Solved How can I block this spam coming via Google?

Richard G · Monday at 7:02 AM

Lately our customers are getting a lot of spam. Problem is that we can not block it the normal way, as they are coming via Google.
We report every instance, but they keep coming, it looks like this:

Code:

eceived: from server.mycompany.nl
    by server.mycompany.nl with LMTP
    id oRgGHvZkt2lEAwsAugeUdg
    (envelope-from <[email protected]>)
    for <[email protected]>; Mon, 16 Mar 2026 03:03:34 +0100
Received: from mail-oa1-x45.google.com ([2001:4860:4864:20::45])
    by server.mycompany.nl with esmtps  (TLS1.3) tls TLS_AES_256_GCM_SHA384
    (Exim 4.99.1)
    (envelope-from <[email protected]>)
    id 1w1xIk-00000004JP9-0jUe
    for [email protected];
    Mon, 16 Mar 2026 03:03:34 +0100
Received: by mail-oa1-x45.google.com with SMTP id 586e51a60fabf-40ee506cf49so36469725fac.2
        for <[email protected]>; Sun, 15 Mar 2026 19:03:24 -0700 (PDT)
From: "Infinitizone Support" <[email protected]>
To: <[email protected]>

To me it seemed the best way to block was to block the sender, firebaseapp.com but that seems not to work for me or I'm doing something wrong.

In the /etc/virtual/blacklist_domains there firebaseapp.com is present.
In the /etc/virtual/blacklist_senders I did it like this (probably wrong) *@*.firebaseapp.com

So I guess I need to change the second one, because an asterisk is only to be used at the beginning/leading. And probably just firebaseapp.com won't work.

But I'm really not good with regular expressions and don't even understand the regex101.com tester how that works.
I could use ^@*.firebaseapp.com but doubt this is good.

Can anybody help me with this or put me in the right direction or maybe a better way to block these spam mails coming via Google without blocking Google?

Richard G · 2026-03-19T08:00:19-0600

I think we need another method. Seems that spammers found another spam method.
They send mail from some domain, then reroute it via Gmail to send it to our servers.

We got another example of this:

Code:

In this only our hostname is masked, the rest is as is.
As you can see it's send from Sh4y.de somehow via hosting4you.de and then we got it via Google.com.

Here's a second example. Now going through both outlook and gmail.

Code:

Received: from GVXPR05CU001.outbound.protection.outlook.com (mail-swedencentralazlp170130007.outbound.protection.outlook.com. [2a01:111:f403:c202::7])
        by mx.google.com with ESMTPS id d2e1a72fcca58-82a6b58cc00si5879683b3a.58.2026.03.18.09.02.20
        for <x>
        (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
        Wed, 18 Mar 2026 09:02:21 -0700 (PDT)
Received: by 2002:a05:6a00:90a3:b0:822:747d:3af9 with SMTP id
 d2e1a72fcca58-82a18a08cbals6356244b3a.2.-pod-prod-09-us; Wed, 18 Mar 2026
 09:02:29 -0700 (PDT)
Received: by 2002:a05:6a00:90a3:b0:822:747d:3af9 with SMTP id
 d2e1a72fcca58-82a18a08cbals6356283b3a.2.-pod-prod-09-us; Wed, 18 Mar 2026
 09:02:30 -0700 (PDT)
Received: from de2-emailsignatures-cloud.codetwo.com (20.79.222.204) by
 AMS0EPF00000198.mail.protection.outlook.com (10.167.16.244) with Microsoft
 SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id
 15.20.9723.19 via Frontend Transport; Wed, 18 Mar 2026 16:02:13 +0000
Received: from AMS0EPF00000198.eurprd05.prod.outlook.com
 (2603:10a6:20b:46e:cafe::ad) by AS9PR06CA0612.outlook.office365.com
 (2603:10a6:20b:46e::19) with Microsoft SMTP Server (version=TLS1_3,
 cipher=TLS_AES_256_GCM_SHA384) id 15.20.9700.27 via Frontend Transport; Wed,
 18 Mar 2026 16:01:50 +0000
Received: from AS9PR06CA0612.eurprd06.prod.outlook.com (2603:10a6:20b:46e::19)
 by PA2PR10MB8393.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:102:417::11) with
 Microsoft SMTP Server (version=TLS1_2,
 cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9723.19; Wed, 18 Mar
 2026 16:02:13 +0000
Received: by mail-pj1-x1045.google.com with SMTP id 98e67ed59e1d1-358f058973fsf181642a91.1
        for <x>; Wed, 18 Mar 2026 09:07:08 -0700 (PDT)
Received: from mail-pj1-x1045.google.com ([2607:f8b0:4864:20::1045])
    by server.ourserver.nl with esmtps  (TLS1.3) tls TLS_AES_256_GCM_SHA384
    (Exim 4.99.1)
    (envelope-from <[email protected]>)
    id 1w2tQL-00000005lwA-3djT
    for x;
    Wed, 18 Mar 2026 17:07:10 +0100
Received: from server.ourserver.nl
    by server.ourserver.nl with LMTP
    id 8WlrOq7Nummx9hEAugeUdg
    (envelope-from <[email protected]>)
    for <x>; Wed, 18 Mar 2026 17:07:10 +0100

We can't block google or outlook so how can we block this? I'm sure others will have or get spam probles like this too.

Maybe @zEitEr a good idea?
This is only an example, we get them from multiple places but on top of the header it's always google or outlook delivering it seems.

Richard G · 2026-03-19T08:08:57-0600

The above are header results from spamcop, this is an original header from the last message.
Seeing the email content (not displayed) it looks like a bounce message coming back and somehow to us while we are not originating.

Code:

Received: by 2002:a05:6000:1846:b0:439:c2a3:a2e9 with SMTP id
 ffacd0b85a97d-43a04b19a37ls3821076f8f.0.-pod-prod-06-eu; Wed, 18 Mar 2026
 09:01:09 -0700 (PDT)
Received: by mail-wm1-x347.google.com with SMTP id 5b1f17b1804b1-485375aa56esf778125e9.1
        for <[email protected]>; Wed, 18 Mar 2026 09:07:11 -0700 (PDT)
Received: by 2002:a05:6000:1a87:b0:432:dbd4:cac9 with SMTP id
 ffacd0b85a97d-43a04b815e7ls4220957f8f.1.-pod-prod-06-eu; Wed, 18 Mar 2026
 09:01:07 -0700 (PDT)
Received: from speed-hosting4you.de (Mail.Sh4y.de [83.136.82.37])
    by Mail.Sh4y.de (Postfix) with ESMTPSA id C61171240E61
    for <[email protected]>; Wed, 18 Mar 2026 17:01:06 +0100 (CET)
Received: from Mail.Sh4y.de (Mail.sh4y.de. [2001:4ba0:ffea:2c9:1::5])
        by mx.google.com with ESMTPS id ffacd0b85a97d-43b518a25aasi7586192f8f.196.2026.03.18.09.01.07
        for <[email protected]>
        (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
        Wed, 18 Mar 2026 09:01:07 -0700 (PDT)
Received: from mail-wm1-x347.google.com ([2a00:1450:4864:20::347])
    by server.ourserver.nl with esmtps  (TLS1.3) tls TLS_AES_256_GCM_SHA384
    (Exim 4.99.1)
    (envelope-from <[email protected]>)
    id 1w2tQO-00000005lzd-0TsK
    for [email protected];
    Wed, 18 Mar 2026 17:07:12 +0100
Received: from server.ourserver.nl
    by server.ourserver.nl with LMTP
    id 8Z9GFbDNummx9hEAugeUdg
    (envelope-from <[email protected]>)
    for <[email protected]>; Wed, 18 Mar 2026 17:07:12 +0100
Reply-To: "Support - Speed-Hosting4you" <[email protected]>
From: "'Support - Speed-Hosting4you' via cerple" <[email protected]>
To: <[email protected]>
Subject: RE: Ihre Anliegen auf SH4Y [2026031861781] Re: Scheibe einschlagen, Gurt schneiden, Familie
Date: Wed, 18 Mar 2026 17:01:06 +0100
Message-ID: <[email protected]>
MIME-Version: 1.0
Content-Type: multipart/alternative;
    boundary="----=_NextPart_000_003B_01DCB76B.B1728B90"
X-Mailer: PHPMailer 7.0.2 (https://github.com/PHPMailer/PHPMailer)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=1e100.net; s=20251104; t=1773850030; x=1774454830;
        h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post
         :x-spam-checked-in-group:list-id:mailing-list:precedence:reply-to
         :x-original-authentication-results:x-original-sender
         :content-transfer-encoding:mime-version:message-id:subject:from:to
         :date:x-beenthere:x-beenthere:x-gm-message-state:from:to:cc:subject
         :date:message-id:reply-to;
        bh=2RweR99JA6XwUGKwp3ODYkT60m+dvmSNMDFerfmt8HM=;
        b=T8zHoQyBed4kylPrFiuK+X1o4HmtR0QUaaOAKuAjFYlb8ctw/rMzzndLKyvd/gKFAH
         GVppwBj5BV6cZ124sauU/ZIC2Jj8kmyKR9e7prNhHjD/93hO5Vfsa7lU0EqXJ6SGJfAe
         hIG3v0WdRWW26PlJkGFt4PR9VgQqvvZTma+zy0Xjm34Yu1vJKTtcMpSNNAF76sC7IJ1Q
         WVxM3Q7FOsUlZFF+Y9GKLXN4dMyih95rgPfbroCrk5F4lMsAotwc0GPGtJauMLpthOLW
         7pdJOJQQSUrDdM5sxZFbimJ+plczL07BsES+V7W0/6/34lhIlTrNS4cl53vi+Q7vCl+a
         CZnA==
X-Forwarded-Encrypted: i=2; AJvYcCWbtcY6WQ0PNaKLtiVWvuWL+sijViV25XTwhhD0HcDP5tYvqTDWm3seXOrhuOsrEzd/[email protected]
X-Forwarded-Encrypted: i=2; AJvYcCVBXffKVk/VYRVlXoD5leuYN0Wz9PRcadaAlqDzyDTTGAUYXVRJm6vI32qAiOzYot/[email protected]
X-Gm-Message-State: AOJu0YxVDuVUcTMCiikIPAo+p3id7/6vzP0TUbxnArRyeqmQ1AO5CxDt
    J6Pe31fr8NoAHI7IGmmCggxRE90rGstx9Kwu1wjdezxF9b1t7ZwXIguNKnXonb4pW9I=
X-Received: by 2002:a5d:5848:0:b0:435:9cd5:bb2a with SMTP id ffacd0b85a97d-43b527af569mr6851891f8f.24.1773850026854;
        Wed, 18 Mar 2026 09:07:06 -0700 (PDT)
X-Received: by 2002:adf:f04e:0:b0:439:fcd5:c9bb with SMTP id ffacd0b85a97d-43b527c902fmr4681496f8f.34.1773849669354;
        Wed, 18 Mar 2026 09:01:09 -0700 (PDT)
X-Received: by 2002:a05:6000:25c4:b0:439:de1d:74c6 with SMTP id ffacd0b85a97d-43b527aa5f5mr7183018f8f.19.1773849667395;
        Wed, 18 Mar 2026 09:01:07 -0700 (PDT)
X-BeenThere: [email protected]; h="AV1CL+GH9GqVDuhDsdXhX13vFz+lgKTdSsEpsgYz9Ywwfw+mvg=="
X-BeenThere: [email protected]; h="AV1CL+GPsvlJnRnM4+BmQ/znz+X22w+KupLr97I07AucYY+PJA=="
Thread-Index: AQKdpump9gSsEGhMpvrAf9HpjVXWFg==
X-Original-Sender: [email protected]
X-Original-Authentication-Results: mx.google.com;       dkim=pass
 [email protected] header.s=default header.b=pz+y1DFf;       spf=pass
 (google.com: domain of [email protected] designates 2001:4ba0:ffea:2c9:1::5 as
 permitted sender) [email protected];       dmarc=pass
 (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=sh4y.de
X-Original-From: Support - Speed-Hosting4you <[email protected]>
X-Spam-Checked-In-Group: [email protected]
X-Google-Group-Id: 616710976686
List-Help: <https://support.google.com/a/capturesoul.com/bin/topic.py?topic=25838>, <mailto:[email protected]>
List-Subscribe: <https://groups.google.com/a/capturesoul.com/group/sdsdsdsdsdsdsdsdsdsdsdsdsdsdsd/subscribe>, <mailto:[email protected]>
List-Unsubscribe: <mailto:[email protected]>, <https://groups.google.com/a/capturesoul.com/group/de3/subscribe>
X-DKIM: signer='capturesoul.com' status='pass' reason=''

Or maybe @mxroute some idea to prevent this?

sysdev · 2026-03-19T09:15:18-0600

so, a mailbox on sh4y.de is hacked (because of the passed spf, dkim, etc), or there is a misconfigured google group at capturesoul.com that allows forwarding everything from everyone and your customer is subscribed to it. But the address and subject indicate a hacked ticket/support account.

I don't know what sh4y.de is (didn't look) but they might want to know their support email might be compromised.

Edit: Bunch of typos

johannes · 2026-03-19T09:25:59-0600

We had the same spam from capturesoul via google groups, just putted ..
/etc/virtual/blacklist_domains -> capturesoul.com
/etc/virtual/blacklist_senders -> *@capturesoul.com
and it finished.

Richard G · 2026-03-19T09:29:37-0600

sysdev said:
so, a mailbox on sh4y.de is hacked

I doubt it or it must be a lot of mailboxes, because we got 16 different of these messages today.
The one from sh4y.de is just an example.
As you could se we also got loads from firebaseapp.com until I blocked those and a spoofed other mail address, but almost every mail is coming form a different provider, so sh4y.de is just one of them.

One is even a reply... let me look it up.

RE: RE: Ihre Anliegen auf SH4Y [2026031861781] Re: Scheibe einschlagen, Gurt schneiden, Familie

Hello,

Our system flagged your email as spam, which caused your request to be closed automatically.

If you’re a legitimate customer and believe this was a mistake, simply reply with “NOTSPAM”, and we’ll reopen your request right away. We apologize for any inconvenience and appreciate your patience.

Thank you for understanding!

Best regards,
Casino Support TeamStill Need Help?
[Live Chat] [https://happyjokers.com/] | [FAQ] [https://happyjokers.com/faq]

Ticket ID: hd.1773838398428.z74l0w.f5c372e3

From hosting4you.de to the spammer.

So why are they ending up via Google at the domain of my customer or even via google and outlook at my customer?

@johannes I already did that too, but I blocked multiple domains this week already.
Also blocked that speed-hosting4you.de and sh4y.de but those are only 2. Customer is getting lots of different of these the past weeks.

Still don't understand why it can get through google and outlook. Even as reply to the spammer. Very odd.

So only solution is to find the non-Google and non-outlook in the headers and block those?

sysdev · 2026-03-19T09:58:13-0600

Well, it's not just you: https://www.spam.org/complaints?f=domain&i=firebaseapp.com

Richard G · 2026-03-19T11:03:15-0600

It's not only firebaseapp, but the most spam started coming them.

zEitEr · 2026-03-19T12:36:13-0600

sysdev said:
so, a mailbox on sh4y.de is hacked (because of the passed spf, dkim, etc), or there is a misconfigured google group at capturesoul.com that allows forwarding everything from everyone and your customer is subscribed to it. But the address and subject indicate a hacked ticket/support account.

The mail-headers that proves this idea are as the following:

Code:

List-Help: <https://support.google.com/a/capturesoul.com/bin/topic.py?topic=25838>, <mailto:[email protected]>

List-Subscribe: <https://groups.google.com/a/capturesoul.com/group/sdsdsdsdsdsdsdsdsdsdsdsdsdsdsd/subscribe>, <mailto:[email protected]>

List-Unsubscribe: <mailto:[email protected]>, <https://groups.google.com/a/capturesoul.com/group/de3/subscribe>

Richard G · 2026-03-19T17:01:34-0600

Oke so then it's just check which domains are non-google and non-microsoft and block these, because I don't only had the ones mentioned here but a lot more.

I presume those (hacked) accounts then make use of Gmail or Microsoft since the customer gets them from on of those and not directly from the spamming server. Would that be a correct assumption?

johannes · 2026-03-20T08:27:43-0600

Again same kind of spam, just other domain "teamkurofune.com" , again via google groups. I got one direct, and this one via my other emailadress. How they make it?

Return-Path: <[email protected]>
Delivered-To: [email protected]
Received: from host.myserver.xy
by strong.relation.at with LMTP
id OR53Hs8QvWnzMRgAMjAz1w
(envelope-from <[email protected]>)
for <[email protected]>; Fri, 20 Mar 2026 10:18:07 +0100
Return-path: <[email protected]>
Envelope-to: [email protected]
Delivery-date: Fri, 20 Mar 2026 10:18:07 +0100
Received: from mail-qk1-f197.google.com ([209.85.222.197])
by host.myserver.xy with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.99.1)
(envelope-from <[email protected]>)
id 1w3Vzb-00000006mhI-0bzo
for [email protected];
Fri, 20 Mar 2026 10:18:07 +0100
Received: by mail-qk1-f197.google.com with SMTP id af79cd13be357-8cfc5df1dccsf328615685a.1
for <[email protected]>; Fri, 20 Mar 2026 02:18:07 -0700 (PDT)
ARC-Seal: i=2; a=rsa-sha256; t=1773998286; cv=pass;
d=google.com; s=arc-20240605;
b=VpF4QS5V5OhZsH6FQe4/+m8KY/25IFVFlLKwsUhRmSJnNdUbtH0vBrM1WHktBq4wmo
verYZ4GTm2uBtPuctt5G9jrEd7WCQz0Z9MPCw7wJcUN58rr/kp46PK436KRA/LjeBgpu
sJ+y1sEiLOEsKSmocFaGvFevNDy9bVYtWCVc+VMIbjkehOqLtZUAuhX5dFhmzBW+VWFJ
vA6zEPKPIErE0FmQdg9xqIGnvB/Io7xRTdgGjxHW5IlrxGV7XujMdh+U6iDujaCmuoId
JgDLUmnD8laX9E5O7i8zbOwq1Cn7zKpZ41BlnhUusBvuQtslvaUKLlpjW/PedOgGkOJ3
OKNQ==
ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;
h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post
:list-id:mailing-list

recedence:auto-submitted:sent-on
:content-transfer-encoding:subject:references:in-reply-to:message-id
:to:reply-to:from:date:mime-version:dkim-signature;
bh=6R36ZrBpUsQiKO8GVKC8b/jCa7ZxiAcln7EX/uCmWKo=;
fh=SR7dS1Y/Yy5R+6MzsAR2hzNPL2lfkRmUVgMYg8lR4vc=;
b=CvCDQGc59DnTZEIk6YMIJPqUGUtJDeVIfq1cOHAk0YzGIH4bLZZ+djErkU8JyJt/YP
eZ2RZMMhrgGtiSzQo6Ccm9mmhaCNoktNxfds2+sTuYymyCuO9i2M7PczyYVKOE0AzQRp
wQK8eiLCjYxWIKJbVN1NfQ050eZnZV5sskU/NGL4AuXew3LFzJWryfI1mNpq1vcNqoaX
1MKh2cw5iH3q61ofMzfGAa0/y1LxHLIyLvrstxsYZ4bFPrfkkrJA9aWcjrqJMJvRi4ne
sTYIYjOGpLwa3bGi+pHxWmi9WijOZV4MMtTv8fjrT/pBJTlSz2Cua3vqoJzuOdBKFHXb
znaw==;
darn=myotherdomain.xy
ARC-Authentication-Results: i=2; mx.google.com;
dkim=pass [email protected] header.s=yfnfq header.b=p7yvqZfk;
spf=pass (google.com: domain of bounces+us.1.31108.62380-support=[email protected] designates 44.192.35.148 as permitted sender) smtp.mailfrom="bounces+us.1.31108.62380-support=[email protected]";
dmarc=pass (p=QUARANTINE sp=NONE dis=NONE) header.from=kilohearts.com
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=teamkurofune.com; s=google; t=1773998286; x=1774603086; darn=myotherdomain.xy;
h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post
:list-id:mailing-list

recedence:x-original-authentication-results
:x-original-sender:auto-submitted:sent-on:content-transfer-encoding
:subject:references:in-reply-to:message-id:to:reply-to:from:date
:mime-version:from:to:cc:subject:date:message-id:reply-to;
bh=6R36ZrBpUsQiKO8GVKC8b/jCa7ZxiAcln7EX/uCmWKo=;
b=fUmZ6kRAxcRhH+ph3cbweCJllo1U8PvAlSC5ESySkRScOF5e9TYAFPlnBzbF11kL4k
LdwkRnjKxLsUTkw/yKihxMRuQl9Dy5Mb5Hklcp6FpsYvjen+QUv+G3k68iKzkf4WlFa6
edPIv9yzNGoIiIiB8CWm9MOaYDGAJxhYxlnI0=
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20251104; t=1773998286; x=1774603086;
h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post
:x-spam-checked-in-group:list-id:mailing-list

recedence
:x-original-authentication-results:x-original-sender:auto-submitted
:sent-on:content-transfer-encoding:subject:references:in-reply-to
:message-id:to:reply-to:from:date:mime-version:x-beenthere
:x-beenthere:x-gm-message-state:from:to:cc:subject:date:message-id
:reply-to;
bh=6R36ZrBpUsQiKO8GVKC8b/jCa7ZxiAcln7EX/uCmWKo=;
b=BVTa7FyAOsWLm50KLK3UaOde3oDs4lMRjIQYTl3Hg3OmWNUVb31zorZAyNtYrzey1U
YgLUd2ilDj51FBqZHdxmLSp85hdiQ1KHFJ4H9bs8mgXZB0QZBhPW6T8p0PIlS9JrlVX/
dvfDzM32tsZx0hWKJyW4zwxbJ/CBORb4ML28mq/elcxDW2nMdCxCjzbeoJN3S+rGwU/A
TYQcKMqqB78K+UKYKxkCujHg8f07QhSrCBCSQ3JaP9CvBvQa1YrP5bXNONJ9kp2Fs8Z4
u3yQ+CJpRwzlusEaouq1oV661wtex8A6sJfCd7P4ExhCIbC3BooVOsCMuGPIaBN0iraS
Q1Dw==
X-Forwarded-Encrypted: i=2; AJvYcCUAhH5oInfCR5ujB2lLFpnjQEdhiF5LHztxGlnFkXgYeCQRAXw3fZ2PSCuNfrQDtXKpJoLLJg==@myotherdomain.xy
X-Gm-Message-State: AOJu0YxTEbYDVg7iyZhNt+84vdLddx6200q7nDeRgS75f6Je2pqyXTOp
CC8zzKWxhAzdMdvFHCvNSTLBk24l0J0vxHNekxVPV2bVUikSGbBTqD4C2QegccFhzv0=
X-Received: by 2002:a05:620a:468f:b0:883:c768:200a with SMTP id af79cd13be357-8cfc7ee9ca1mr327712485a.32.1773998285643;
Fri, 20 Mar 2026 02:18:05 -0700 (PDT)
X-BeenThere: [email protected]; h="AV1CL+EssVKiFnvTSKUjpbHkVsp67yq4qPDoWbAIYtNlK84JRQ=="
Received: by 2002:a05:6214:1c0c:b0:89a:12a0:7ebc with SMTP id
6a1803df08f44-89c78053d6bls29185936d6.0.-pod-prod-05-us; Fri, 20 Mar 2026
02:13:52 -0700 (PDT)
X-Forwarded-Encrypted: i=2; AJvYcCX6obZgylsXW9DlS+OIxdvaf0KQmAFPVVfzXHQ8ofJuhONVi9q01I3rrS+QEwJpnSzJDA==@teamkurofune.com
X-Received: by 2002:a05:6214:20e9:b0:89a:621e:42bc with SMTP id 6a1803df08f44-89c85a99ad7mr32495746d6.59.1773998032344;
Fri, 20 Mar 2026 02:13:52 -0700 (PDT)
X-BeenThere: [email protected]; h="AV1CL+F/tWZWs3rVt+BLxNfhV8NfzMm3BzakK3DrxR0yVrgXHw=="
Received: by 2002:a05:6214:230b:b0:88f:ca81:d5ee with SMTP id
6a1803df08f44-89c781eba2els32359926d6.2.-pod-prod-05-us; Fri, 20 Mar 2026
02:13:51 -0700 (PDT)
X-Received: by 2002:a05:6214:4603:b0:89c:5963:b2ef with SMTP id 6a1803df08f44-89c85aa5b8bmr31824026d6.63.1773998031457;
Fri, 20 Mar 2026 02:13:51 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; t=1773998031; cv=none;
d=google.com; s=arc-20240605;
b=HlxAdlzWEnl/f51jJP2DvWnPY8B9OoVTIaM9HLXu0WnRQ/sRUbzhT0GCNn5NkrUWjO
fIYnxttENhkL6il5RqLM259DR6TGx1qIYh6YmzrywTksNUwaIvYQdkfHh1IHCd1kliLD
Iw6+icj8imjcZyU8Ft66MxR8hsI20E9QYgFdC0AxFFMCMFyBIW/viDlAU47jmOFRlxVi
gGNUrdb8NpwHspZ84iZ+xwlaVMBFMUq2vIGhWYiyM4vAgrs6pu1K835QOl830oauBoWa
7qaENrIUSOeX99cx2LN3mEX8OcXM5OR9mK9JONPCIPRR1feeyudZ1mdnMSbj6i+/gLUR
fTPQ==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;
h=auto-submitted:sent-on:content-transfer-encoding:subject:references
:in-reply-to:message-id:to:reply-to:from:date:mime-version
:dkim-signature;
bh=6R36ZrBpUsQiKO8GVKC8b/jCa7ZxiAcln7EX/uCmWKo=;
fh=fcPagJ9zjamyzgO2Bm+7uwDkCGapooNJcUNCl8sGOuY=;
b=IH85TWcUaoO7qXPPbIUP6HsZWQK2OT95kksP5Fv9vxOTfNsfuJNQxegJnFHMqNP7Lx
UibGGqq1NeMDZ8qfCZUhEXDPmyU3D/K+qLEchI1e4E+kgS5oV58KBYazVn8lTqF/G4hn
ncYxsFerDio3qIhQwPovVGZbqr0yFdZYUXR3vHvxL0gk+ViFtbDGxjlr63UjvW1/yAFz
iUFPtet20KYKM2/yYagpFqpkOtY/7sgcKhFWB6HVCAyvcQ2P+9XoBG8APkok1J7Qmnic
+USZj0OoeF1Ly48Rb+lYMBsbynChuYzqTbYP9em6M4Oz4kzJxeehUg6EUCFwyMGFRi3w
sbeA==;
dara=google.com
ARC-Authentication-Results: i=1; mx.google.com;
dkim=pass [email protected] header.s=yfnfq header.b=p7yvqZfk;
spf=pass (google.com: domain of bounces+us.1.31108.62380-support=[email protected] designates 44.192.35.148 as permitted sender) smtp.mailfrom="bounces+us.1.31108.62380-support=[email protected]";
dmarc=pass (p=QUARANTINE sp=NONE dis=NONE) header.from=kilohearts.com
Received: from mail-usn149.freshemail.io (mail-usn149.freshemail.io. [44.192.35.148])
by mx.google.com with ESMTPS id 6a1803df08f44-89c85347fd6si26427846d6.432.2026.03.20.02.13.51
for <[email protected]>
(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
Fri, 20 Mar 2026 02:13:51 -0700 (PDT)
Received-SPF: pass (google.com: domain of bounces+us.1.31108.62380-support=[email protected] designates 44.192.35.148 as permitted sender) client-ip=44.192.35.148;
MIME-Version: 1.0
X-Received: from ip-172-16-112-26.ec2.internal (EHLO freshdesk.com) ([172.16.112.26])
by smtpout.freshdesk.com (Freshworks SMTP Server) with ESMTPA ID 8ac81c70.
for <[email protected]>;
Fri, 20 Mar 2026 09:13:50 +0000 (UTC)
Date: Fri, 20 Mar 2026 09:13:50 +0000
From: "'Kilohearts Support' via 88s9deedes" <[email protected]>
Reply-To: Kilohearts Support <[email protected]>
To: [email protected]
Message-ID: <69bd0fce47dd_2061f5539ed061765ad.sidekiq-realtime-fd-poduseast1-main1-blue-6d45945c7c-44c7t@automation.freshdesk.com>
In-Reply-To: <712a39c5-8dd7-43c6-91e3-6dee762df69c.9ub24c.a6887297@tickets.helpdesk.com>
References: <712a39c5-8dd7-43c6-91e3-6dee762df69c.9ub24c.a6887297@tickets.helpdesk.com>
Subject: Thanks for your message!
Content-Type: multipart/alternative;
boundary="--==_mimepart_69bd0fce9d78_2061f5539ed061766ef";
charset=UTF-8
Content-Transfer-Encoding: 7bit
sent-on: 2026-03-20 10:13:50 +0100
Auto-Submitted: auto-generated
X-Auto-Response-Suppress: DR, RN, OOF, AutoReply
X-FUP-PRIORITY: 5
X-SDS-INFO: 2fBDEBlg42thRA5TO_24xdRBF00XN-x37QoQ-5w-c0xrONGag7YeNi2_hNwzqoNulHzohmn3BPo0cBU7z0VYhlRgh1G2GCgvytV9H3kYILaCqnCg9ij23DzyrNhZjLL9c425WUiZ-XJmLkP85LoY4WWe0ti6N_XOssrK8EyAU-TqpsXE26AdGp9Qs-U3UG65
X-MESSAGEID: YhLs2e3O18xWofC4tTW27zZzIWuz7nleq8PHNAWrjpjIJhCImQSoyzG5jqPyD7/zW2wCtCa+TkRaZZtMyV+500t0ZOI9qMSQCM9DOXqtq3NMq2hkcFX1cs7V2GYP/dPiqxC8+V1FDeuKsCTui+L8a1cscUn8PkLXLn72Vss41mg=
X-Original-Sender: [email protected]
X-Original-Authentication-Results: mx.google.com; dkim=pass
[email protected] header.s=yfnfq header.b=p7yvqZfk; spf=pass
(google.com: domain of bounces+us.1.31108.62380-support=[email protected]
designates 44.192.35.148 as permitted sender) smtp.mailfrom="bounces+us.1.31108.62380-support=[email protected]";
dmarc=pass (p=QUARANTINE sp=NONE dis=NONE) header.from=kilohearts.com
X-Original-From: Kilohearts Support <[email protected]>
Precedence: list
Mailing-list: list [email protected]; contact [email protected]
List-ID: <7t.teamkurofune.com>
X-Spam-Checked-In-Group: [email protected]
X-Google-Group-Id: 617709198575
List-Post: <https://groups.google.com/a/teamkurofune.com/group/7t/post>, <mailto:[email protected]>
List-Help: <https://support.google.com/a/teamkurofune.com/bin/topic.py?topic=25838>,
<mailto:[email protected]>
List-Archive: <https://groups.google.com/a/teamkurofune.com/group/7t/>
List-Subscribe: <https://groups.google.com/a/teamkurofune.com/group/infgfgfg9964fgtttggg/subscribe>,
<mailto:[email protected]>
List-Unsubscribe: <mailto:[email protected]>,
<https://groups.google.com/a/teamkurofune.com/group/7t/subscribe>
Forward-Confirmed-ReverseDNS: Reverse and forward lookup success on 209.85.222.197, -10 Spam score
X-DKIM: signer='teamkurofune.com' status='pass' reason=''
DKIMCheck: Server passes DKIM test, -20 Spam score
X-Spam-Bar: ++++
SpamTally: Final spam score: 19
X-Antivirus-Scanner: Clean mail though you should still use an Antivirus

Richard G · 2026-03-20T11:21:49-0600

johannes said:
How they make it?

Yes exactly that is what I was wondering about too, hence my question how that is possible.

The only thing I can think of is that the abused address is making use of external mailserver from Google and/or has forwards to Google groups or MS mail addresses.

johannes · 2026-03-20T12:24:08-0600

now i started to get the firebase app spams

Richard G · 2026-03-20T12:41:36-0600

But those are easy to block. I think it's whitespread and a lot of us will soon encounter these.

Solved How can I block this spam coming via Google?

Richard G

Verified User

Richard G

Verified User

Richard G

Verified User

sysdev

Verified User

johannes

Verified User

Richard G

Verified User

sysdev

Verified User

Richard G

Verified User

zEitEr

Super Moderator

Richard G

Verified User

johannes

Verified User

Richard G

Verified User

johannes

Verified User

Richard G

Verified User