Topic: New Coinbase Spam (Read 1977 times)

Well it depends on the sender domain:

coinbase.com has SPF record with fail (-all) default. Messages failing SPF test should be rejected.

bitcoin.org has no SPF record, the test makes no sense.

some don't fail. (from what i posted above) also spf alone is not going to kick the email out.

These messages fail SPF test: http://www.openspf.org/Project_Overview

Your mailserver should perform this test automatically and reject them

X-SmarterMail-Spam: SPF_None, SpamAssassin 0 [raw: 0], DK_None, DKIM_None

I guess it is a trick to take your money

So did the emails only start after the hack?  Mine did, and are sent to an email I only use for this forum so it seems related.  Might be a path back to the hackers, by determining who they sold lists to.

do you have one that you can open. if you have it, can post the raw text (like i did above) of the message so i can look at it?

I only receiving Coinbase newsletters. I dont know what is inside becaue I delete these and I cant sign out for newsletters because I lost login info to Coinbase.

Well do that. These kinds of emails need to be stopped.
Luckily I'm not getting them.

Return-Path: <[email protected]>
Received: from smtp02-forward-0.daemonmail.net (smtp02-forward-0.daemonmail.net [216.104.163.150]) by sm03.internetmailserver.net with SMTP;
   Sun, 27 Oct 2013 21:13:41 -0700
Received: from mxw04.daemonmail.net (unknown [216.104.161.14])
   by smtp02-forward-0.daemonmail.net (Postfix) with ESMTP id 2D1628132E
   for <*@appropriatesystems.com>; Sun, 27 Oct 2013 20:57:52 -0700 (PDT)
Received: from localhost (localhost [127.0.0.1])
   by mxw04.daemonmail.net (Postfix) with ESMTP id 2F8B52A71E6
   for <*@garrettbattaglia.info>; Sun, 27 Oct 2013 20:57:51 -0700 (PDT)
X-Virus-Scanned: Debian amavisd-new at mxw04.daemonmail.net
X-Spam-Flag: NO
X-Spam-Score: 0.496
X-Spam-Level:
X-Spam-Status: No, score=0.496 tagged_above=-20 required=4
   tests=[BAYES_40=-0.001, MISSING_MID=0.497] autolearn=no
Received: from mxw04.daemonmail.net ([127.0.0.1])
   by localhost (mxw04.daemonmail.net [127.0.0.1]) (amavisd-new, port 10024)
   with ESMTP id Kz2rsgXq+feO for <*@garrettbattaglia.info>;
   Sun, 27 Oct 2013 20:57:49 -0700 (PDT)
Received: from netgains11422.netgainstechnologies.com (netgains11422.netgainstechnologies.com [180.179.114.22])
   by mxw04.daemonmail.net (Postfix) with ESMTP id 3FF452A71E5
   for <*@garrettbattaglia.info>; Sun, 27 Oct 2013 20:57:47 -0700 (PDT)
Received: from home-91e15d0351.user.nevalink.net (UnknownHost [89.223.47.197]) by netgains11421.netgainstechnologies.com with SMTP;
   Mon, 28 Oct 2013 09:25:58 +0530
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Description: Mail message body
Subject: Bitcoin Awaiting your order confirmation
To: *@garrettbattaglia.info
From: [email protected]
Date: Mon, 28 Oct 2013 07:57:28 +0400
Reply-To: [email protected]
Return-receipt-to: [email protected]
X-Rcpt-To: <*@appropriatesystems.com>
Message-ID: <72dbdc94e0764e08a510a668727fb45c@com>
X-SmarterMail-Spam: SPF_Fail, SpamAssassin 0 [raw: 0], DK_None, DKIM_None
X-SmarterMail-TotalSpamWeight: 5


Donate to the Bitcoin Forum

Donation =


Bitcoin address:   1KaEvEH1eWf8EXnrUCdsMNt9TucYGXwTZU

Litecoin address:   LXHR3ThQz2qrJqEXJrce2GsTzEdh5JCZG2

The Bitcoin Forum is a website meant to host free discussion of Bitcoin and=
 related topics. It is operated as a service to the community, and all prof=
it is reinvested into the forum. It was started in 2009 by Satoshi Nakamoto=
, the original creator of Bitcoin. It is now managed by Malmi Martti (Siriu=
s), Stefan Thomas (justmoon), and Michael Marquardt (theymos). Donated fund=
s are managed by theymos.

Private Internet Access provides free hosting for the forum. Check them out=
 for anonymous VPN tunnels. They accept Bitcoin!

If you donate some BTC, you can get a special "Donator" title and a green "=
who's online" color. If you donate 1 BTC, you get VIP status and the abilit=
y to create a custom title for yourself. Both Donators and VIPs also get ac=
cess to an exclusive forum section. You must prior to donating if you want =
to take advantage of this offer: you will be given a unique donation addres=
s.

Big Thanx For Help situation and sent for our donate this right now
Thank you for your interest in donate!
we do and develop an interest for many people and the system in general, it=
 makes it all bolie popular and we try for you
if ever we need your help we hope you will be able to help us and send some=
 of your coins for us
we need money for maintenance and we invite you to support us and make a do=
nation to help us

We very much appreciate and thank you a lot

Return-Path: <[email protected]>
Received: from smtp01-forward-0.daemonmail.net (smtp01-forward-0.daemonmail.net [216.104.162.150]) by sm03.internetmailserver.net with SMTP;
   Tue, 29 Oct 2013 04:05:43 -0700
Received: from mxw02.daemonmail.net (unknown [216.104.161.12])
   by smtp01-forward-0.daemonmail.net (Postfix) with ESMTP id 2A7D181BB7
   for <*@appropriatesystems.com>; Tue, 29 Oct 2013 03:49:11 -0700 (PDT)
Received: from localhost (localhost [127.0.0.1])
   by mxw02.daemonmail.net (Postfix) with ESMTP id 2D589282541
   for <*@garrettbattaglia.info>; Tue, 29 Oct 2013 03:49:11 -0700 (PDT)
X-Virus-Scanned: Debian amavisd-new at mxw02.daemonmail.net
X-Spam-Flag: NO
X-Spam-Score: -0.002
X-Spam-Level:
X-Spam-Status: No, score=-0.002 tagged_above=-20 required=4
   tests=[BAYES_05=-0.5, MISSING_MID=0.497, URIBL_BLOCKED=0.001]
   autolearn=no
Received: from mxw02.daemonmail.net ([127.0.0.1])
   by localhost (mxw02.daemonmail.net [127.0.0.1]) (amavisd-new, port 10024)
   with ESMTP id H0RToO-gmIJL for <*@garrettbattaglia.info>;
   Tue, 29 Oct 2013 03:49:05 -0700 (PDT)
Received: from smtp.2164.v.tld.pl (v2164.rev.tld.pl [195.149.231.64])
   by mxw02.daemonmail.net (Postfix) with ESMTP id C4B6028254B
   for <*@garrettbattaglia.info>; Tue, 29 Oct 2013 03:49:04 -0700 (PDT)
Received: (qmail 313 invoked by uid 2164007); 29 Oct 2013 10:49:02 -0000
X-clamdmail: clamdmail 0.18a
Received: from 89.223.47.197 (HELO home-91e15d0351.user.nevalink.net) ([email protected]@89.223.47.197)
  by 195.149.231.64 with ESMTPA; 29 Oct 2013 10:49:02 -0000
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Description: Mail message body
Subject: Activation your new account 2013
To: *@garrettbattaglia.info
From: [email protected]
Date: Tue, 29 Oct 2013 14:49:07 +0400
Reply-To: [email protected]
Return-receipt-to: [email protected]
X-Rcpt-To: <*@appropriatesystems.com>
Message-ID:
X-SmarterMail-Spam: SPF_Fail, SpamAssassin 9 [raw: 3], DK_None, DKIM_None
X-SmarterMail-TotalSpamWeight: 14

Activation your new account 2013

Here Yes

This individual invite for you


https://www.switchpoker.com/?rid=3D4145&link=3D7


The referral bonus will be added to your account automatically

Return-Path: <[email protected]>
Received: from smtp02-forward-0.daemonmail.net (smtp02-forward-0.daemonmail.net [216.104.163.150]) by sm03.internetmailserver.net with SMTP;
   Tue, 29 Oct 2013 06:13:44 -0700
Received: from mxw01.daemonmail.net (unknown [216.104.161.11])
   by smtp02-forward-0.daemonmail.net (Postfix) with ESMTP id 94E7081212
   for <*@appropriatesystems.com>; Tue, 29 Oct 2013 05:54:54 -0700 (PDT)
Received: from localhost (localhost [127.0.0.1])
   by mxw01.daemonmail.net (Postfix) with ESMTP id 3CF29240951
   for <*@garrettbattaglia.info>; Tue, 29 Oct 2013 05:54:53 -0700 (PDT)
X-Virus-Scanned: Debian amavisd-new at mxw01.daemonmail.net
X-Spam-Flag: NO
X-Spam-Score: -1.889
X-Spam-Level:
X-Spam-Status: No, score=-1.889 tagged_above=-20 required=4
   tests=[BAYES_00=-1.9, T_MANY_HDRS_LCASE=0.01, URIBL_BLOCKED=0.001]
   autolearn=ham
Received: from mxw01.daemonmail.net ([127.0.0.1])
   by localhost (mxw01.daemonmail.net [127.0.0.1]) (amavisd-new, port 10024)
   with ESMTP id 6z3xe3NWF61J for <*@garrettbattaglia.info>;
   Tue, 29 Oct 2013 05:54:50 -0700 (PDT)
Received: from mail.qatar.net.qa (cactus4.qatar.net.qa [82.148.101.71])
   by mxw01.daemonmail.net (Postfix) with ESMTPS id 3785B240EAD
   for <*@garrettbattaglia.info>; Tue, 29 Oct 2013 05:54:49 -0700 (PDT)
MIME-version: 1.0
Content-transfer-encoding: 7BIT
Content-type: text/plain; CHARSET=US-ASCII
Received: from home-91e15d0351.user.nevalink.net ([89.223.47.197])
 by cactus4.qatar.net.qa
 (Oracle Communications Messaging Exchange Server 7u4-18.01 64bit (built Jul 15
 2010)) with ESMTPA id <[email protected]> for
 *@garrettbattaglia.info; Tue, 29 Oct 2013 15:50:36 +0300 (AST)
Message-id: <[email protected]>
Content-description: Mail message body
Subject: Bitcoin Your [Procedure Right Now]
To: *@garrettbattaglia.info
From: [email protected]
Date: Tue, 29 Oct 2013 16:54:51 +0400
Reply-to: [email protected]
Return-receipt-to: [email protected]
X-Rcpt-To: <*@appropriatesystems.com>
X-SmarterMail-Spam: SPF_None, SpamAssassin 0 [raw: 0], DK_None, DKIM_None
X-SmarterMail-TotalSpamWeight: 0

Bitcoin is a website in which you earn small amounts of Bitcoins in exchange for visiting websites for a designated period of time. You may be required to spend anywhere from one minute, up to five minutes or more on the sponsored website. You must spend the full amount of required time on the website in order to recieve payment.

N1

http://minefield.bitcoinlab.org/?r=tjG2tHzTPhhKmkjo

N2

http://www.bitcoinget.com/?r=1Akps1g2LETZ2SSB2HZKw5si46quj6WxH8

N3

http://satoshi36.com/ofn


Want more free bitcoins? Check out these site

N4

https://www.switchpoker.com/?rid=4145&link=7

Get Your Bitcoins Stable Bonus This
Start Right Now

DaemonMail is a mail sorter and mail handler shared by several ISPs.

If you have reached this web page by examining headers found in an unwanted email, please email us the entire message: [email protected]. Be sure to include a full copy of the email headers. You will receive a prompt, personalized response.

Our AUP is provided below:

---

DaemonMail Acceptable Use Policy

These servers and hosted domains may not be the source, intermediary, or destination address involved in the transmission of junk email, nor may they be listed in any junk email message. The use of these servers to send or relay junk email is prohibited, and will result in a fine.

"Junk email" is defined as "any mass unsolicited or unwanted message in any medium." Violation will result in immediate termination of all services without refund. Fines and legal action may be imposed. Any customer who is repeatedly flamed/mail-bombed or attracts such behavior will be asked to leave.

Mailing list services are provided for use as discussion forums only, and may not be used to distribute unsolicited email. All users on a list must have personally subscribed to that list.

I saw someone also made a post about this in General Discussion. It seems to be a phishing scam.