Solved Many nonsensable subject e-mail messages

Hewlett-packard / PAVILION
August 21, 2017 at 10:25:16
Specs: Windows 7, Intel Pentium D 925
Within the past week I have been getting many e-mail messages where the subject is "nonsensical" with many different and many different advertisers. An example of the subjects follow: ?utf-8?Q?=20=06=05=05=02=20=5f=48=2e=61=2e=76=2e=65=5f=59=30=75=5f=53=2e=65=2e=61=72=5f=63=68=2e=65=64=5f=59=30=2e=75=72=5f=4e=61=2e=6d=65=5f=59=2e=65=2e=74=3f=20=05=04=06=06=20?=

I have cleansed my computer with CCleaner, Spybot, and Malwarebytes with no success.

Any help would be great. Uncle Dewey

message edited by uncledewey


See More: Many nonsensable subject e-mail messages

Reply ↓  Report •

#1
August 21, 2017 at 11:20:47
Doubt this is malware. Doe it only happen on email? If so let us know what email program or service you use. What happens if you send yourself an email?

Always pop back and let us know the outcome - thanks


Reply ↓  Report •

#2
August 21, 2017 at 16:20:39
I use Juno and download my messages to my computer. I sent one to myself which was okay. I just got four more and they are all advertisements for various products. I am now leaving Juno on the Internet open and hope to see the messages with same type of subjects before downloading to my computer.

Tx for your interest. Uncle Dewey


Reply ↓  Report •

#3
August 21, 2017 at 17:58:58
✔ Best Answer
OK - Let us know how you get on.

Better run a quick malware check just to be on the safe side. Run these three in the order given:

AdwCleaner:
https://www.malwarebytes.com/adwcle...
Download and "Save" the file somewhere. Go to the saved file then double click it to run the program. Use the "Scan" button, followed by the "Clean" button.

Junkware Removal Tool (JRT)
https://www.malwarebytes.com/junkwa...
Download and "Save" the file somewhere. Go to the saved file then double click it to run JRT. It might appear to have stopped at times or flash the screen but sit tight until it has finished.

MalwareBytes:
https://www.malwarebytes.org/
(use the "Free Download" button rather than the "Buy Now" button).
After the install go to "Settings > Protection". Under Scan Options move the "Scan for rootkits" slider over to On and Run the Threat Scan. Quarantine anything it finds.

If any of them find something please copy/paste the associated logs on here.

Always pop back and let us know the outcome - thanks

message edited by Derek


Reply ↓  Report •

Related Solutions

#4
August 21, 2017 at 21:19:53
That looks suspiciously like a string. A UTF-8 string. Let's see if I'm right:
$str = '20=06=05=05=02=20=5f=48=2e=61=2e=76=2e=65=5f=59=30=75=5f=53=2e=65
=2e=61=72=5f=63=68=2e=65=64=5f=59=30=2e=75=72=5f=4e=61=2e=6d=65=5f=59=2e
=65=2e=74=3f=20=05=04=06=06=20' -split '=' -replace "[`r`n]", ''
[text.encoding]::UTF8.GetString(($str | % { [convert]::ToByte($_, 16) }))
 ???? _H.a.v.e_Y0u_S.e.ar_ch.ed_Y0.ur_Na.me_Y.e.t? ????  

If I had to guess, I'd say it's someone's too clever attempts to bypass spam filters, and that it ended up backfiring, especially with the UTF-8 control charters in there.

How To Ask Questions The Smart Way


Reply ↓  Report •

#5
August 22, 2017 at 08:46:00
Dear Derek and Razor,
I had already run Malewarebyte, but will start over with the programs you suggested. Just this morning I received my normal e-bay notice with the subject: ?UTF-8?Q?=F0=9F=9A=9A_ORDER_SHIPPED:_5/6/7/8_inch_Free_St...?= It has the info it should have, but injected more info, I checked and the info is in my Internet Browser so we know it is not added when I download my e-mail messages. So it could be something in my browser?

Thanks for sticking with me--I am a bit busy so may not be back as soon as I'd like. Uncle Dewey


Reply ↓  Report •

#6
August 22, 2017 at 10:06:30
OK. AdwCleaner and JRT are focussed towards browser malware.

Always pop back and let us know the outcome - thanks


Reply ↓  Report •

#7
August 23, 2017 at 16:55:08
Dear Derek & Razor,

I installed ADWCLEANER and finished successfully--I've forgot exactly how it deleted. JUNKWARE deleted a lot of temporary files. MALWAREBYTE did not find any errors--but I had run the same program a few days ago. I also did some tinkering with Firefox and had to also update Adobe Flash Player on Firefox.

I just received a new e-mail message with the subject: ?utf-8?Q?=20=04=01=08=02=20=23=21=24=23=5f=23=5f=31=5f=57=65=69=72=64=2d=54=2e=72=2e=69=2e=63=2e=6b=2d=54=30=2d=50=61=79=2d=24=37=5f=2f=5f=2a=4d=2e=30=2e=6e=2e=74=2e=68=2d=4f=6e=2d=45=2e=31=2e=65=63=2e=74=2e=72=2e=21=2e=63=2e=21=2e=74=2e=79=2a=2a=2a=21=2a=2a=20=04=05=08=05=20?=

Thanks for any help you might give me. dewey


Reply ↓  Report •

#8
August 23, 2017 at 17:01:59
Are you able to determine a senders address?

Seems to me it is not a problem on your actual system.

Always pop back and let us know the outcome - thanks


Reply ↓  Report •

#9
August 23, 2017 at 18:12:48
Yes I can see "From" and "Sender" I don't know/think there is real pattern, but.... My day is really full tomorrow, but I can capture From and Sender in several messages in a file to see if there is pattern plus copy paste to the forum.

Tx, Uncle Dewey


Reply ↓  Report •

#10
August 24, 2017 at 02:59:01
OK, will look out for you later.

Always pop back and let us know the outcome - thanks


Reply ↓  Report •

#11
August 24, 2017 at 08:57:55
Hi Again,

Below is pertinent info from three message headers, and the entire header for message #3. I can do more if it would help.

Uncle Dewey

Message #1
From: Optima–IRS-.A.s.s.i.s.t.a.n.c.e.Programs <xERnOTGHQJqydnwiJAe@foamyleu.com>
(sender <bounce-ztgjpymsfsmijgiwicnqecwmtlgwanatabi@foamyleu.com>)
(envelope-from <bounce-bdpsymlkssmfdwzqsdahketdjhjcwkwxzxz@foamyleu.com>)
Return-Path: <bounce-ztgjpymsfsmijgiwicnqecwmtlgwanatabi@foamyleu.com>
list-unsubscribe: <mailto:unsub-6514170739545679393290-616273900-DV4ROASHVZDRZOE31JLYGDLMH0RZX8R8G58@foamyleu.com>

Message #2
From: &%$%_L-u-m-!_-b-1-a-z-e.,~,S.p.e.c._!.a.1_&%&$<eNpwLNttgynpnvTxejA@scale.coolforever4.com>
Reply-To: United Online <zxjtzsjhifacpedaljsepqkgcddbzclgbxxkbmcihgtfqwldwheeytnfqiyezveaateksfhfalfntqhacmsletemnesbcklteyg@scale.coolforever4.com>
(sender <bounce-yfttegqypfqayyzqdvtshqeppdtwjaehpfq@scale.coolforever4.com>)
list-unsubscribe: <mailto:unsub-5056876651648245641317-974310510-CK3VMIWQ2M76RJSOADD9QRQQ4NK00RM3VHV@scale.coolforever4.com>

Message #3
From: Pro= V.a.p.o.r. <fFgiljHFvEeJFeaAAWi@foamyleu.com>
(sender <bounce-fkjapivebhiizqfmhievzmfphgwdskqjase@foamyleu.com>)
list-unsubscribe: <mailto:unsub-9781317231038981165563-803294773-OZS4FZ4B3A310XDLUUJE56OUMLSPVZEIB2H@foamyleu.com>

Entire Header for Message #3
From: Pro= V.a.p.o.r. <fFgiljHFvEeJFeaAAWi@foamyleu.com>
To: friend <xxxx@juno.com>
Date: Wed, 23 Aug 2017 10:33:42 -0400
Subject: =?utf-8?Q?=20=07=05=05=05=20=5e=5e=49=20=05=01=05=02=20=74=68=30=75=67=68=74=20=04=04=03=08=20=79=30=75=5c=27=64=20=06=02=02=09=20=62=65=20=04=02=05=08=20=2f=69=6e=74=65=72=65=73=74=65=64=2f=20=05=05=07=05=20=69=6e=20=03=03=08=03=20=74=68=69=73=20=04=05=01=03=20=77=68=65=6e=20=06=04=05=04=20=49=20=06=01=03=02=20=73=2e=61=2e=77=2e=20=07=04=08=05=20=69=74=e2=80=a6=5e=5e=20=07=01=04=03=20?= Wed, 23 Aug 2017 10:33:42 -0400
Message-ID: <630227187908.287666632.671320385203569.JavaMail.root@foamyleu.com>
Reply-To: United Online <bhpwgkjekejgynzmswhblapllekitvfvehidytjpyxgtfvxjgpclzmkiatljbdwagtjilwdijlqpcqhbizcehnencmzmyazxycf@foamyleu.com>
Received: from mx09.dca.untd.com (mx09.dca.untd.com [10.171.44.39])
by maildeliver03.vgs.untd.com with SMTP id AABN35EUNAW9ZUN2
for <xxxx@juno.com> (sender <bounce-fkjapivebhiizqfmhievzmfphgwdskqjase@foamyleu.com>);
Wed, 23 Aug 2017 07:33:48 -0700 (PDT)
Received: from foamyleu.com (4itemfoamy.com [52.38.8.28])
by mx09.dca.untd.com with SMTP id AABN35EUMAHKDFMS
for <xxxx@juno.com> (sender <bounce-fkjapivebhiizqfmhievzmfphgwdskqjase@foamyleu.com>);
Wed, 23 Aug 2017 07:33:48 -0700 (PDT)
Received: by mail11.foamyleu.com id hcz6lhqmfel4 for <xxxx@juno.com>; Wed, 23 Aug 2017 10:33:42 -0400 (envelope-from <bounce-nzawehmvtnmmlngwqllxgpkskjhqpsqtjan@foamyleu.com>)
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
X-UNTD-UBE: -1
X-UNTD-Peer-Info: 52.38.8.28|4itemfoamy.com|foamyleu.com|bounce-fkjapivebhiizqfmhievzmfphgwdskqjase@foamyleu.com
X-MAIL-INFO: 58392c49b83d2c8181cd813ded3109216d35bd7801bd05adbcfcbd294cf9f921a9653c21ede1e12931cd61413d85b54d59c5e8694d75755d5dc56c09a1f5050dec6c6cd519d5e5e988596519791998b5656d88c8e8008d498d0c9125d5f9491d2c9949e1e158e1993dcdc54508850055210031bc05d5002dbd3c3c455c794c453da5a52dcd58380c9981c8b591e8916859ed4d9535816905f5b9610d8c0925e98c6c6c786ce9e5b12859c1d569dcf1697d214561694d15a1a159bd715d59e5acac4db1782c1ce9cc99313d9d05753129d511119d9528f50165d118959538483898d9993c714888480cbc71c1582cbc68890989e828a938a109c5 8cec09acac55acece9789db5c9cc68dd5968b1457d386891695d5db5008815b5e99c9c91785549e8ec6c3999cd05cd353d785519e979757d2d192cd15c28a9d95c9595dc95d998f86d3d8538753ced75c859b52c75317cf5f53d6958113d98a8a831f8dc8cbcd9d8ecb1e9087dfcb148896565088d6d2d8971290c8d8d49e149a5416cf158e1b8e1a12558859c55b135b928b905191d
Authentication-Results: mx09.dca.untd.com; DKIM=PASS
X-ContentStamp: 49:24:227540408
X-UOL: yxxxftftlnhkpyhaeaenalgdgjknvsqkqyi hwqcxmzebbennbbaweahqfxdkvzgnbtbzdmyiwpgfsktgqxqaxhtazpqgbhtpsejftdedtjqvjmvpqxaiphpafwcpvqiccccyap sabwlqqxqba
Return-Path: <bounce-fkjapivebhiizqfmhievzmfphgwdskqjase@foamyleu.com>
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=selector1; d=foamyleu.com; h=From:Reply-To:To:Message-ID:Subject:MIME-Version:Content-Type:list-unsubscribe:Date; i=fFgiljHFvEeJFeaAAWi@foamyleu.com; bh=PHPBQVcuVZ0AAeQYbzVlZpkM/n0=; b=UNmbTIravUg+PEFOt8LyGe/zb7v7zW0vyJyTYnnGAK2xIl5uh83z/ndsgmF2IhUPqQUTRDWdCCY6 p9GTzSBjIfA9R0i/iR5TqUbcV4ANTYpNlFbgQRfUprTFd/fcka/3ASuz9rw7T4s2zzI+FUXhojDV PK06xZ9xOp2L5C8pjVo=
DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=selector1; d=foamyleu.com; b=G+Bkmb/T9YW23Zyd0lp/L/ZocMZQdQITCQpxnkyAxcdduenmDAq/MVgOsAAt1APFvYR2KrDSpDSe MtvkQmDjmSrXV35iQJXTTiw81D+57uTUQb1j3QLR6q873KLXDa5snnTR3chFVJVwuElYXbP/42SB 9/V4pavxr7E6aWsEgS8=;
X-UNTD-BodySize: 12187
Received-SPF: Fail
X-UNTD-DKIM: PASS
X-UNTD-SPF: Fail
X-UNTD-BPF: 58a52c4981f9b8bd998581cd583549ed35753105b8285c9d5c115c35dd5c18d1187cd8dddcd998f5488861b5c871ddf14dc1e8914d615c3138a109c58c5509e9a16ce5
list-unsubscribe: <mailto:unsub-9781317231038981165563-803294773-OZS4FZ4B3A310XDLUUJE56OUMLSPVZEIB2H@foamyleu.com>
Message-ID: <630227187908.287666632.671320385203569.JavaMail.root@foamyleu.com>

edited by moderator: Removed poster's email address. -Razor2.3


Reply ↓  Report •

#12
August 24, 2017 at 10:08:56
One thing that stands out is they all mention "unsubscribe" which makes me think they are commercial messages - possibly spam.

What email program or service are you using?

Always pop back and let us know the outcome - thanks


Reply ↓  Report •

#13
August 24, 2017 at 10:34:11
Derek: What email program or service are you using?
Going by the headers, I'd think Juno would be the service provider.

So, looking at the senders, and I see two domains popping up. Namely, coolforever4.com, and foamyleu.com. Both of which were registered just over a month ago, both of them have the default Apache landing page, the IPs of both point to third party web hosting services, and I can only assume they're dedicated spam domains. Block them in your program, or talk to Juno's customer support to see if they can be blacklisted.

How To Ask Questions The Smart Way


Reply ↓  Report •

#14
August 24, 2017 at 11:03:29
I use Juno off line. However I checked Juno "on line" and the info is there. I, too suspect it is Spam, but it just started and the messages are not all Spam, but legitimatesenders--my Senator, my Insurance company, and one of my medical message. ??? I'll copy/paste a their header info below.

Uncle Dewey


----- Forwarded Message -----
From: "Senator Dianne Feinstein" <senator@feinstein.senate.gov>
To: xxxx@juno.com
Date: 19 Aug 2017 11:39:31 -0400
Subject: =?utf-8?B?RmVpbnN0ZWluIFVwZGF0ZTogU3RhbmRpbmcgYWdhaW5zdCBy?= =?utf-8?B?YWNpc207IFRydW1w4oCZcyBkYW5nZXJvdXMgaW1taWdyYXRpb24gcG9s?= =?utf-8?B?aWN5OyBGaWdodCB0byBzYXZlIGhlYWx0aCBjYXJl?=
Message-ID: <FEINSTEIN-IQLqIfQdm000bd3e8@feinstein-iq.senate.ussenate.us>
Received: from mx06.vgs.untd.com (mx06.vgs.untd.com [10.181.44.36])
by maildeliver02.vgs.untd.com with SMTP id AABN3SY7VAYZYQAS
for <xxxx@juno.com> (sender <senator@feinstein.senate.gov>);
Sat, 19 Aug 2017 08:39:31 -0700 (PDT)
Received: from p-ess-cssb220110.senate.gov (p-ess-cssb220110.senate.gov [156.33.220.110])
by mx06.vgs.untd.com with SMTP id AABN3SY7VASAAD92
for <xxxx@juno.com> (sender <senator@feinstein.senate.gov>);
Sat, 19 Aug 2017 08:39:31 -0700 (PDT)
Received: from [156.33.203.107] ([156.33.203.107:56967] helo=FEINSTEIN-IQ.senate.ussenate.us)
by p-ess-cssms3.senate.gov (envelope-from <senator@feinstein.senate.gov>)
(ecelerity 4.1.3.47899 r(Core:4.1.3.1)) with ESMTP
id 29/5A-22206-3BB58995; Sat, 19 Aug 2017 11:39:31 -0400
Received: from FEINSTEIN-IQ ([127.0.0.1]) by FEINSTEIN-IQ.senate.ussenate.us with Microsoft SMTPSVC(8.5.9600.16384);
Sat, 19 Aug 2017 11:39:31 -0400
MIME-Version: 1.0
Content-Type: text/html; charset=iso-8859-1
Content-Transfer-Encoding: 7bit
X-UNTD-UBE: -1
Precedence: Bulk
X-UNTD-Peer-Info: 156.33.220.110|p-ess-cssb220110.senate.gov|p-ess-cssb220110.senate.gov|senator@feinstein.senate.gov
X-Envelope-From: "Senator Dianne Feinstein" <senator@feinstein.senate.gov>
Return-Path: <senator@feinstein.senate.gov>
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=senate.gov; s=senate-css1704; t=1503157171; bh=9kiWpHQ/+6xab268MB5NviVZ8fj83UP8LZgrAnS3HsY=; h=From:To:Date:Subject:Content-Type:Message-ID; b=cQB2Z38cENLyyCfarQOs7YckJhX5ecqYHJQTDlnTR5XwPgOA7Xu4oyXAXQasH1Tef KeMAeahRFCkGKsAnoALWJr3KsI8tx5ZUtJA1mNjc4gVWt0bJEztpZNHKkzXXim7b5N cssh4z+oml7pyQqPaTJdL1ZyLQNxkio12uN0ZPVS7Dnqb+oZSkNi2zOBV2HYhFRvro 2CFF2M3DYqSdTGZT8EeyiwdRsiC3i7ASbSLleNyGhqIyxq+i8IhCs78cGipy+vGcDk XGKgCYT92mC1mdVuTDAH2aG1+Qfhb1rhZCmjFuKfVJvedj+USFfKqZbM73IkATQS1f cLcHdDsqZIaHg==
X-IQCropID: 19170.210176044.156902102.7222218
X-UNTD-BodySize: 29472
X-OriginalArrivalTime: 19 Aug 2017 15:39:31.0312 (UTC) FILETIME=[599ED700:01D31901]
Message-ID: <FEINSTEIN-IQLqIfQdm000bd3e8@feinstein-iq.senate.ussenate.us>

----- Forwarded Message -----
From: "State Farm" <drivesafeandsave@e.statefarm.com>
To: xxxx@juno.com
Date: Thu, 22 Jun 2017 10:25:40 -0700
Subject: =?UTF-8?B?QUNUSU9OIFJFUVVJUkVEOiBSZXBvcnQgRHJpdmUgU2FmZSAmIA==?= =?UTF-8?B?U2F2ZeKEoiBPZG9tZXRlciBSZWFkaW5n?=
Message-ID: <0.0.124.E1.1D2EB7C6E075A8A.0@om-statefarm-trans.rsys2.com>
Reply-To: "State Farm" <christine@christinecline.com>
Received: from mx08.vgs.untd.com (mx08.vgs.untd.com [10.181.44.38])
by maildeliver12.vgs.untd.com with SMTP id AABNWZ9NXAEYJTBS
for <xxxx@juno.com> (sender <sfi.1285@envfrm.rsys2.com>);
Thu, 22 Jun 2017 10:25:41 -0700 (PDT)
Received: from om-statefarm-trans.rsys2.com (om-statefarm-trans.rsys2.com [12.130.138.180])
by mx08.vgs.untd.com with SMTP id AABNWZ9NWA6RQ55A
for <xxxx@juno.com> (sender <sfi.1285@envfrm.rsys2.com>);
Thu, 22 Jun 2017 10:25:40 -0700 (PDT)
Received: by om-statefarm-trans.rsys2.com id h9fulg161hs7 for <xxxx@juno.com>; Thu, 22 Jun 2017 10:24:40 -0700 (envelope-from <sfi.1285@envfrm.rsys2.com>)
MIME-Version: 1.0
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
X-UNTD-UBE: -1
X-UNTD-Peer-Info: 12.130.138.180|om-statefarm-trans.rsys2.com|om-statefarm-trans.rsys2.com|sfi.1285@envfrm.rsys2.com
X-cid: sfi.10930097
X-MAIL-INFO: 4a61214061b10d0c4d40b111114d7d74d9e9a9f095ede5bd01540475c1e52d71711d451da191a4a424a4d034a4d4d475358d2154308194404d54c43d20097979791da5a141b039a5c991ad05d191d0d4d4d46dcdc4d19450d4d15510754971692161690cb1250c00814584fd406059fde5c951e4d959b490e9d931712d293d59c045b02491a1a4f9a1dd1499ddd4d1f449b1d55431b13930a9113d31b920793d649150958554dd
Authentication-Results: mx08.vgs.untd.com; DKIM=PASS
Feedback-ID: 1285:324706:oraclersys
X-ContentStamp: 17:8:3790449680
Return-Path: <sfi.1285@envfrm.rsys2.com>
X-CSA-Complaints: whitelist-complaints@eco.de
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=statefarm; d=e.statefarm.com; h=MIME-Version:Content-Type:Content-Transfer-Encoding:Date:To:From:Reply-To:Subject:Message-ID; i=drivesafeandsave@e.statefarm.com; bh=n/klscFBBjtBkrOuI42CwR8/owY=; b=Njl1gm+YkMmDTD1V6nvNUZdrY10X8MYitZeN9RPvvLLmOt4D8vFi8LB2nKyLk59L5y6SoOtsWBif t55vOcvrjf/0fvY/hkgJRsKiHoQZbcdJoJuMQ0n0sO/yt5KbsF+LtlYhvK7iPWD3Wac97ctmrSmc sXiTc5rPSwoSZv6QkLA=
X-rext: 5.interact2.EuSKwGvLMht0mCZRMrCMzoaYMsjybN_xy9brV_VCsKZ9kBZE42mxQ0
X-sgxh1: KLOLPgLtkhgxrmghQJhu
DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=statefarm; d=e.statefarm.com; b=QuNut+YPLuYMTgPvBTIVYqD6J64K7RpNusi3QrhK7zsc3h1dmd96FNrw3MDH6s4veDXJu8ypgySs ZUi9SFY6P2UVumNVWV3Nigm5V5p/OXks9huLM7IjXGOvMuXODuJgP6Rc3DaNhaiqqAXZ1CUQWCnU hPcFdE5aiLKAy0FnupE=;
X-UNTD-BodySize: 56836
Received-SPF: Pass
X-UNTD-DKIM: PASS
X-UNTD-SPF: Pass
X-UNTD-BPF: 4a0db169b12d25bd4d45b14d0030694530f5a9ed258d89b43995c13079b539b03d09b491701db0a1c1d4dd5014ddd170d0c4d444d0f45039f524b9cdc555fd9d5541e4904119a0c9
Message-ID: <0.0.124.E1.1D2EB7C6E075A8A.0@om-statefarm-trans.rsys2.com>

----- Forwarded Message -----
From: Sutter Health <npssupport@sutterhealth.org>
To: xxxx@juno.com
Date: Mon, 07 Aug 2017 09:10:56 -0700
Subject: =?utf-8?q?How_was_your_recent_experience_with_Sutter=3F?=
Message-ID: <fcnz-773728-1837714872-z98xpfnzqw-npssupport@sutterhealth.org>
Reply-To: npssupport@sutterhealth.org
Received: from mx08.vgs.untd.com (mx08.vgs.untd.com [10.181.44.38])
by maildeliver05.vgs.untd.com with SMTP id AABN2TGYPAFRCUHJ
for <xxxx@juno.com> (sender <invite+fcnz-773728-1837714872@decipherinc.com>);
Mon, 7 Aug 2017 09:52:29 -0700 (PDT)
Received: from apollo.decipherinc.com (apollo.decipherinc.com [204.13.11.49])
by mx08.vgs.untd.com with SMTP id AABN2TGYPABZ7K4A
for <xxxx@juno.com> (sender <invite+fcnz-773728-1837714872@decipherinc.com>);
Mon, 7 Aug 2017 09:52:29 -0700 (PDT)
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="===============2454982796251461325=="
X-UNTD-UBE: -1
X-UNTD-Peer-Info: 204.13.11.49|apollo.decipherinc.com|apollo.decipherinc.com|invite+fcnz-773728-1837714872@decipherinc.com
X-MAIL-INFO: 19dade8ada639a3ab78a63cbcbb74e132aaf5b5eeaf3bef7331797ab5f9a13deabab6e5b57eb7f57b3d77a0a7fb37b7b0a1a1e5f0b6fa38f02c79ef30e43839b5a4bb30bd76e6e235a07075aefefbe372a9f779fbeab573e4ba7af3efbfb2e2f2e8f2b2fa7873e9a9bcffbaf734f9373f36a0b6a8bea6b1ec79e5a1ada33def79fae2af7af1a63df97b73a8adffedb5bc347ea1e179eb7272ba393c74f276b6e7a170acf2e9b37ba33335aef37efa37b6702038f0203030e43af3efbfb2e2f2e8f2b2fa7873e9a9bcffb8a777ebb13baaa6a2a870737aaefd3dabbca8e7a7a8eeeeeb36e1be7cee7b36f5e6b8bea7f6b1717c78ac75b738aeaae 6b0ea327174b6e6e0f8e1e478327eefea38ecf7a2f7b7b4bd37eafab131a1af797ab977f83dedf2b8fbf4b9ba73e373b3fa7b72e77336aaf2a83877eefd31edafadfce2a9a7eeeebd3
Authentication-Results: mx08.vgs.untd.com; DKIM=PASS
X-ContentStamp: 6:3:4099872864
Return-Path: <invite+fcnz-773728-1837714872@decipherinc.com>
X-Complaints-To: abuse@decipherinc.com
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=decipherinc.com; s=main2016; h=To:Subject:Message-Id:Date:From:Content-Type; bh=83wrz9Dj2GYlj0a8QK+u6rnA6R8poJkXYnRGl+6kVGs=; b=UIqBHsLf/ZlvZ8YBKM7nAUI8TOYfuSIUf/bxdw1mpTI2OAt3Z1pOzxcDtZm0ZZHn616ESPwmptdY50buJE0hUJNuWlTq/HF/ufBbedTdLwaUhkdDeNPGAVYscZlPQTZz0qzwW8JnDG9tVPEcNYEHp4fVXOuZ6+DSzsAt49sbhWzoG5tn/7fRwndmLkEQnb1rHYaG1umTJT/ADTnc/L0WI1Z2zSXvRX6O6Z9zwdxPT5J+PmSV50SunYVKkHR4BAmnzXS2iRVDC5bdynXpDtq4NGKyAMGr8mhsplmtj6t06qf9MLzE1FBPs4I3Hd4ciETrs54tko/kxwSJ5oTVAtmPGg==;
X-UNTD-BodySize: 9814
Received-SPF: Pass
List-Unsubscribe: <mailto:unsubscribe+fcnz-773728-1837714872+fvto=64657765796e656c736f6e406a756e6f2e636f6d@decipherinc.com>
X-UNTD-DKIM: PASS
X-UNTD-SPF: Pass
X-UNTD-BPF: 19cacadffadbfaf74acb63b7ca73dfc373935bf3faea5f6b5fea5f73575f0f9eae4f270fee6ece1ed7677a1be77f0f0abf7b0247237a7f6bca2f8e0b2b27ea2b1b2efb83fbba5a3b5a879b33be
Message-ID: <fcnz

edited by moderator: Removed poster's email address. -Razor2.3


Reply ↓  Report •

#15
August 24, 2017 at 13:43:36
I put coolforever4.com, and foamyleu.com. in my message checker and if found to be deleted. So far I've only had one message and it did not have coolforever4.com, and foamyleu.com. in the header

Uncle Dewey.


Reply ↓  Report •

#16
August 24, 2017 at 14:21:26
I think Razors idea of contacting Juno is the best idea. They might be able to help. Seems pretty certain these messages are coming down the wire and not a local system issue.

Always pop back and let us know the outcome - thanks


Reply ↓  Report •

#17
August 28, 2017 at 11:27:45
i have sent the problem to Juno. It is not only spam, messages as I also get the nonsensical info from usual messages from e-bay such as: Subject: =?UTF-8?Q?=F0=9F=9A=9A_ORDER_SHIPPED:_Halls_Cough_Drops_Tr...?=

I know the real subject is regarding my cough drops.

Uncle Dewey


Reply ↓  Report •

#18
August 28, 2017 at 12:33:44
OK. We need them to see if it's OK their end and if so, between us, where it goes wrong.

Always pop back and let us know the outcome - thanks


Reply ↓  Report •

Ask Question