypal.com; s=pp-dkim1;
>> c=relaxed/relaxed;
>> q=dns/txt; i=@paypal.com; t=1738086589;
>> h=From:From:Subject:Date:To:MIME-Version:Content-Type;
>> bh=x4gXgJPzgMJS4s6SslPDX50DN37l6UgxYv1Fke0blj4=;
>> b=Ti5ZlN8t9vOP4oHPw6S7EFSv5qCloXAAcGFhN1UUYPh8b+kHEbenBvfdHtOlBzCF
>> 7lCfc0LH2NGC6vIhFkmbmn490P6XkzLMgQwi9IcUaQTZrUIeD8r5YPRT5b/Y4RmA
>> VqAbuOE/7S20QxDlpoCqOprRhS/39AvB5W/QuCyzPn6uf+IjwQjyd7f8imwXsGGD
>> O+hiNma12uuMIgpeuAdk5PNYrZJv9UZA6Ta9OZP1LyowQPFIdPaIJf4ACHUkBGaa
>> fChq5r8wr7lBUGY/5ft8dfpmzcj3QiEcytLWYQ4niDlTJAMZcPI3OSuoyiwXjFJq
>> yuYqt5ZZhMyeauUvreQNbw==;
>> Content-Transfer-Encoding: quoted-printable
>> Content-Type: text/html; charset="UTF-8"
>> Date: Tue, 28 Jan 2025 09:49:49 -0800
>> Message-ID: <AD...@ccg01mail06>
>> MIME-Version: 1.0
>> From: "service@paypal.com" <se...@paypal.com>
>> To: Sharon Turner <or...@Euroland.onmicrosoft.com>
>> Subject: You've sent a money request
>> X-MaxCode-Template: RT000241
>> X-PP-Priority: 0-paypal-false
>> PP-Correlation-Id: f388091b585de
>> X-PP-Email-transmission-Id: 44cd845b-dda0-11ef-bbbe-0f3c32714b27
>> X-PP-REQUESTED-TIME: 1738086577206
>> X-Email-Type-Id: RT000241
>> AMQ-Delivery-Message-Id: nullval
>> X-XPT-XSL-Name: nullval
>> X-EOPAttributedMessage: 1
>> X-MS-TrafficTypeDiagnostic:
>> DU2PEPF00028CFD:EE_|PAWP192MB2250:EE_|AS8P192MB2065:EE_|SG2PEPF000B66CE:EE_|TYZPR04MB7271:EE_|TYSPR04MB8220:EE_|TYZPR04MB7906:EE_
>> X-MS-Office365-Filtering-Correlation-Id:
>> 198a6f79-7e5b-4b79-7cbb-08dd3fc43981
>> X-Moderation-Data: 1/28/2025 5:50:06 PM
>> X-LD-Processed: 597638ac-1f39-416f-b8b6-2a57af6395fe,ExtAddr
>> X-Auto-Response-Suppress: DR, OOF, AutoReply
>> X-MS-Exchange-Transport-CrossTenantHeadersStamped: AS8P192MB2065
>> X-EOPTenantAttributedMessage: 7ab5503a-6b18-41b1-ab89-bb02ef5b5daf:0
>> X-MS-Exchange-Transport-CrossTenantHeadersStripped:
>> SG2PEPF000B66CE.apcprd03.prod.outlook.com
>> X-MS-Exchange-Transport-CrossTenantHeadersPromoted:
>> SG2PEPF000B66CE.apcprd03.prod.outlook.com
>> X-MS-PublicTrafficType: Email
>> X-MS-Office365-Filtering-Correlation-Id-Prvs:
>> 5c11a4de-9c64-4aae-d96a-08dd3fc42a48
>> X-Moderation-Data: 1/28/2025 6:07:58 PM
>> X-LD-Processed: 7ab5503a-6b18-41b1-ab89-bb02ef5b5daf,ExtAddr,ExtAddr
>> X-OriginatorOrg: smpn7wonogiri.sch.id
>> X-MS-Exchange-CrossTenant-Network-Message-Id:
>> 198a6f79-7e5b-4b79-7cbb-08dd3fc43981
>> X-MS-Exchange-CrossTenant-Id: 7ab5503a-6b18-41b1-ab89-bb02ef5b5daf
>> X-MS-Exchange-CrossTenant-AuthSource:
>> SG2PEPF000B66CE.apcprd03.prod.outlook.com
>> X-MS-Exchange-CrossTenant-AuthAs: Anonymous
>> X-MS-Exchange-CrossTenant-FromEntityHeader: Internet
>> X-MS-Exchange-CrossTenant-OriginalArrivalTime: 28 Jan 2025 18:07:59.9852
>> (UTC)
>> X-MS-Exchange-Transport-CrossTenantHeadersStamped: TYZPR04MB790
>
--
For SpamAssassin Users List
Re: Fake paypal email triggers -7.5 USER_IN_DEF_DKIM_WL From: address is in the default DKIM
Posted by Mark London <mr...@psfc.mit.edu>.
This my pet peeve. I set USER_IN_DEF_DKIM_WL to 0.001 a long time
ago, and it hasn't affected me at all.
But my view is probably not mainstream.
As an aside, I've added rules to filter for the recent fake requests for
money, that abuse that feature, which exists on PAYPAL and VENMO.
Rules can be easily created to detect these fake requests, if you look
at some the examples that come through. They aren't very sophisticated.
FWIW.
Now I'll go back into hiding, - Mark
On 1/29/2025 3:23 AM, Niamh Holding wrote:
> Hello
>
> Given the From: address can be so easily faked is a rule testing its validity a great idea?
>
>
> Headers-
>
> Return-Path: <bo...@smpn7wonogiri.sch.id>
> X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on iron.holtain.net
> X-Spam-Level:
> X-Spam-Status: No, score=-6.5 required=4.5 autolearn=no autolearn_force=no
> X-Spam-Report:
> * 0.0 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
> * [40.93.128.29 listed in wl.mailspike.net]
> * -0.0 SPF_PASS SPF: sender matches SPF record
> * 0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
> * mail domains are different
> * -0.0 SPF_HELO_PASS SPF: HELO matches SPF record
> * -7.5 USER_IN_DEF_DKIM_WL From: address is in the default DKIM
> * welcome-list
> * 0.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
> * 0.0 HTML_MESSAGE BODY: HTML included in message
> * 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily
> * valid
> * -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from
> * author's domain
> * -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
> * 1.3 RCVD_IN_VALIDITY_RPBL RBL: Relay in Validity RPBL,
> * https://senderscore.org/blocklistlookup/
> * [40.93.128.29 listed in bl.score.senderscore.com]
> * -0.0 T_SCC_BODY_TEXT_LINE No description available.
> * 1.0 POSSIBLE_PAYPAL_PHISH_03 Claims to be from paypal, sent to
> * Microsoft365 domain - likely fraud if you don't use MSFT365!
> * 0.0 T_REMOTE_IMAGE Message contains an external image
> * -1.3 DKIMWL_WL_HIGH DKIMwl.org - High trust sender
> X-Spam-Relays-Untrusted: [ ip=40.93.128.29
> rdns=mail-eastasiaazlp17011029.outbound.protection.outlook.com
> helo=HK3PR03CU002.outbound.protection.outlook.com by=iron.holtain.net
> ident= envfrom= intl=0 id=8EA1DC000546 auth= msa=0 ] [
> ip=2603:1096:405:8e::12 rdns=TYSPR04MB8220.apcprd04.prod.outlook.com
> helo=TYSPR04MB8220.apcprd04.prod.outlook.com
> by=TYZPR04MB7906.apcprd04.prod.outlook.com ident= envfrom= intl=0
> id=15.20.8377.21 auth= msa=0 ] [ ip=2603:1096:820:11b::9
> rdns=KL1PR04MB7539.apcprd04.prod.outlook.com
> helo=KL1PR04MB7539.apcprd04.prod.outlook.com
> by=TYSPR04MB8220.apcprd04.prod.outlook.com ident= envfrom= intl=0
> id=15.20.8377.21 auth= msa=0 ] [ ip=fe80::b078:df3:b558:4f13 rdns=
> helo=KL1PR04MB7539.apcprd04.prod.outlook.com
> by=KL1PR04MB7539.apcprd04.prod.outlook.com ident= envfrom= intl=0 id=
> auth= msa=0 ] [ ip=2603:1096:4:b8::34
> rdns=SGXP274CA0022.SGPP274.PROD.OUTLOOK.COM
> helo=SGXP274CA0022.SGPP274.PROD.OUTLOOK.COM
> by=TYZPR04MB7271.apcprd04.prod.outlook.com ident= envfrom= intl=0
> id=15.20.8377.21 auth= msa=0 ] [ ip=2603:1096:4:b8:cafe::6f
> rdns=SG2PEPF000B66CE.apcprd03.prod.outlook.com
> helo=SG2PEPF000B66CE.apcprd03.prod.outlook.com
> by=SGXP274CA0022.outlook.office365.com ident= envfrom= intl=0
> id=15.20.8398.17 auth= msa=0 ] [ ip=2a01:111:f403:48::209
> rdns=EUR03-VI1-obe.outbound.protection.outlook.com
> helo=EUR03-VI1-obe.outbound.protection.outlook.com
> by=SG2PEPF000B66CE.mail.protection.outlook.com ident= envfrom= intl=0
> id=15.20.8398.14 auth= msa=0 ] [ ip=2603:10a6:5:10::31
> rdns=DB7P192MB0331.EURP192.PROD.OUTLOOK.COM
> helo=DB7P192MB0331.EURP192.PROD.OUTLOOK.COM
> by=AS8P192MB2065.EURP192.PROD.OUTLOOK.COM ident= envfrom= intl=0
> id=15.20.8377.22 auth= msa=0 ] [ ip=fe80::306f:e2a6:6620:fff0 rdns=
> helo=DB7P192MB0331.EURP192.PROD.OUTLOOK.COM
> by=DB7P192MB0331.EURP192.PROD.OUTLOOK.COM ident= envfrom= intl=0 id=
> auth= msa=0 ] [ ip=2603:10a6:10:120::12
> rdns=DB8PR06CA0038.eurprd06.prod.outlook.com
> helo=DB8PR06CA0038.eurprd06.prod.outlook.com
> by=PAWP192MB2250.EURP192.PROD.OUTLOOK.COM ident= envfrom= intl=0
> id=15.20.8377.22 auth= msa=0 ] [ ip=2603:10a6:10:120:cafe::e9
> rdns=DU2PEPF00028CFD.eurprd03.prod.outlook.com
> helo=DU2PEPF00028CFD.eurprd03.prod.outlook.com
> by=DB8PR06CA0038.outlook.office365.com ident= envfrom= intl=0
> id=15.20.8377.22 auth= msa=0 ] [ ip=66.211.170.90
> rdns=mx4.phx.paypal.com helo=mx4.phx.paypal.com
> by=DU2PEPF00028CFD.mail.protection.outlook.com ident= envfrom= intl=0
> id=15.20.8398.14 auth= msa=0 ]
> X-Spam-Language: en
> X-Spam-DKIM-i: @paypal.com
> X-Spam-DKIM-d: paypal.com
> X-Original-To: niamh@fullbore.co.uk
> Delivered-To: niamh.fullbore@iron.holtain.net
> Received-SPF: Pass (mailfrom) identity=mailfrom; client-ip=40.93.128.29; helo=hk3pr03cu002.outbound.protection.outlook.com; envelope-from=bounces+srs=4a6bc=uu@smpn7wonogiri.sch.id; receiver=<UNKNOWN>
> DMARC-Filter: OpenDMARC Filter v1.4.2 iron.holtain.net 8EA1DC000546
> Authentication-Results: iron.holtain.net; dmarc=pass (p=reject dis=none) header.from=paypal.com
> Authentication-Results: iron.holtain.net; spf=pass smtp.mailfrom=smpn7wonogiri.sch.id
> DKIM-Filter: OpenDKIM Filter v2.11.0 iron.holtain.net 8EA1DC000546
> Authentication-Results: iron.holtain.net;
> dkim=pass (2048-bit key, unprotected) header.d=paypal.com header.i=@paypal.com header.a=rsa-sha256 header.s=pp-dkim1 header.b=Ti5ZlN8t
> Received: from HK3PR03CU002.outbound.protection.outlook.com (mail-eastasiaazlp17011029.outbound.protection.outlook.com [40.93.128.29])
> by iron.holtain.net (Postfix) with ESMTPS id 8EA1DC000546
> for <ni...@fullbore.co.uk>; Tue, 28 Jan 2025 18:08:36 +0000 (GMT)
> Received: from TYSPR04MB8220.apcprd04.prod.outlook.com (2603:1096:405:8e::12)
> by TYZPR04MB7906.apcprd04.prod.outlook.com (2603:1096:405:a9::11) with
> Microsoft SMTP Server (version=TLS1_2,
> cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8377.21; Tue, 28 Jan
> 2025 18:08:28 +0000
> Received: from KL1PR04MB7539.apcprd04.prod.outlook.com (2603:1096:820:11b::9)
> by TYSPR04MB8220.apcprd04.prod.outlook.com (2603:1096:405:8e::12) with
> Microsoft SMTP Server (version=TLS1_2,
> cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8377.21; Tue, 28 Jan
> 2025 18:08:00 +0000
> Received: from KL1PR04MB7539.apcprd04.prod.outlook.com
> ([fe80::b078:df3:b558:4f13]) by KL1PR04MB7539.apcprd04.prod.outlook.com
> ([fe80::b078:df3:b558:4f13%3]) with mapi id 15.20.8377.021; Tue, 28 Jan 2025
> 18:07:59 +0000
> Received: from SGXP274CA0022.SGPP274.PROD.OUTLOOK.COM (2603:1096:4:b8::34) by
> TYZPR04MB7271.apcprd04.prod.outlook.com (2603:1096:400:44f::6) with Microsoft
> SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id
> 15.20.8377.21; Tue, 28 Jan 2025 17:50:17 +0000
> Received: from SG2PEPF000B66CE.apcprd03.prod.outlook.com
> (2603:1096:4:b8:cafe::6f) by SGXP274CA0022.outlook.office365.com
> (2603:1096:4:b8::34) with Microsoft SMTP Server (version=TLS1_3,
> cipher=TLS_AES_256_GCM_SHA384) id 15.20.8398.17 via Frontend Transport; Tue,
> 28 Jan 2025 17:50:17 +0000
> Authentication-Results: spf=softfail (sender IP is 2a01:111:f403:48::209)
> smtp.mailfrom=euroland.fr; dkim=pass (signature was verified)
> header.d=paypal.com;dmarc=pass action=none header.from=paypal.com;
> Received-SPF: SoftFail (protection.outlook.com: domain of transitioning
> euroland.fr discourages use of 2a01:111:f403:48::209 as permitted sender)
> Received: from EUR03-VI1-obe.outbound.protection.outlook.com
> (2a01:111:f403:48::209) by SG2PEPF000B66CE.mail.protection.outlook.com
> (2603:1096:f:fff5:0:1:0:5) with Microsoft SMTP Server (version=TLS1_3,
> cipher=TLS_AES_256_GCM_SHA384) id 15.20.8398.14 via Frontend Transport; Tue,
> 28 Jan 2025 17:50:16 +0000
> Received: from DB7P192MB0331.EURP192.PROD.OUTLOOK.COM (2603:10a6:5:10::31) by
> AS8P192MB2065.EURP192.PROD.OUTLOOK.COM (2603:10a6:20b:5bd::19) with Microsoft
> SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id
> 15.20.8377.22; Tue, 28 Jan 2025 17:50:13 +0000
> Received: from DB7P192MB0331.EURP192.PROD.OUTLOOK.COM
> ([fe80::306f:e2a6:6620:fff0]) by DB7P192MB0331.EURP192.PROD.OUTLOOK.COM
> ([fe80::306f:e2a6:6620:fff0%5]) with mapi id 15.20.8377.021; Tue, 28 Jan 2025
> 17:50:13 +0000
> Received: from DB8PR06CA0038.eurprd06.prod.outlook.com (2603:10a6:10:120::12)
> by PAWP192MB2250.EURP192.PROD.OUTLOOK.COM (2603:10a6:102:34e::21) with
> Microsoft SMTP Server (version=TLS1_2,
> cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8377.22; Tue, 28 Jan
> 2025 17:49:51 +0000
> Received: from DU2PEPF00028CFD.eurprd03.prod.outlook.com
> (2603:10a6:10:120:cafe::e9) by DB8PR06CA0038.outlook.office365.com
> (2603:10a6:10:120::12) with Microsoft SMTP Server (version=TLS1_3,
> cipher=TLS_AES_256_GCM_SHA384) id 15.20.8377.22 via Frontend Transport; Tue,
> 28 Jan 2025 17:49:51 +0000
> Authentication-Results-Original: spf=pass (sender IP is 66.211.170.90)
> smtp.mailfrom=paypal.com; dkim=pass (signature was verified)
> header.d=paypal.com;dmarc=pass action=none header.from=paypal.com;
> Received-SPF: Pass (protection.outlook.com: domain of paypal.com designates
> 66.211.170.90 as permitted sender) receiver=protection.outlook.com;
> client-ip=66.211.170.90; helo=mx4.phx.paypal.com; pr=C
> Received: from mx4.phx.paypal.com (66.211.170.90) by
> DU2PEPF00028CFD.mail.protection.outlook.com (10.167.242.181) with Microsoft
> SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id
> 15.20.8398.14 via Frontend Transport; Tue, 28 Jan 2025 17:49:50 +0000
> DKIM-Signature: v=1; a=rsa-sha256; d=paypal.com; s=pp-dkim1; c=relaxed/relaxed;
> q=dns/txt; i=@paypal.com; t=1738086589;
> h=From:From:Subject:Date:To:MIME-Version:Content-Type;
> bh=x4gXgJPzgMJS4s6SslPDX50DN37l6UgxYv1Fke0blj4=;
> b=Ti5ZlN8t9vOP4oHPw6S7EFSv5qCloXAAcGFhN1UUYPh8b+kHEbenBvfdHtOlBzCF
> 7lCfc0LH2NGC6vIhFkmbmn490P6XkzLMgQwi9IcUaQTZrUIeD8r5YPRT5b/Y4RmA
> VqAbuOE/7S20QxDlpoCqOprRhS/39AvB5W/QuCyzPn6uf+IjwQjyd7f8imwXsGGD
> O+hiNma12uuMIgpeuAdk5PNYrZJv9UZA6Ta9OZP1LyowQPFIdPaIJf4ACHUkBGaa
> fChq5r8wr7lBUGY/5ft8dfpmzcj3QiEcytLWYQ4niDlTJAMZcPI3OSuoyiwXjFJq
> yuYqt5ZZhMyeauUvreQNbw==;
> Content-Transfer-Encoding: quoted-printable
> Content-Type: text/html; charset="UTF-8"
> Date: Tue, 28 Jan 2025 09:49:49 -0800
> Message-ID: <AD...@ccg01mail06>
> MIME-Version: 1.0
> From: "service@paypal.com" <se...@paypal.com>
> To: Sharon Turner <or...@Euroland.onmicrosoft.com>
> Subject: You've sent a money request
> X-MaxCode-Template: RT000241
> X-PP-Priority: 0-paypal-false
> PP-Correlation-Id: f388091b585de
> X-PP-Email-transmission-Id: 44cd845b-dda0-11ef-bbbe-0f3c32714b27
> X-PP-REQUESTED-TIME: 1738086577206
> X-Email-Type-Id: RT000241
> AMQ-Delivery-Message-Id: nullval
> X-XPT-XSL-Name: nullval
> X-EOPAttributedMessage: 1
> X-MS-TrafficTypeDiagnostic:
> DU2PEPF00028CFD:EE_|PAWP192MB2250:EE_|AS8P192MB2065:EE_|SG2PEPF000B66CE:EE_|TYZPR04MB7271:EE_|TYSPR04MB8220:EE_|TYZPR04MB7906:EE_
> X-MS-Office365-Filtering-Correlation-Id: 198a6f79-7e5b-4b79-7cbb-08dd3fc43981
> X-Moderation-Data: 1/28/2025 5:50:06 PM
> X-LD-Processed: 597638ac-1f39-416f-b8b6-2a57af6395fe,ExtAddr
> X-Auto-Response-Suppress: DR, OOF, AutoReply
> X-MS-Exchange-Transport-CrossTenantHeadersStamped: AS8P192MB2065
> X-EOPTenantAttributedMessage: 7ab5503a-6b18-41b1-ab89-bb02ef5b5daf:0
> X-MS-Exchange-Transport-CrossTenantHeadersStripped: SG2PEPF000B66CE.apcprd03.prod.outlook.com
> X-MS-Exchange-Transport-CrossTenantHeadersPromoted: SG2PEPF000B66CE.apcprd03.prod.outlook.com
> X-MS-PublicTrafficType: Email
> X-MS-Office365-Filtering-Correlation-Id-Prvs:
> 5c11a4de-9c64-4aae-d96a-08dd3fc42a48
> X-Moderation-Data: 1/28/2025 6:07:58 PM
> X-LD-Processed: 7ab5503a-6b18-41b1-ab89-bb02ef5b5daf,ExtAddr,ExtAddr
> X-OriginatorOrg: smpn7wonogiri.sch.id
> X-MS-Exchange-CrossTenant-Network-Message-Id: 198a6f79-7e5b-4b79-7cbb-08dd3fc43981
> X-MS-Exchange-CrossTenant-Id: 7ab5503a-6b18-41b1-ab89-bb02ef5b5daf
> X-MS-Exchange-CrossTenant-AuthSource: SG2PEPF000B66CE.apcprd03.prod.outlook.com
> X-MS-Exchange-CrossTenant-AuthAs: Anonymous
> X-MS-Exchange-CrossTenant-FromEntityHeader: Internet
> X-MS-Exchange-CrossTenant-OriginalArrivalTime: 28 Jan 2025 18:07:59.9852
> (UTC)
> X-MS-Exchange-Transport-CrossTenantHeadersStamped: TYZPR04MB790