I am seeing similar messages. Possiblly a similar situation to past Google
Calendar abuse, but now over facebook. Email forwarding compromises are not
uncommon, and a lot of recipients on a forwarded chain may explain it.
X-ImunifyEmail-Filter-Action: no action
X-ImunifyEmail-Filter-Version: 3.8.26/202607071011
Received: from mout-xforward.gmx.net ([82.165.159.12]:38737)
by dragon.fah-dc3-ds.com with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384
(Exim 4.99.4)
id 1whC4u-0000000E3Ww-3L8H
Tue, 07 Jul 2026 16:07:34 -0400
UI-Loop: V01:k+oj5qkfP98=:R2bJCysoTdIm3Jp6fSuJpIj0+U7PPzF73nY74SeeTNM=
Received: from 66-220-144-149.mail-mail.facebook.com ([66.220.144.149]) by
mx-ha.gmx.net (mxgmx009 [212.227.15.9]) with ESMTPS (Nemesis) id
1M29ed-1weioM0Eif-00A0e5; Tue, 07 Jul 2026 21:40:27 +0200
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=facebookmail.com;
s=s1024-2013-q3; t=1783453225;
bh=oh18E7dnFZikRBQfpxtcL5+BHa7V7X6t8Pk8VYeNilc=;
h=Date:To:Subject:From:MIME-Version:Content-Type;
b=hbN1n9gn9XFH8xDi0GGbF7lV6iRyjLSVqVww8jDiAbjlhbdh4DrxZ+96P9XkZb3do
aMnBVpbI+qaZJctZBdI5rPR8J5BdlXgVddEEaguX4HGdHXxhQrMS049kz3ZQ0omUqi
so6dQJzkV6rb9LGnYagP9Bj8CjP8pXKJCw9acWfs=
X-Facebook: from 2803:6084:1a4:a02:9155:da24:15bb:a00 ([MTI3LjAuMC4x])
bywww.facebook.com with HTTPS (ZuckMail);
Date: Tue, 7 Jul 2026 12:40:25 -0700
To:[email protected]
Subject: Aria Lee invited you to subscriptions Bill paid successfully
X-Priority: 3
X-Mailer: ZuckMail [version 1.00]
From: "Aria Lee"<[email protected]>
Reply-to: noreply<[email protected]>
Errors-To:[email protected]
X-Facebook-Notify: event_invite_off_fb;
mailid=HMTc4MzQ1MTk5MDM0OTQ5ODp4NjQlZ2x1Y3R5YmVpYmVyZ2JAZ214LmRlOjkyNw
List-Unsubscribe:<https://www.facebook.com/email/oneclick/unsubscribe?identifier=AfkbxIuBHr5Xrq4P_aJVlaD-hoiq32IBAlgEbYZK16dWZNP49MqCnKKV-ydFvZTgPW4IFPONAIiCL3IAQmp-bBGR2_cp5YfMfMP6FezcKdLjSf5t03SncFtfXthofjvtz8AHjjTCKGRuR5570KXlmtEZnBtyFsBgvXr-HQrmk_sAhGwMIgwK-obZoDfxn1y00GmoUxJ0LInExUMr1CyX1GOMKRsLvl7HBfQQQ7OH6l44fqqiHkOhlvf-AtMQUbHBNUca8g29wSwvXC17PLfQ8JiffNagoUUHWxosKBsGogKfMA-CWCyC2RGg2yqRaNWbTNnk8fGUIn9BhWNjlIPMBc-vRhDS0vDOD-V0t0xdR1eS21U>
List-Unsubscribe-Post: List-Unsubscribe=One-Click
X-FB-Internal-Notiftype: event_invite_off_fb
BIMI-Selector: v=BIMI1; s=fb2023q1v3;
Feedback-ID: event_invite_off_fb:Facebook
X-FB-Internal-MID:
Y0YMTc4MzQ1MTk5MDM0OTQ5ODp4NjQlZ2x1Y3R5YmVpYmVyZ2JAZ214LmRlOjkyNw
X-FACEBOOK-PRIORITY: 0
X-Auto-Response-Suppress: All
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="b1_723969c1db0dac0aae9681bc6fd68de7"
Message-ID:<[email protected]>
On 7/7/2026 4:11 PM, Michael Peddemors via mailop wrote:
Consider this.. the actor behind it.. They have to be abusing accounts
on One on One..
Are they forwarding to thousands of people? No advantage to them
unless they can do this at scale..
Normally there would be a trace header between facebook outbound IP,
eg One on One would be adding a trace header .. and we see a UI-Loop
header, which must have been added by One on One.. (GMX)
There is no header indicating that it was sent to an address that is
performing remote forwarding..
This originated from an abuse of Facebook notification system.. Let's
assume the To header is correct..
To: 1h26d%[email protected] <sic>
GMX 'should' be inserting some form of trace header on acceptance of
that email..
by mx-ha.gmx.net (mxgmx006 [212.227.15.9]) with ESMTPS
.. it is at that point, the abuse of GMX systems occur.. How does an
email destined for this single email address (if it was a list address
it would add additional headers) reach thousands of intended victims?
The only trace header(s) applied by GMX is when their SMTP accepts the
message, a UI-Loop header, and no other trace headers from internal
systems indicating this was sent out again..
Anyways, obvious spam relay vector that GMX should look into..
On 2026-07-07 12:27, Bill Cole via mailop wrote:
On 2026-07-07 at 12:47:40 UTC-0400 (Tue, 7 Jul 2026 09:47:40 -0700)
Michael Peddemors via mailop <[email protected]>
is rumored to have said:
Doesn't clearly show in the trace headers what is going on.. or how
this is relayed..
I concur with Benny. There's no mystery.
The mail is addressed in the From header to
1h26d%[email protected]. gmx.de=gmx.net=1&1=IONOS.
It looks like 1h26d%[email protected] is forwarding their mail to
whatever address this was aimed at, which is not extant in the
headers provided.
The Received headers show the only path for such mail.
Received: from mout-xforward.gmx.net (HELO mout-xforward.gmx.net)
(82.165.159.12)
id 90303a98-7a22-11f1-a75e-ab7e4ebd7c72; Tue, 07 Jul 2026
09:40:32 -0700
UI-Loop: V01:aeJf7xjF65U=:5wSFE5H9EdLAuv8m5XsAZTQc1vr/PT/4rvrCEq4Pqm8=
Received: from 69-171-232-134.mail-mail.facebook.com
([69.171.232.134]) by
mx-ha.gmx.net (mxgmx006 [212.227.15.9]) with ESMTPS (Nemesis) id
1MVuPH-1wX0Ll2lVt-00KciN; Tue, 07 Jul 2026 18:39:53 +0200
......
Received: from mout.gmx.net (HELO mout.gmx.net) (212.227.17.22)
id 2edcdc72-7a1f-11f1-9caf-f7abe4257846; Tue, 07 Jul 2026
09:16:19 -0700
UI-Loop: V01:urgVzG+2iEU=:xHZXqWNb4NkV8upa4cJvNR0DzCz2KBQpG5r55bBNs6k=
Received: from 69-171-232-140.mail-mail.facebook.com
([69.171.232.140]) by
mx-ha.gmx.net (mxgmx108 [212.227.17.5]) with ESMTPS (Nemesis) id
1N3qRs-1x7hk93x0C-00tqQv; Tue, 07 Jul 2026 18:14:10 +0200
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple;
d=facebookmail.com;
s=s1024-2013-q3; t=1783440848;
bh=NXHJmZPfhCxv7wDPUvkGh7vH1+s1zsLL/v+aSs97Kh0=;
h=Date:To:Subject:From:MIME-Version:Content-Type;
b=Hko/O5zCW/CSjYDi8+kvr4Zqsi2nz5WR0KEwFeUQA0ktWyKbvkXwKO+gLRxKCZy3k
x2VIunZinK5lIIwT2XG+sTXgnZQgzZF2ng72IRZdqA1lVroybb+XZkPygKu7Zk5I/7
6BsdI3bPcY52EsQi5zhcPGzzikzoTNVeAAEBNErY=
X-Facebook: from 2803:6081:a840:566a:a7e4:7cf8:14ba:a00
([MTI3LjAuMC4x])
by www.facebook.com with HTTPS (ZuckMail);
Date: Tue, 7 Jul 2026 09:14:08 -0700
To: 1h26d%[email protected]
Subject:
=?UTF-8?B?4Lib4Lit4LiHIOC4meC4tOC4pyDguYDguK3guKog4Lit4Liy4Lij?=
=?UTF-8?B?4LmMIGludml0ZWQgeW91IHQ=?=
=?UTF-8?B?byBTdWJzY3JpcHRpb24g?=
=?UTF-8?B?QmlsbGluZyDigJMgVmVyaWY=?=
=?UTF-8?B?eSBZb3VyIElkZW50aXR5?=
X-Priority: 3
X-Mailer: ZuckMail [version 1.00]
Return-Path: [email protected]
--
John Quaglieri
_______________________________________________
mailop mailing list
[email protected]
https://list.mailop.org/listinfo/mailop
