These are the headers of one of the spam mail I’m talking about
Return-Path: <ovkiwfr@almalinux.gb.net>
Delivered-To: kontakt@<redacted>.de
Received: from mail.<redacted>.de ([fd4d:6169:6c63:6f77::d])
by 571dfdc8d171 with LMTP
id qJz/AeAYmWfHVgQAB8BEWQ
(envelope-from <ovkiwfr@almalinux.gb.net>)
for <kontakt@<redacted>.de>; Tue, 28 Jan 2025 18:50:24 +0100
X-Original-To: kontakt@<redacted>.de
Received: from xn--k1aif.078.xn--p1acf (xn--k1aif.078.xn--p1acf [212.32.242.60])
by mail.<redacted>.de (Postcow) with ESMTP id 1EEB3BC07C
for <kontakt@<redacted>.de>; Tue, 28 Jan 2025 18:50:22 +0100 (CET)
Authentication-Results: mail.<redacted>.de;
dkim=none;
spf=pass (mail.<redacted>.de: domain of ovkiwfr@almalinux.gb.net designates 212.32.242.60 as permitted sender) smtp.mailfrom=ovkiwfr@almalinux.gb.net
Received: from almalinux.gb.net (relabs.homes [46.20.35.125])
by xn--k1aif.078.xn--p1acf (Postfix) with ESMTPA id E43E66CA5D;
Tue, 28 Jan 2025 17:38:51 +0200 (EET)
Message-ID: <143764402400372176456715736687830768455750613311@almalinux.gb.net>
From: "Kein Verlangen nach Zigaretten" <ovkiwfr@almalinux.gb.net>
To: <terminabsage@lukasplath.de>
Subject: Nicozero - Ihre Freiheit von Nikotin!
Date: Tue, 28 Jan 2025 17:38:52 +0200
MIME-Version: 1.0
Content-Type: multipart/related;
type="multipart/alternative";
boundary="----=_NextPart_000_0006_01DB71A9.37177EE0"
X-Rspamd-Queue-Id: 1EEB3BC07C
X-Rspamd-Fuzzy: 4f3dd46fdbb3519060449b67721b44fe56b06ee3fbfe0c49195b13c7b6810b05ad7b3188f9353ce5aea08b4c46dfd0479ed119dfa6c694ba044fdf953eab52ee
X-Rspamd-Pre-Result: action=no action;
module=multimap;
Matched map: GLOBAL_RCPT_WL
X-Spamd-Result: default: False [8.83 / 15.00];
MAILCOW_FUZZY_DENIED(6.94)[11:3e637642b2:1.00:txt,11:4f3dd46fdb:1.00:bin];
HTML_SHORT_LINK_IMG_1(2.00)[];
ONCE_RECEIVED(0.20)[];
R_SPF_ALLOW(-0.20)[+mx];
MIME_GOOD(-0.10)[multipart/related,multipart/alternative,text/plain];
MX_GOOD(-0.01)[];
ASN(0.00)[asn:60781, ipnet:212.32.224.0/19, country:NL];
SUBJECT_ENDS_EXCLAIM(0.00)[];
GLOBAL_RCPT_WL(0.00)[kontakt@<redacted>.de];
RCPT_MAILCOW_DOMAIN(0.00)[<redacted>.de];
R_DKIM_NA(0.00)[];
MIME_TRACE(0.00)[0:+,1:+,2:+,3:~,4:~,5:+];
FROM_EQ_ENVFROM(0.00)[];
FROM_HAS_DN(0.00)[]
This is a multi-part message in MIME format.
------=_NextPart_000_0006_01DB71A9.37177EE0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_0007_01DB71A9.37177EE0"
------=_NextPart_000_0007_01DB71A9.37177EE0
Content-Type: text/plain;
charset="windows-1251"
Content-Transfer-Encoding: quoted-printable
=0D=0A=0D=0A=0D=0A=0D=0A=0D=0A=0D=0A =0D=0A =0D=0A =0D=0A =20=
=0D=0A Nicozero - mit dem =0D=0A rauchen=0D=0A =20=
aufzuhören ist =0D=0A einfach!=0D=0A =0D=0A =0D=
=0A =0D=0A =0D=0A Wie ich für immer mit dem Ra=
uchen aufgehört =0D=0A habe.=0D=0A =0D=0A Ic=
h habe 1000 Mal versucht mit dem Rauchen =0D=0A aufzuhö=
ren=0D=0A und es scheint, dass es mir beim 1001=0D=0A M=
al endlich gelungen ist!=0D=0A =0D=0A =0D=0A =0D=0A =20=
Seit sechs Monaten finde ich =0D=0A Raucher ziemlich eklig=
=0D=0A und werde niemals einer von =0D=0A ihnen werden.=
=0D=0A =0D=0A =0D=0A =0D=0A Möchtet ih=
r es auch so? =0D=0A >>>=0D=0A
------=_NextPart_000_0007_01DB71A9.37177EE0
Content-Type: text/html;
charset="windows-1251"
Content-Transfer-Encoding: quoted-printable
And this is the rspamd score with a forged recepient address, that didn’t even got flagged as one.
However another mailbox that also received a similiar spam mail marked it as spam with no issues:
