Mailhost configuration problem, identified internal IP as source

[Mikey2]

Plz ignore, found answer in forums.

Edited December 10, 2022 by Mikey2
Remove IP addresses

[Lking]

Would you like to share your answer with the group?

[Mikey2]

Well, it did not exactly work for me.

Originally, I posted:

Parsing header:

0: Received: from 104.148.61.131 (EHLO channel.saygingasgrup.com) by 10.215.136.138 with SMTPs (version=TLS1_2 cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256); Sat, 10 Dec 2022 16:18:01 +0000

Hostname verified: channel.saygingasgrup.com

Possible forgery. Supposed receiving system not associated with any of your mailhosts

Will not trust this Received line.

Mailhost configuration problem, identified internal IP as source

Mailhost:
Please correct this situation - register every email address where you receive spam

No source IP address found, cannot proceed.

Add/edit your mailhost configuration
Finding full email headers
Submitting spam via email (may work better)
Example: What spam headers should look like

Nothing to do.

 

 I went through the automated mail host set up, and it added a new mail host for me after following the prompts, but I'm still getting the "Mailhost configuration problem, identified internal IP as source" message on some of my spam messages.  Thank you very much for asking Lking.

 

[Mikey2]

Same issue as:   

 

 

[petzl]

3 hours ago, Mikey2 said:

Well, it did not exactly work for me.

Originally, I posted:

Parsing header:

0: Received: from 104.148.61.131 (EHLO channel.saygingasgrup.com) by 10.215.136.138 with SMTPs (version=TLS1_2 cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256); Sat, 10 Dec 2022 16:18:01 +0000

Hostname verified: channel.saygingasgrup.com

Possible forgery. Supposed receiving system not associated with any of your mailhosts

Will not trust this Received line.

Mailhost configuration problem, identified internal IP as source

Mailhost:
Please correct this situation - register every email address where you receive spam

No source IP address found, cannot proceed.

Add/edit your mailhost configuration
Finding full email headers
Submitting spam via email (may work better)
Example: What spam headers should look like

Nothing to do.

 

 I went through the automated mail host set up, and it added a new mail host for me after following the prompts, but I'm still getting the "Mailhost configuration problem, identified internal IP as source" message on some of my spam messages.  Thank you very much for asking Lking.

 

I would suggest you remove old ones, then redo your "new" mail hosts, you could get more than one email from mail hosts you need to reply to each of them.

[gnarlymarley]

One quick note is that you might need to resend the setup email if your mailhosts had any changes.

[Mikey2]

I will regroup on this after the first of the year, and follow both suggestions.  Thank you very much for your input(s).  It is much appreciated.

[scottNY]

Does this refer to the spam I receive from domain *.xyz where it shows the originating IP as 127.0.0.1 or is this a different issue?  Sorry for the newbie-like question.

[petzl]

5 hours ago, scottNY said:

Does this refer to the spam I receive from domain *.xyz where it shows the originating IP as 127.0.0.1 or is this a different issue?  Sorry for the newbie-like question.

Reporting spam from a companies network address "127.0.0.1", won't work with SpamCop

[gnarlymarley]

Mailhosts can work with internal servers with a 127.0.0.1 IP, but it is meant to determine your ISP's border mail server.

[scottNY]

Thanks. I understand that 127.0.0.1 is an internal loopback IP all computers use. How come I get regularly get spam [it always includes "yahoo" in the email header properties dialog] and uses 127.0.0.1 as the sender IP? It isn't coming from my PC and if I try to submit to Spamcop manually, it bounces back. I hope I am explaining this correctly.

[petzl]

On 12/30/2022 at 7:27 AM, scottNY said:

Thanks. I understand that 127.0.0.1 is an internal loopback IP all computers use. How come I get regularly get spam [it always includes "yahoo" in the email header properties dialog] and uses 127.0.0.1 as the sender IP? It isn't coming from my PC and if I try to submit to Spamcop manually, it bounces back. I hope I am explaining this correctly.

Try reporting one via SpamCop and before you submit at top of reporting page will be a SpamCop "Tracking URL" copy it and post it here may help solve?
Here is your TRACKING URL - it may be saved for future reference:
https://www.spamcop.net/sc?id=z6783981921z3874a5706b7057f2b6578e022311dddfz

[scottNY]

Thanks for the clear direction, Petzl.  Here is what you asked for.  https://www.spamcop.net/sc?id=z6792151867z023f771c3fe755a1a45ad824025053f2z

Here is the header information with my email address hidden:

Received: from 127.0.0.1 by atlas-production.v2-mail-prod1-gq1.omega.yahoo.com pod-id atlas--production-gq1-69c878588f-lqv2b.gq1.yahoo.com with HTTP; Sat, 31 Dec 2022 03:34:10 +0000
Return-Path: <return@liveisgood.shop>
X-Originating-Ip: [93.115.96.156]
Received-SPF: softfail (domain of transitioningliveisgood.shop does not designate 93.115.96.156 as permitted sender)
Content-Transfer-Encoding: 8bit
Authentication-Results: atlas-production.v2-mail-prod1-gq1.omega.yahoo.com; dkim=unknown; spf=softfail smtp.mailfrom=liveisgood.shop; dmarc=unknown header.from=uness5.liveisgood.shop;
X-Apparently-To: sxxxxx@aol.com; Sat, 31 Dec 2022 03:34:10 +0000
X-YMailAVSC: WUAhPOI3bBtIGmy_BYFVTRv3Qu1WlRcreC7fsaHbiPjLFWx WXceSJeFjrKrQnF35xCQWbAdUs1aboqQG9ovld_v9nQhfFAfRulITp6ayy_s l5L4sybipvDNXQV5O7UcdUStejaKlAasdrXh6GH8krwqAnYwfkO2gr65v0vE 1p_SIe1ZZpWQ7QUrKYgXuhPeMW0dG.lXQq0nD65fO.rh1E55W3Vw2SceKk_v wrCgWfCn5a1vU2lumReEzFJBsD.cozu0HXRt9N5UqT2enSNHOTxfrKOJYQti ut5TXxIxul52JfAJtlf2ky8HQxp9pPj7BNFlTVZ2aNfNXq3ICc9rWPVMukoQ eZeX.jZfTO6D8YL_5Ac4RphKy6n6qAi8x11umMJaXPyKWooQmGz6epqfw73X QiyMKqkG0tyqksTm9MGKwj3FLjb.2MzTtOEdMsIJ8CHyIoloCsZlCGdSk3d7 q5BelF6CycaXFKQr_HgKQMfdTaGgZldAPj.UfRvj0x65KI1f3oFV3TLH0cl2 _bl6oEZYKwnLAzqleatSyYgf_ndeWOHKJ0NLbYqC1uGxzHc3AvjkX5SXs4zi rWd1enN_qjDsgUDzDJ1oHDzqll0XJanZ5DGlZ7DQsu0PNNEVAFBKpSxZRtim aCeHtfsrn0QBJMfAhk_vZYFwGJpXy7GseTEPdn3lsPPIKbdSgGYdI7LQ2Y62 aDOJ7rMddaRGtnCIOg6SeKoHb8stqffpH1O2dLocG_XiVUoFSkxXXxujDuZN rEvRcPWe4OCnf1GfWvKrr8itpVs3.yipfknAhRZbneH.mWGDyox_f2ABnGn9 EHnhcc3I8Gx0BubTWYos3rmIzXzTHtD61ojDS4L8Z18b46kf0mr3agWFoewk PJ8qMNz7RZNuJiqqNJQwHSFWB8_trpr3tAq_Qbgy7JfzAVxi_g1RGYVXSSiJ LO3E3zKang47fJRMlspGFgg16dhLuAy0uA33Z
    jECbw2quz.rgL4wwvc.kXXX vI2dEKTCh.SEda48eQWl_2551EYqu9bqrWR4O43iEMv_cN03dtyQtLiibMB_ UL2pC30ZbWYFRIsnOwuVSLfHETWzgb4UrMK5Nc8zqn4415KgoV9Ad2o4_KOM 6nn3CutI7edCj6U.LalQdcYuaYKlKBT6knKWnZ.K.70MxEElktk96af8_hM. GMcCgfff0kiYC_dVc4kogpl2fJWJdrlLt_BvT7vy78JNN8NbfHSQ_u8wg12E .7ABlr8r8v7VRA.Wz0l0LO3pBRvy8upFbXv1E.g_IjD2PBvgjF5gfZbV1omS or4m2fSbHk5eUH4TSDNz9Zw4XZa.H7O0Z8L2G.XEgUY8vjauENuJ4aAvW5vf DIHD.pTxqj9e95JnkuPKBqngluXyK26bhJ5Hse_Wukj5FH1jK3v8g1HLg7eu nCyg_JnHl02.84EJBHD2bJECpP1t2TY0_07CGYL9P6iY5mkSlgihDSSYuCm4 .pWmk99WFHNHgbL1cYqZjj7Q47ZzBDBmR4Yo7Sd4tOYkQkR83LOXOaqiaj1W IAFmcVy9CHt6tDWsP5ZW91f.BzPQaJdxpgsPcC1wvj9x8WQL6inw-
X-YMailISG: 5A49otMWLDtwO4vXlr06sqMt5mZLaDIrlEsOTj9WpFwIgPcb iq5ePBoVpbxnpFgvOPTEdMqmqhHQeLM06Y9zcW4wyi7EmOKEQrwVtsfjimFb U4jnktaowpAo9K8vFtwft142LIqfUXFsacdGyXBFamu_8nriydPTS66stjtw SGwKrB.kloLgygV61p48NeqYJmpxoiecZlmNbgKO_pubzeuR8L1MLaYCfYIx YxRuowmbqpUZn1hh8PAMT6QV42dsB2bG2wI011Ns6b3zLHtnSfS_i9gvnERQ 5yVjqPC.gX9US8FbY5tR.6eBv92PtWNd5MpTDdTYNviwDiTy5rduerTbhl.V YrNyD0Gh3f5r_G2usJY.BYna51ZyK.j6x6JSOoO9.3f.DBYcCbpeGwJQBYFw cIsasOOFE6sSpMFrGR2qBhivodl93ajy7Hg4cjoF2wbFnz4wpD6K_8zaJOzy dlEWx94mBBLtNmQdRTutxZzlkHHNRQVv4_t3_ggcDGejSi1ltXktX6eetWp4 79t0KDZ_lT3eX7q_kh6c3a5hsnwIMpHh9m0boQq3yiUOqVi_L5ALwkQTiEZL INf6w35R35H_aSIQs5DaTRZJtJ4Q.9sgKPnAyuyNX1bYGFvD91to0P6j5Nj_ 0yKTEw54aXviZ.CNlp5H_zAaKamVHj1M0Dz8Dasve_YYiV7rRXwPhOBq8F22 HN9wKvppQZgtQgfVAt5XMN173_f.AKQUoWlsjfL03XgpUOGqcBQfqqXY7g.0 FZ7MKrUbJqE8lD1ICgi0ZPhL9iAU0E5HAgMpxBr_JvMgwceaKBrYoTY7f_fA BUQndcyMfD8mhLHNjrX4mejk0ZgcynZdDnMalf7FyM0GT91_8y1c3W6ae4SJ TIPucBlCLlRW4_M.VEsOIeOq0fPXo2g4XUvyp6FznqVOgzS7WngFCyWjxk2X Be.39b5dZ4ix0m9TwyC7eAggA3Tqf46bUGyE
    TjpDsnZk5gL7XTZ1EnkWHxyG fi3Bpid7rUijIN0QxlVNXjqXXCdqWmNWEiCD8CZLbZADHJc1g9eJf6wg9jSi 3ESrcoDOHlH0oo3QiMxdinMPS3ZlX644.IQOYaRuAmqPgZ5.uJdjTFBlWt4k 0J2IftuOGKrbCR7OqnHrVH3xzMbdmKOt8QOX78VRSe6ihQ--
X-SpamFlt-Status: spam
X-KASFlt-Status: {Tracking_amspam_for_Misha_3lev}
X-KASFlt-Status: {Tracking_amspam_for_Misha_endurl}
X-KASFlt-Status: {Tracking_amspam_for_Misha_superweak}
X-KASFlt-Status: {Tracking_amspam_for_Misha_newdomain}
X-KASFlt-Status: {Tracking_uf_ne_domains}
X-KASFlt-Status: {Tracking_list_headers, id}
X-KASFlt-Status: {Headers: Tracking_amspam_urls_three, imghost}
X-KASFlt-Status: {Tracking_amspam_for_Misha}
X-KASFlt-Status: {Tracking_marketers, two}
X-KASFlt-Status: ApMailHostAddress: 93.115.96.156
X-KASFlt-Status: d41d8cd98f00b204e9800998ecf8427e.com:7.1.1;127.0.0.199:7.1.2;i.imgur.com:5.0.1,7.1.1
X-KASFlt-Status: Rate: 100
X-KASFlt-Status: Method: headers plus
X-KASFlt-Status: Status: spam
X-KASFlt-Status: {Tracking_from_domain_doesnt_match_to}
X-KASFlt-Status: {Tracking_amspam_for_Misha_old1}
X-KASFlt-Status: {Prob_amspam_text, usual}
X-KASFlt-Status: Category: Phishing
X-KASFlt-Status: {Headers: E23729_dosetph}
X-KASFlt-Status: Version: 5.9.18.0
X-KASFlt-Status: Lua profiles 174490 [Dec 29 2022]
X-KASFlt-Status: LuaCore: 502 502 69dee8ef46717dd3cb3eeb129cb7cc8dab9e30f6
X-KASFlt-Status: {Tracking_newaverage_msgidsensi}
X-KASFlt-Status: {Has list-unsubscribe header [mass mail]}
X-MimeOLE: Produced By Microsoft MimeOLE
Received: from 93.115.96.156 (EHLO uness5.liveisgood.shop) by 10.206.128.73 with SMTP; Sat, 31 Dec 2022 03:34:10 +0000
From: "Grow Your Own" <newsletter@uness5.liveisgood.shop>
To: <sxxxxxx@aol.com>
List-ID: sxxxxx@aol.com
X-List-Box: <VmDeLSsscottier1sSVmDeL.89891.Box>
Subject: =?iso-8859-1?Q?=5B!!_SPAM=5D__=E2=80=9Cyou_never_told_me_it_was_so_BI?=
    =?iso-8859-1?Q?G!=E2=80=9D_=5B40%_growth=5D?=
Date: Sat, 31 Dec 2022 04:33:42 +0100
List-Unsubscribe: <mailto:leave-gKYaoTFGOYvvgKYaoTFGOYvv-89891@uness5.liveisgood.shop>
MIME-Version: 1.0
Reply-To: "uness5.liveisgood.shop" <reply-gKYaoTFGOYvvgKYaoTFGOYvvgKYaoTFGOYvv)_HTML-gKYaoTFGOYvvgKYaoTFGOYvvgKYaoTFGOYvv)@uness5.liveisgood.shop (reply-970787308-5208494_HTML-gKYaoTFGOYvvgKYaoTFGOYvvgKYaoTFGOYvv)@liveisgood.shop)>
List-ID: <gKYaoTFGOYvvgKYaoTFGOYvv.xt.local>
X-CSA-Complaints: whitelistcomplaints@eco.de
Message-ID: <LYRIS-gKYaoTFGOYvvgKYaoTFGOYvv-X89891X@uness5.liveisgood.shop>
Content-Type: text/HTmL;
    charset="iso-8859-1"
Content-Length: 2172

I get several a day like this, although usually from *.xyz.com. They always have *.yahoo.com in the first like like it is here.

Thanks and happy new year!

[petzl]

2 hours ago, scottNY said:

Thanks for the clear direction, Petzl.  Here is what you asked for.  https://www.spamcop.net/sc?id=z6792151867z023f771c3fe755a1a45ad824025053f2z

Here is the header information with my email address hidden:

Received: from 127.0.0.1 by atlas-production.v2-mail-prod1-gq1.omega.yahoo.com pod-id atlas--production-gq1-69c878588f-lqv2b.gq1.yahoo.com with HTTP; Sat, 31 Dec 2022 03:34:10 +0000
Return-Path: <return@liveisgood.shop>
X-Originating-Ip: [93.115.96.156]

You using Yahoo email?
What is your email client  seems headers are mangled?

Go to Mailhosts and send update them
the mail is from a spammer and gets blocked
https://www.spamcop.net/w3m?action=checkblock&ip=93.115.96.156
will be delisted automatically in approximately 6 hours.
Other hosts in this "neighborhood" with spam reports
93.115.96.56 93.115.96.171

[scottNY]

Actually, no, I use AOL [had my email since the birth of email] but I use Outlook as my mail client. I deleted and re-added my AOL mailhosts. I also verified that Outlook was giving me the same header information as in the original email when viewed on AOL and it is. All the 127.0.0.1 spam I get has yahoo in the header information, which I don't understand, if that helps. And I'm sorry, I don't understand this part:

"https://www.spamcop.net/w3m?action=checkblock&ip=93.115.96.156
will be delisted automatically in approximately 6 hours.
Other hosts in this "neighborhood" with spam reports
93.115.96.56 93.115.96.171 "

Thanks!

[petzl]

2 hours ago, scottNY said:

"https://www.spamcop.net/w3m?action=checkblock&ip=93.115.96.156
will be delisted automatically in approximately 6 hours.
Other hosts in this "neighborhood" with spam reports
93.115.96.56 93.115.96.171 "

The above is SpamCop Blocklist works like a radar, when certain mathematically number of spam IP's hit it it lists that IP for at least 24 hours.
If your Outlook headers are wrong  but the same as AOL?
(try copying and pasting AOL webmail headers to SpamCop report page to make sure)

Edited January 2, 2023 by petzl

[gnarlymarley]

The two Received header lines don't seem to line up. Usually they don't use an IP after the "by". What is after the by below should match before the "by" one the line above. My guess would be 10.206.128.73 is actually the atlas yahoo server. They should be using the domain and not a 10.0.0.0/8 IP. It might be good if you were to login with a webmail to see if the headers are the outlook client or if it is a yahoo/aol server issue.

Received: from 127.0.0.1 by atlas-production.v2-mail-prod1-gq1.omega.yahoo.com pod-id atlas--production-gq1-69c878588f-lqv2b.gq1.yahoo.com with HTTP; Sat, 31 Dec 2022 03:34:10 +0000

Received: from 93.115.96.156 (EHLO uness5.liveisgood.shop) by 10.206.128.73 with SMTP; Sat, 31 Dec 2022 03:34:10 +0000

[Mikey2]

Well, I guess I am going to have to give up on reporting spam to SpamCop.  Everything I have tried seems to have failed, again and again.  I have deleted mailhosts several times and added them back in using the tool provided.  However, all my reports now end up the same, with the failure message, "nothing to do".

 

SpamCop v 5.4.0 © 2023 Cisco Systems, Inc. All rights reserved.
Here is your TRACKING URL - it may be saved for future reference:
https://www.spamcop.net/sc?id=z6794918584zedd0b52588ee71ebe70d76c09f8d9840z

 

Parsing header:

0: Received: from 178.170.47.16 (EHLO sildenafilztabs.com) by 10.215.172.81 with SMTP; Sat, 21 Jan 2023 15:07:46 +0000

Hostname verified: sildenafilztabs.com

Possible forgery. Supposed receiving system not associated with any of your mailhosts

Will not trust this Received line.

Mailhost configuration problem, identified internal IP as source

Mailhost:
Please correct this situation - register every email address where you receive spam

No source IP address found, cannot proceed.

Add/edit your mailhost configuration
Finding full email headers
Submitting spam via email (may work better)
Example: What spam headers should look like

Nothing to do.

 

[petzl]

1 hour ago, Mikey2 said:

SpamCop v 5.4.0 © 2023 Cisco Systems, Inc. All rights reserved.
Here is your TRACKING URL - it may be saved for future reference:
https://www.spamcop.net/sc?id=z6794918584zedd0b52588ee71ebe70d76c09f8d9840z

your email provider is a intranet  (10.215.172.81) is listing as "received from" IP  178.170.47.16 which is the spammer?
https://check.spamhaus.org/listed/?searchterm=178.170.47.16
Your IP address is either exhibiting suspect behavior, is misconfigured, or has a poor sending reputation.

[Mikey2]

Thanks for the second set of eye Petzl.  Your analysis seems correct, but I do not know how I can change my IP for email, as it belongs to AOL.   I guess I either have to give up this email address or stop reporting spam to fix this?  I don't have any control over the provider's email IP, to the best of my knowledge.

I have Internet provided by Frontier.com (local telco), which was Verizon.  Verizon dumped their email several years ago over to AOL, which I am forced to use their User Interface mail relay. 

My Malware VPN is turned off when I try to report spam.  I do use OpenDNS DNS servers, 208.67.222.222 with backup 208.67.222.220 if that matters?

[petzl]

2 hours ago, Mikey2 said:

Thanks for the second set of eye Petzl.  Your analysis seems correct, but I do not know how I can change my IP for email, as it belongs to AOL.   I guess I either have to give up this email address or stop reporting spam to fix this?  I don't have any control over the provider's email IP, to the best of my knowledge.

I have Internet provided by Frontier.com (local telco), which was Verizon.  Verizon dumped their email several years ago over to AOL, which I am forced to use their User Interface mail relay. 

My Malware VPN is turned off when I try to report spam.  I do use OpenDNS DNS servers, 208.67.222.222 with backup 208.67.222.220 if that matters?

Not sure about AOL do they have web mail? If so try direct reporting spam from that.
It looks to me like AOL are using a badly configured email intranet server?
I only use Gmail Webmail, without problems
A  VPN should not affect SpamCop reporting, however some websites have a blacklist of VPN IP's and deny access.
I mainly use a VPN except like now in morning I read "news", then I have it off as my VPN IP's are blocked for such sites.

Edited January 22, 2023 by petzl

[BillyOrBob]

I have also noticed the same behavior with emails to a yahoo email account.  It's not the email client causing it - in my case Thunderbird.  If I look at the same emails via the web portal, the header is doing the same thing. 

But if you look at this header, in the following line, 10.206.155.40 is the address that should be in the place of 127.0.0.1

If your parser stopped looking at top of the header for the received by and picked up the info a bit further down the header, the issue would be resolved. 

Received: from 107.174.244.119 (EHLO cividual.asia) by 10.206.155.40 with SMTP;

Received: from 127.0.0.1
 by atlas-production.v2-mail-prod1-gq1.omega.yahoo.com pod-id atlas--production-gq1-7df5bd5f94-xv54q.gq1.yahoo.com with HTTP; Tue, 25 Apr 2023 16:38:13 +0000
Return-Path: <bounce@cividual.asia>
X-Originating-Ip: [107.174.244.119]
Received-SPF: pass (domain of cividual.asia designates 107.174.244.119 as permitted sender)
Authentication-Results: atlas-production.v2-mail-prod1-gq1.omega.yahoo.com;
 dkim=perm_fail header.i=@commeries.com header.s=smtp;
 spf=pass smtp.mailfrom=cividual.asia;
 dmarc=unknown header.from=commeries.com;
X-Apparently-To: bobbandino@yahoo.com; Tue, 25 Apr 2023 16:38:14 +0000
X-YMailAVSC: WOgHJzQ3bBt3hX2Mcgn2tb8LE8UbJPr62SiOXx_0x1xKf0Z
 ApVlHgTEokjKiqZCjxBVhBID3RBbmqqUmN_LrawUvCY7H7He188bt4pcbAHZ
 cysSejrsFmZmqfnstkr6vyoTN495SfCTRS3Z.J4VhMC75C1pJ6CYL29dBiEJ
 iX_pM3D6EVMJo13muxN_BuMSif.0iw_LEIhJxTmWnwfEk_3aPJXE8ExfK0Sx
 zGDn0ZX9h7k17OydGVKLotd32g6htxrdWkgK02vdZmXFuCYSnkfzg4sFJQz7
 gV8pwDXp628oUgkMMjkZBtYESDQ_dTn.LGdphaSeVbeJxmlVIbkBQ1l_G8bw
 J1tmO80qVxzPmbcyqDdBUB0fHADilzGD2acvnlzg_6pDAl3i5pSL_IDyfFyS
 GofzjbGxDiZ0Xx6TNfeLXl5tbIAzuP6J00xCw33sIZqn9XNtJdajlir6lQda
 wSm1cxxHCcoh88QDmJLi1I6YQBo04QblDUGfM_d.UNyJqMy.S9b5DEQgV7C9
 thehR8.7mgrhNuQ2zQq1xrbmq74Yzq_0jU.fQS3sG0JiXFr80wn7egLO8RIE
 kQmWId1_wps5erNy50bpcyvJPfbdWlvYEvA5Hgz8tJ8BmRvglYb4wX1AANhD
 kf9XSDX8z0oBagK0Fio4w1l85oQ3ejTxUnonJLySmAHaWi36XZUSCUXMOdYE
 7AUL236GvjEc9SBpgHMIDfKyom9NFvEOD_ty0aJgLTgu6r2tHjBHc_aKwz64
 c9KjeXz.PrWwpMLkuiXzf6gY1QR0yJtGaf6Dm_KNOr_LLq3_NMkBBY1vyHN9
 g1.kBydzIlYvoUMxc4vo9O9NOz3Ecfz14_tkQ8qdECshpQ2Tvq0DrOi2eFzv
 fxY3oVblW7DqtsuAjywY3vuZtz5DvQrKTjAileguoORdruuIgw7COM2RoVLR
 MD68PB_ZvtW3jJYNH9Df2anWCjIm7BkCBWaA_FnYX1dy4eB9cFTTw5uJG9i1
 HUvpAfQRaqt8CjAxg7L5fVid.yhb.JS0q37QBPl8TuqjDgTcj6.V7GNWiyDC
 UUHgDJsbU27iq8wE5yOPFtjXtB7IRXtCFXc5jS9xAPKa9iPCabbIWs54ZOYF
 noaNcRQE6UiSMGNf8SdnZWN4mNn0kqmBMsnEiTfET3w--
X-YMailISG: zaR6LeAWLDu1JrZMLuWv3lbzj0F2L9tfuL.WTOI50OW_OMvD
 AGX0N3gwJhkhBilDjEwFFMOxtryntIpe2tz.66DXknt7mKq7NQTFHqIeRMr.
 6BgQCsV2BxDHqCiPNx_JML9CjjQOKMTHrQAs27Nl2EIzenBEtCRowlZHNmcd
 XxajlCPwuz39xwc7ss2p6vrZ77MS9NucANX8aPEuo3SZ1PuJwIAvdAoYLTsm
 4hspmcEajLJhaoT.V03t2RK2AjpQ8LiwqP_yr4B5OQJLnGLaQbilaL5dpZnH
 Q3BQdofF.jFAkxSbt.xIijtQtXsFOVyVmChmEyN7W6Mtkny0kKUELxaKWdAp
 myOa0VgBhP5HK4pv4c1YMAXVQd4IeJaYSgjx5QUyg1HMpvr53oYEJH3Twcpy
 MrAqrLuAAvBNH56aSquaam9UQbJuWLThS3VWxJmX6yQQKfGTCvT27f0j6Bpt
 7bHWjrgPgDbA7c0ipIFFrefdh6A9x1was1rRdQRoODdLuKS9N1x5.9Rb3MWV
 u2NsA66AKZ_auuqqSkY4.Gv6kb5KePA5Gsig9E0y3EAlEpbaoWoXPD2udgtx
 _5tcqsKRDtIY5Ss4c7BAJLmFPaBxBYfTP6sUf9GebcNI6QhrmFhVs1irZ4qF
 l0PMpgeqr9LWxlXwIltmMqwc55yKKl0hEGZiRvnfERTgw2tylGMEYMUU8LS3
 LkzyhY.0J0ahQf_M4NthvRHduzUXV6cm8OmtFoMRuQNLAd6XA.qqnMEuxGzR
 MzG_t7nHUpjUVM1DZCGjcatVwCoD337WQWpdLA6.sRxPqV7zQtgDDm.GskDw
 P2petuC1a7kZJqfldVd0d4Q8zmv2wpnMuM9dFEIhO1floKO4Juh3LXA5IIlL
 j4aHmcUZ0raQ7Cwsvv30oOI8Y_w35CtploBuF0O8tQouryTGg6fLRnAXYC4E
 aHvNt.tzbGmrWqM_U9aWTPBg0YXhmw66O163kOM5hFI_P_Rh1agAhsGLO53.
 K4KHeXiztkiF5z2rfBs3.CKgYDiFdzZEQIHS8CpN6mmnsWe31vsg1GQdbyyK
 s3CAIggdbJng.32v13LL__Gfm6rHcJx4ltNlGgzAMgPxbP3eLUYeSjAljVzR
 4.ZitymwzkvRcqcjh.r58h3gmDVqWosncDzkZiD9QEXjG7rUGO82e54lA1yD
 RAfX5ogYn6EIU0v6pk1yAllGuNDYLw--
Received: from 107.174.244.119 (EHLO cividual.asia)
 by 10.206.155.40 with SMTP;
 Tue, 25 Apr 2023 16:38:13 +0000
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=smtp; d=commeries.com;
 h=From:Subject:To:List-Id:Message-ID:Date:content-type:MIME-Version; i=A@commeries.com;
 bh=pAIVr82R+MBHS4cPKxNw5ujx9zU=;
 b=GVtjrIjWk6N3gmuQbN3w3Xo7j11Q73q7dV3wsZHsypvUdxurTH9nIVMHlo5cvrdkBeJz9eliEcZa
   RnB+QzWcvEjSGxYGlti1vtMB13ZuB0fgdzwwcY94mRUpIE/wssBAziWwmrzrViANmHDEBF6CLH+O
   7yEpxd/nZBiY9nWUueA=
DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=smtp; d=commeries.com;
 b=qSdOdEZDw3Ft6JTrR//Pq2tMvgZc2igidkk2s6PBQh1eIf1MDiFBzYBNotINJADywvJSoZNaeEgb
   P4oTBLr4GSSSPXL9RqcxMcnoObkDK7g04VWUOSP3e46b+uUMuCB0nGclDazxw90BMjVDAQ4sCmmh
   7RRQ/mSXkFu82lw2cG8=;
From: "Storage Icloud" <A@commeries.com>
Subject: bobbandino, Your iCloud  storage is full please update your subscriptionbobbandino, Your iCloud  storage is full please update your subscription
To: bobbandino@yahoo.com
List-Id: bobbandino@yahoo.com
X-Originating-IP: 107.174.244.119
Message-ID: <920240876_120386008_223504279@commeries.com>
Date: Tue, 25 Apr 2023 16:38:13 +0000
content-type:text/html; charset="utf-8"
Content-Disposition:inline
MIME-Version: 1.0
Content-Length: 1951

[BillyOrBob]

I suspect this is occurring due to spammers changing ISP's and rushing to set up their SMTP servers.  They are not setting things up completely.