Consider this.. the actor behind it.. They have to be abusing accounts
on One on One..
Are they forwarding to thousands of people? No advantage to them unless
they can do this at scale..
Normally there would be a trace header between facebook outbound IP, eg
One on One would be adding a trace header .. and we see a UI-Loop
header, which must have been added by One on One.. (GMX)
There is no header indicating that it was sent to an address that is
performing remote forwarding..
This originated from an abuse of Facebook notification system.. Let's
assume the To header is correct..
To: 1h26d%[email protected] <sic>
GMX 'should' be inserting some form of trace header on acceptance of
that email..
by mx-ha.gmx.net (mxgmx006 [212.227.15.9]) with ESMTPS
.. it is at that point, the abuse of GMX systems occur.. How does an
email destined for this single email address (if it was a list address
it would add additional headers) reach thousands of intended victims?
The only trace header(s) applied by GMX is when their SMTP accepts the
message, a UI-Loop header, and no other trace headers from internal
systems indicating this was sent out again..
Anyways, obvious spam relay vector that GMX should look into..
On 2026-07-07 12:27, Bill Cole via mailop wrote:
On 2026-07-07 at 12:47:40 UTC-0400 (Tue, 7 Jul 2026 09:47:40 -0700)
Michael Peddemors via mailop <[email protected]>
is rumored to have said:
Doesn't clearly show in the trace headers what is going on.. or how
this is relayed..
I concur with Benny. There's no mystery.
The mail is addressed in the From header to 1h26d%[email protected].
gmx.de=gmx.net=1&1=IONOS.
It looks like 1h26d%[email protected] is forwarding their mail to
whatever address this was aimed at, which is not extant in the headers
provided.
The Received headers show the only path for such mail.
Received: from mout-xforward.gmx.net (HELO mout-xforward.gmx.net)
(82.165.159.12)
id 90303a98-7a22-11f1-a75e-ab7e4ebd7c72; Tue, 07 Jul 2026 09:40:32
-0700
UI-Loop: V01:aeJf7xjF65U=:5wSFE5H9EdLAuv8m5XsAZTQc1vr/PT/4rvrCEq4Pqm8=
Received: from 69-171-232-134.mail-mail.facebook.com
([69.171.232.134]) by
mx-ha.gmx.net (mxgmx006 [212.227.15.9]) with ESMTPS (Nemesis) id
1MVuPH-1wX0Ll2lVt-00KciN; Tue, 07 Jul 2026 18:39:53 +0200
......
Received: from mout.gmx.net (HELO mout.gmx.net) (212.227.17.22)
id 2edcdc72-7a1f-11f1-9caf-f7abe4257846; Tue, 07 Jul 2026 09:16:19
-0700
UI-Loop: V01:urgVzG+2iEU=:xHZXqWNb4NkV8upa4cJvNR0DzCz2KBQpG5r55bBNs6k=
Received: from 69-171-232-140.mail-mail.facebook.com
([69.171.232.140]) by
mx-ha.gmx.net (mxgmx108 [212.227.17.5]) with ESMTPS (Nemesis) id
1N3qRs-1x7hk93x0C-00tqQv; Tue, 07 Jul 2026 18:14:10 +0200
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=facebookmail.com;
s=s1024-2013-q3; t=1783440848;
bh=NXHJmZPfhCxv7wDPUvkGh7vH1+s1zsLL/v+aSs97Kh0=;
h=Date:To:Subject:From:MIME-Version:Content-Type;
b=Hko/O5zCW/CSjYDi8+kvr4Zqsi2nz5WR0KEwFeUQA0ktWyKbvkXwKO+gLRxKCZy3k
x2VIunZinK5lIIwT2XG+sTXgnZQgzZF2ng72IRZdqA1lVroybb+XZkPygKu7Zk5I/7
6BsdI3bPcY52EsQi5zhcPGzzikzoTNVeAAEBNErY=
X-Facebook: from 2803:6081:a840:566a:a7e4:7cf8:14ba:a00 ([MTI3LjAuMC4x])
by www.facebook.com with HTTPS (ZuckMail);
Date: Tue, 7 Jul 2026 09:14:08 -0700
To: 1h26d%[email protected]
Subject: =?UTF-8?B?4Lib4Lit4LiHIOC4meC4tOC4pyDguYDguK3guKog4Lit4Liy4Lij?=
=?UTF-8?B?4LmMIGludml0ZWQgeW91IHQ=?=
=?UTF-8?B?byBTdWJzY3JpcHRpb24g?=
=?UTF-8?B?QmlsbGluZyDigJMgVmVyaWY=?=
=?UTF-8?B?eSBZb3VyIElkZW50aXR5?=
X-Priority: 3
X-Mailer: ZuckMail [version 1.00]
Return-Path: [email protected]
--
"Catch the Magic of Linux..."
------------------------------------------------------------------------
Michael Peddemors, President/CEO LinuxMagic Inc.
Visit us at http://www.linuxmagic.com @linuxmagic
A Wizard IT Company - For More Info http://www.wizard.ca
"LinuxMagic" a Registered TradeMark of Wizard Tower TechnoServices Ltd.
------------------------------------------------------------------------
604-682-0300 Beautiful British Columbia, Canada
_______________________________________________
mailop mailing list
[email protected]
https://list.mailop.org/listinfo/mailop
