TOPIC:

Look out for something like this (edited)... which I got today. Don't click on buttons:

Delivery Notification: 5 messages to This email address is being protected from spambots. You need JavaScript enabled to view it. delayed for 48 hours
Contact photo
From Toastmasters Club on behalf of xxx-toastmasters.org <This email address is being protected from spambots. You need JavaScript enabled to view it.> on 2020-07-02 8:11 am
Details Plain text

Message generated from xxx-toastmasters.org source.

You have some pending messages

Your emails on This email address is being protected from spambots. You need JavaScript enabled to view it. have been bIocked 7/2/2020 5:11:13 a.m. (EDT). due to authentication error in your domain.

Get all emails unbIocked by following below buttons.

RELEASE MESSAGES PREVIEW HERE::..

Microsoft inc © 2020: We are here to serve you better.

I really need the full unedited email header as those email addresses you are showing are not valid FTH email addresses.

I started the topic more as a warning of pattern.
I don't like to post messages with potential active malware links to public forums.
I have blacklisted the sender in my club's website, using the link your service provides. I've also reported the message to SpamCop (I have excluded FTH as a source in general)
If you wish I can provide you the full text of the message (I still have it) in text or zip, if you can explain how you would prefer that.

all I want is the full email header. There are no links in an mail header just the mail routing details.

Okay:

Return-Path: This email address is being protected from spambots. You need JavaScript enabled to view it.
Delivered-To: This email address is being protected from spambots. You need JavaScript enabled to view it.
X-FDA: 76993020678.10.balls76_5b009bf26e89
Received: from filter.hostedemail.com (10.5.16.251.rfc1918.com [10.5.16.251])
by smtpin10.hostedemail.com (Postfix) with ESMTP id 1EE0316A07E
for <This email address is being protected from spambots. You need JavaScript enabled to view it.>; Thu, 2 Jul 2020 12:11:19 +0000 (UTC)
X-Spam-Summary: 30,2,0,10253494fcb83db6,d41d8cd98f00b204,server@toastmastersclubs.org,,RULES_HIT:41:72:355:375:379:494:495:496:800:962:966:967:973:978:983:988:989:1189:1208:1224:1260:1261:1263:1311:1313:1314:1345:1381:1397:1431:1433:1434:1436:1437:1513:1515:1516:1517:1521:1535:1544:1571:1588:1589:1593:1594:1685:1711:1714:1730:1747:1777:1792:2196:2198:2199:2200:2393:2525:2527:2560:2566:2610:2682:2685:2828:2859:2902:2933:2937:2939:2942:2945:2947:2951:2954:3022:3138:3139:3140:3141:3142:3148:3350:3586:3865:3867:3870:3871:3873:3934:3936:3938:3941:3944:3947:3950:3953:3956:3959:4118:4321:4385:4552:4903:5007:6261:6650:6653:6669:6671:6674:6678:6688:7688:7903:8518:8568:8603:8957:8960:9025:9059:9394:9416:9908:10004:10049:10234:10346:11473:11657:11658:11914:12043:12114:12295:12324:12555:12740:12749:12895:12955:12958:12959:12967:12968:12986:13007:13025:13095:13139:13255:13439:13868:14096:14181:14347:14721:14818:14827:14913:18000:21080:21212:21347:21433:21451:21483:21524:21611:21627:21660:21811:21
X-HE-Tag: balls76_5b009bf26e89
X-Filterd-Recvd-Size: 7763
Received: from toastmastersclubs.org (toastmastersclubs.org [50.19.253.65])
by imf06.hostedemail.com (Postfix) with ESMTP
for <This email address is being protected from spambots. You need JavaScript enabled to view it.>; Thu, 2 Jul 2020 12:11:18 +0000 (UTC)
Received: from localhost.localdomain (toastmastersclubs.org [127.0.0.1])
by toastmastersclubs.org (8.14.4/8.14.4) with ESMTP id 062CBH5c029513
for <This email address is being protected from spambots. You need JavaScript enabled to view it.>; Thu, 2 Jul 2020 12:11:18 GMT
Message-Id: <This email address is being protected from spambots. You need JavaScript enabled to view it.>
Received: from slot0.davisnit.com (slot0.davisnit.com [45.95.169.127])
by toastmastersclubs.org (8.14.4/8.14.4) with ESMTP id 062CBEsd029500
(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO)
for <This email address is being protected from spambots. You need JavaScript enabled to view it.>; Thu, 2 Jul 2020 12:11:16 GMT
DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=dkim; d=davisnit.com;
b=uMMG0sNAEscPYcubkB5IkJ+1DndYERHrKlSyI1L8wcTv+7Q6cP1l1kUeUK+bgQ1xq+3W/Sr+EBz8
hBt8Ekz9E1VSxyu4XYY6G8dG4wlCPz6M38OElB/eNZpSWP7mQfxLZsWw9BQYDEYowDO23Dvz4K3s
INOZP5Na7OfWXu2hqMSwJtxcp0GugoEt8KpHMSkKW57eo9GMfi/HtGM4lcZP97sCO0urHPvpdu7a
0pG2PqrigigMdDl7MAjiiBtXSLQESg4eslEfelq1vNuD7hqALEbSGSAA5/QjTekVYcykzcQyyPUF
0AyoifmDMhEon7nbAJy0NREpB2EQVNZjo9u/zQ==;
Subject: Delivery Notification: 5 messages to This email address is being protected from spambots. You need JavaScript enabled to view it. delayed for 48 hours
Date: 02 Jul 2020 05:11:13 -0700
MIME-Version: 1.0
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
X-Spam-Status: No, score=0.3 required=5.0 tests=HTML_FONT_LOW_CONTRAST,
HTML_MESSAGE,MIME_HTML_ONLY,PDS_FRNOM_TODOM_NAKED_TO,
PDS_FROM_NAME_TO_DOMAIN,RCVD_IN_DNSWL_HI,RCVD_IN_PSBL,SPF_HELO_NONE,
SPF_PASS,URIBL_BLOCKED,URIBL_PH_SURBL autolearn=no autolearn_force=no
version=3.4.3
X-Spam-Checker-Version: SpamAssassin 3.4.3 (2019-12-06) on
toastmastersclubs.org
From: "Toastmasters Club 508 on behalf of merrimack-toastmasters.org"
<This email address is being protected from spambots. You need JavaScript enabled to view it.>
X-Loop: This email address is being protected from spambots. You need JavaScript enabled to view it.
Sender: This email address is being protected from spambots. You need JavaScript enabled to view it.
Reply-To: This email address is being protected from spambots. You need JavaScript enabled to view it.
To: "This email address is being protected from spambots. You need JavaScript enabled to view it." <This email address is being protected from spambots. You need JavaScript enabled to view it.>
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed; d=toastmastersclubs.org;
h=content-transfer-encoding:content-type:date:from:mime-version
:reply-to:sender:subject:to; s=default; bh=hKIzYH9BtHmiKDxWsRnQc
D+NkvgvnR/jDtvXgeA0T1Q=; b=m46URTBaCKJCdlkR6EKQAdRYzXAYJuAZheG6G
2wCTm7ycqvfDloziqyP1NT+pVSGv9R3LtLBTeALzTrvrAWe4Y4fxExphQ+K0WBIm
V8+KUPj2M9e9gGrHrKY9VP4YiayplThF8clAMt3UjnXqjQ2CLHA6kiexGNf6+s0E
hZ3hqU=
X-Rspamd-Queue-Id: 1EE0316A07E
X-Spamd-Result: default: False [0.00 / 100.00]
X-Rspamd-Server: rspam02

1) this was sent to the club contact email we do filter that or the direct officers email forwarders
2) Thank you for reporting this spam, we have taken steps to block that mail service.

And ...they tried again from a different source. And the (not included) button is via goggleapis
Subject: [17] Clustered Mails Detected

---

Return-Path: This email address is being protected from spambots. You need JavaScript enabled to view it.
Delivered-To: This email address is being protected from spambots. You need JavaScript enabled to view it.
X-FDA: 77017247286.25.wound79_0b15b9526ec2
Received: from filter.hostedemail.com (10.5.16.251.rfc1918.com [10.5.16.251])
by smtpin25.hostedemail.com (Postfix) with ESMTP id 619B01804E3A1
for <This email address is being protected from spambots. You need JavaScript enabled to view it.>; Thu, 9 Jul 2020 04:25:03 +0000 (UTC)
X-Spam-Summary: 30,2,0,9e3b8c81797f0ff8,d41d8cd98f00b204,server@toastmastersclubs.org,,RULES_HIT:1:2:41:72:355:375:379:455:496:962:966:967:973:978:983:988:989:1189:1208:1224:1260:1261:1311:1313:1314:1345:1381:1431:1432:1433:1434:1436:1437:1513:1515:1516:1517:1521:1588:1589:1593:1594:1685:1714:1730:1747:1777:1792:2194:2196:2198:2199:2200:2201:2393:2525:2538:2553:2559:2565:2682:2685:2737:2828:2859:2890:2894:2902:2933:2937:2939:2942:2945:2947:2951:2954:3022:3138:3139:3140:3141:3142:3148:3350:3586:3865:3867:3870:3871:3873:3934:3936:3938:3941:3944:3947:3950:3953:3956:3959:4042:4052:4180:4181:4321:4385:5007:6261:6653:6669:6671:6674:6678:6688:7688:7775:8518:8603:8957:9025:9059:9080:9149:9394:9416:9908:10004:10346:11473:11658:11914:12043:12295:12324:12438:12555:12740:12895:12956:12958:12959:12986:13007:13139:13198:13211:13229:13439:14096:14877:21080:21325:21347:21433:21450:21451:21483:21524:21627:21660:21810:21819:21851:21881:21889:21939:21966:21985:21987:30001:30003:30022:30054:30070:30090,
X-HE-Tag: wound79_0b15b9526ec2
X-Filterd-Recvd-Size: 11860
Received: from toastmastersclubs.org (toastmastersclubs.org [50.19.253.65])
by imf37.hostedemail.com (Postfix) with ESMTP
for <This email address is being protected from spambots. You need JavaScript enabled to view it.>; Thu, 9 Jul 2020 04:25:02 +0000 (UTC)
Received: from localhost.localdomain (toastmastersclubs.org [127.0.0.1])
by toastmastersclubs.org (8.14.4/8.14.4) with ESMTP id 0694P16J016221
for <This email address is being protected from spambots. You need JavaScript enabled to view it.>; Thu, 9 Jul 2020 04:25:02 GMT
Message-Id: <This email address is being protected from spambots. You need JavaScript enabled to view it.>
Received: from kia0.blockkeykeychain.net (kia0.blockkeykeychain.net [37.235.48.52])
by toastmastersclubs.org (8.14.4/8.14.4) with ESMTP id 0694OxTV016208
(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO)
for <This email address is being protected from spambots. You need JavaScript enabled to view it.>; Thu, 9 Jul 2020 04:25:00 GMT
Subject: [17] Clustered Mails Detected
Date: 08 Jul 2020 21:24:58 -0700
MIME-Version: 1.0
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
X-Spam-Status: No, score=0.1 required=5.0 tests=HTML_MESSAGE,MIME_HTML_ONLY,
SPF_HELO_NONE,SPF_NONE autolearn=no autolearn_force=no version=3.4.3
X-Spam-Checker-Version: SpamAssassin 3.4.3 (2019-12-06) on
toastmastersclubs.org
From: "Toastmasters Club 508 on behalf of " <This email address is being protected from spambots. You need JavaScript enabled to view it.>
X-Loop: This email address is being protected from spambots. You need JavaScript enabled to view it.
Sender: This email address is being protected from spambots. You need JavaScript enabled to view it.
Reply-To: This email address is being protected from spambots. You need JavaScript enabled to view it.
To: "This email address is being protected from spambots. You need JavaScript enabled to view it." <This email address is being protected from spambots. You need JavaScript enabled to view it.>
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed; d=toastmastersclubs.org;
h=content-transfer-encoding:content-type:date:from:mime-version
:reply-to:sender:subject:to; s=default; bh=P9dUt3RMsKurdPZ6GjHv5
dPOn4tw+jv6gchJIwObdD0=; b=wwp7xZKLE+uLLl68sKrvKHwZkkmKGkxnKLukh
nXMrHGJB3gp28pFqfZvbSdQiogdoNBy8REGUFFe3jCN7G2dkvMt6ZtkozG3Tldhc
4GthwF61FxmtxM/CdWkSd2Do4HmkEU15iHkykOFfWdvwA88YOg4Ruw0FPfsc28RT
mqJlDY=
X-Rspamd-Queue-Id: 619B01804E3A1
X-Spamd-Result: default: False [0.00 / 100.00]
X-Rspamd-Server: rspam03

Spammers spam, not to much we can do to stop every spam email, we do have in place several anti-spam tools they just can't catch every one.

Please add the domain @e9412.b.akamaiedge.net to your black list.

Yes I get many more than this on my other mailboxes. I thought this was more tailored than most, but after thinking a bit, its' just a variation on fake email admin mails taking advantage of the open contacts@club address.

One of the things I also notice is that you are not using the Crowd-Sourced Blacklist feature. It is certainly your choice either way. However, when I implemented that feature in the past, I anticipated that clubs might unfortunately be targeted with much more spam in the future. (It is the trend.) If you are leveraging the black lists of other clubs, it should result in less work for you preventing spam. (It is the "strength in numbers" approach.)

The only reason I mention this is the number of email addresses I notice in your club email black list. (quite a few) I wonder how many of those were also caught by other clubs.

Originally, this feature had some issues that had led to us telling clubs to shut it off in some cases. However, those issues have long since been resolved.

Thanks, was just reading your notice about that feature this morning, and thought I had it on already. Do now.
I suspect that most in my list were one-timers and I should prune it in the future.

One thing you might try if you want to investigate this a bit more is to cut and paste each entry from your club black list into the Search Crowd Sourced Black List pop-up, then paste each back into your club black list. That would let you know if another club has the respective emails / domains on their club black list. If some other club has it already, you don't need to include it in your black list if you are doing the crowd sourcing thing.

>>> You just have to make sure you remove each email addr / domain from your club black list before doing the search, since the search does also include your club's black list. (Thus, the reason I suggest cutting each entry before doing the search.)