On Thu, Feb 09, 2017 at 06:16:36PM +0800, P.V.Anthony wrote: > Just got an scam email that looks like from paypal. > > It passed dkim and spf. > > dkim=pass (1024-bit key) header.d=service2.sdmone.email > header.i=sdmone@service2.sdmone.email header.b="adXLiw9w"; > dkim=pass (1024-bit key) header.d=mandrillapp.com > header.i=@mandrillapp.com header.b="JsfO1hqx" > > spf=pass (sender SPF authorized) smtp.mailfrom=mandrillapp.com > (client-ip=198.2.187.23;
This appears to be from Mailchimp, so reporting it as abuse is likely to yield some satisfactory results. -- http://rob0.nodns4.us/ Offlist GMX mail is seen only if "/dev/rob0" is in the Subject:
