S3 used for spam abuse.

A spam campaign that is getting past gmail spam filters. The content is using links at S3 buckets. Amazon needs to disable the accounts that own these bogus buckets. Here is a small sample:

• https://s3.amazonaws.com/frgrrffgfd/31861.html#qs=r-ahbffakhefkfjjdafgebhifakkjigbdafejefabababagjadfjaccacjgkadgkfacfedhcacb
• https://s3.amazonaws.com/homrkezrk44gfg/homrkezrk44gfg.html#qs=r-ahbffakhefkfjjdaffihhdhakkikkhjaefjbkabababagiacijaccacbfdadebdacfcfbiacb
• https://s3.amazonaws.com/z2q4g8n9t3f6k2z9w7d6j7j4g/o0a2d0w8.html#qs=r-ahbffakhefkfjjdaffhdcgkakkiedjgafbkbcafbkbcafbkbcabaijadhaccadbjcadfgcacdifdcacb
• https://s3.amazonaws.com/rsfdgvfdgvfdgv/tgbdfbdfb00.html#qs=r-ahbffakhefkfjjdafgebhieakkifcgjadkdckabababagjacikaccacjgkadfjdacccbdbacb
• https://s3.amazonaws.com/addttt2t11tttt2/addttt2t11tttt2.html#qs=r-ahbffakhefkfjjdafgedfdjakkgkcjfaefjbkabababagiacijaccacbfdadebdacfcfbiacb
• https://s3.amazonaws.com/frdeeffgvf/31861.html#qs=r-ahbffakhefkfjjdaffdeikfakkgcedhafejefabababagjadfjaccacjgkadgkfaccgbhiacb
• https://s3.amazonaws.com/vcxvjhuazyehgzeezz/vcxvjhuazyehgzeezz.html#qs=r-ahbffakhefkfjjdaffihgkdakkgbcfgafbkbcabababagiadhaccacccfadbceaccgbjeacb

Below is sample source of the spam that's getting through. Delivered-To: REDACTED@gmail.com Received: by 2002:a05:7011:c97:b0:305:971a:b2c0 with SMTP id ih23csp268516mdb; Tue, 13 Sep 2022 20:26:26 -0700 (PDT) X-Google-Smtp-Source: AA6agR6MFSkzF2HjUKhQX5se4yp5mdpkMmA4VEJijsBD0oOKf12DhFnS6CBPDQSfVirWB34gTuB2 X-Received: by 2002:a05:6000:108f:b0:228:c680:47e4 with SMTP id y15-20020a056000108f00b00228c68047e4mr20963449wrw.593.1663125986706; Tue, 13 Sep 2022 20:26:26 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1663125986; cv=none; d=google.com; s=arc-20160816; b=InMrEWd9/JJU9551H6GAX3tSo+fQRK0WVCCwvBAK2EXqrFDxQ5Dd0zioLBHr8LhfWh Rm8zbhpdbx8Kcbp782Z2/iSfsEtW1BZ/uog6TEiwvZ9tRL+K7utNt7yZQDpSYfIqMYXK lmHnnwDS+l0rvJfxPqX7Nr3spTd4jhXhRJHgBho+n0etbCETsNU5Rp07PRrqYqMzU0+8 3AHs29LksvMJwtiq3+nBEKUdd68ZGcQnBuHoVuHnbLeVGyZHlyqE5HguGevbFLIwF5U+ oSdZXKSLRQkvJN1f3dUBqq7eoulQnSFn8k64LsBJCdFg8k/P/kkxcZWUn3bYWEMbDsfN OkUA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=subject:feedback-id:date:mime-version:list-id:to:cc:references :message-id:from:in-reply-to; bh=NdwAoHGiQToRKvvWOasTT8rKiHvKIlaqjAOiwLG2E40=; b=Se4t3spJ0Ak1wmwnb/B8qxu+MvfLFighsx1C0V86Cde/kz4RJY1LX7Vz8jCTuxKyqx pZ++dVB9P1m5YJ4mKqpVqcSi/0R6Y65Ql3z75XGa0DMiE5VwADaYJ/iiwEU/POVDopcT DBWE6CtQ3VSS/ELwd6Aq2iu/QJpODJkk5BODk1l+doNhHfJWQubnyb1fDtDHJgSH/rKx pYI4V2pOJOwgOIlJmkp/Jf8ri+IHpyub5oJnve/Tho42Oh7oxJZG1R+IR/xRZ8Z7mjus wKXu+5XZ4B2A4xUsNATrOZvPN+017IfaMF8S46jPnpstUsnHK6mgLFA8EMYqtI9lw98M TUTw== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of messages.rjo@flfkpdyhlltp.expoplatforme.com designates 193.111.125.64 as permitted sender) smtp.mailfrom=messages.rjO@flfkpdyhlltp.expoplatforme.com Return-Path: messages.rjO@flfkpdyhlltp.expoplatforme.com Received: from statement-mail-xvcs.expoplatforme.com (statement-mail-xvcs.expoplatforme.com. [193.111.125.64]) by mx.google.com with ESMTP id r14-20020adfce8e000000b002284a6bf834si7255421wrn.649.2022.09.13.20.26.25 for REDACTED@gmail.com; Tue, 13 Sep 2022 20:26:26 -0700 (PDT) Received-SPF: pass (google.com: domain of messages.rjo@flfkpdyhlltp.expoplatforme.com designates 193.111.125.64 as permitted sender) client-ip=193.111.125.64; Authentication-Results: mx.google.com; spf=pass (google.com: domain of messages.rjo@flfkpdyhlltp.expoplatforme.com designates 193.111.125.64 as permitted sender) smtp.mailfrom=messages.rjO@flfkpdyhlltp.expoplatforme.com Received: from 10.217.130.145 (EHLO losangelessleo.com) (172.245.221.154) by mta4365.mail.ne1.yahoo.com with SMTP; Sat, 11 Apr 2020 19:09:47 +0000 Received: from VE1EUR03FT011.eop-EUR03.prod.protection.outlook.com (2603:10a6:20b:484:cafe::1a) by AS9PR06CA0761.outlook.office365.com (2603:10a6:20b:484::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5438.15 via Frontend Transport; Sat, 16 Jul 2022 10:02:41 +0000 Received: from app19.muc.ec-messenger.com (app19.muc.ec-messenger.com ) (envelope-from <g-3851351679-7322-354668012-1559235622088@bounce.news.mapp.com (g-3851351679-7322-354668012-1559235622088@bounce.news.mapp.com)>) by gp13mtaq123 (mtaq-receiver/2.20190311.1) with ESMTP id yA3jJ-_S5g8Z for maizeseven@comcast.net; Thu, 30 May 2019 19:00:22 +0200 Received: from www.takataka.gr (realshop.gr ) by uat.atnet.gr (Postfix) with ESMTPA id 24BF957C2E58 for daily.fast@aol.com; Wed, 29 May 2019 20:27:11 +0300 (EEST) Received: from rvirapvdc00.net.ravensburger.ag () by mx01.ravensburger.ag (SMTP DAEMON FROM RAVENSBURGER AG) with SMTP ID 555; Mon, 15 Jan 2018 03:52:48 +0100 (CET) In-Reply-To: CADT5qSj0REQQpwKiW6P5cL27kFYMN9CK1r89qGQ3q5sFm46NH1Cu5OuqVwXww@jpk.gsdukfpf.org Content-Type: multipart/digest; boundary="----=_Part_gpFORTCVfwd_0701552677577.EEC6JKWUPUK" From: """""Car lnsurance""""" info_1r89qGQ3q5sF@news.jdpsefdvtuy.com Message-ID: ZF3lf1bGTw-Ct-Y9ADdP1r89qGQ3q5sFHg-193.111.125.64@cnaui.dcccd.edu References: 5099124348.0061952.3510102649736.JavaMail.app@mail-news.jdpsefdvtuy.com.io CC:WilliamqH@aol.com To: WilliamFH@aol.com List-ID: <.7289367.xt.local> MIME-Version: 2.0 Date: Wed, 14 Sep 2022 05:24:13 CEST Feedback-ID: 325-anexp#nret-fa:account-notifier Subject: ConfirmationReceipt 182

------=Part_gpFORTCVfwd_0701552677577.EEC6JKWUPUK Content-Type: multipart/parallel; boundary="-------CpK514606xYd-9865656565CpK514606xYd=_:"

---------CpK514606xYd-9865656565CpK514606xYd=: Content-Type: multipart/alternative; boundary="_----------=bollinCpK514606xYd"

--_----------=bollinCpK514606xYd Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: Hexa

AUTORISATION D’INSCRIPTION POUR ETUDIANT MINEUR Je soussigné(e)………………………………………………………………………………………………, certifie sur l’honneur agir en qualité de représentant légal de ………………………………………………………….…………., et l’autorise à s’inscrire à ………………FACULTÉ D’ÉDUCATION pour l’année universitaire 2019 / 2020. A…………..………..…………, le…… / …… / ……

Signature(s)* :

• en cas de séparation des parents et d’autorité parentale exercée conjointement, la signature des deux représentants légaux est obligatoire. Your subscription to our list has been confirmed.

--_----------=1r89qGQ3q5sF----=_Part_gpFORTCVfwd_0701552677577.EEC6JKWUPUK Content-Type: text/html; charset=utf-8

<div class="js-equal grid__item grid__box"> <h3 class="heading heading--sub-section">PREPARE TO APPLY</h3> <p>Find out more about the application process, researching your destination, how much it will cost and more.</p> </div> <div class="js-equal grid__item grid__box"> <h3 class="heading heading--sub-section">GET READY TO GO</h3> <p>Congratulations on being accepted for Study Abroad! Now it's time to plan the details, like where you'll stay, organising your visa and applying for your student loan.</p> </div> <div class="js-equal grid__item grid__box"> <h3 class="heading heading--sub-section">DURING YOUR STUDY ABROAD YEAR</h3> <p>Once you know you'll be studying abroad, you'll need to arrange accommodation, insurance, visas, proof of your finances and maybe some foreign language studies. </p> </div> <div class="js-equal grid__item grid__box"> <h3 class="heading heading--sub-section">SUMMER SCHOOLS</h3> <p>Short programmes, usually through summer schools, are a great chance to experience study and life in another country.</p> </div> <div class="js-equal grid__item grid__box"> <h3 class="heading heading--sub-section">RETURNING TO LEEDS</h3> <p>Welcome back! Here's some useful information to help you settle back into life in Leeds.</p> </div> <div class="js-equal grid__item grid__box"> <h3 class="heading heading--sub-section">STUDY ABROAD HANDBOOKS AND DOCUMENTS</h3> <p>Handbooks, checklists, forms and information you will need before and during your study abroad.</p> </div> <div class="js-equal grid__item grid__box"> <h3 class="heading heading--sub-section">GRADUATE STUDY ABROAD OPPORTUNITIES</h3> <p>If you're a Postgraduate researcher, there may be opportunities to study abroad during your time here.</p> </div>

--_----------=bollinCpK514606xYd Content-Type: text/html; charset=utf-8

<CeNteR> <a href="https://s3.us-west-1.wasabisys.com/kwahvzrdxtmmprbpeft/LINK.html#qs=r-ahbffakhefkfjjdafgchjidakkfiihjafckjhabababahdadfjaccadfbgackigacbkgfdacb"><h2>As Low As $38/mo for Auto Insurance – Don’t Miss Out!</h2></a><br><br> <imG SRc="https://s3.us-west-1.wasabisys.com/kwahvzrdxtmmprbpeft/IMG2.jpg" USEmAP="#"> <mAP naME=""> <ARea hREf="https://s3.us-west-1.wasabisys.com/kwahvzrdxtmmprbpeft/LINK.html#qs=r-ahbffakhefkfjjdafgchjidakkfiihjafckjhabababahdadfjaccadfbgackigacbkgfdacb" COords="5,3,942,1031" shAPe="reCT"> <aREa hRef="https://s3.us-west-1.wasabisys.com/kwahvzrdxtmmprbpeft/LINK.html#qs=ua-ahbffakhefkfjjdafgchjidakkfiihjafckjhabababahdadfjaccadfbgackigacbkgfdacb" COords="127,1075,862,1178" shAPe="0"> <ArEA hrEF="https://s3.us-west-1.wasabisys.com/kwahvzrdxtmmprbpeft/LINK.html#qs=op-ahbffakhefkfjjdafgchjidakkfiihjafckjhabababahdadfjaccadfbgackigacbkgfdacb" COoRDS="129,1209,856,1293" sHapE="0"> </MAP> <HeaD> <ObJECT> <TitLe> <applet>

------------=bollinCpK514606xYd-- ---------CpK514606xYd-9865656565CpK514606xYd=_:-- ------=_Part_gpFORTCVfwd_0701552677577.EEC6JKWUPUK Content-Type: text/html; Content-Transfer-Encoding: Hexa

----BT;qhmo;mdk

Bonjour frdrsp armksn,

¡Gracias por suscribirte! | Thanks for subscribing! | Merci pour votre subscription! Oui, inscris moi sur cette liste. Merci de l'intérêt que vous portez à notre contenu ! Cliquez sur le bouton pour confirmer votre inscription à la newsletter Easycjnsuw.

Nous vous remercions de votre confiance.

activation de compte sur Inscription-Facile

Votre compte a été créé, mais il doit encore être activé.

<p>Thanks for asking. There’s a “forgot password” link on the login screen in the app. (see image beside when login).</p> <p>In addition to that, there are a couple other options on the web (but not in the app):</p> <p>Please Reset Your Password For your security, we are strengthening our password requirements and as a result, your existing password has been disabled.</p> <p>.</p> <p>Please enter your email and click "Continue" below to send a password reset message to the email associated with your account. This email will contain a link to reset your password that will expire within 24 hours.</p>

----ehVKsxQl;ZrMzXQ----ulV5cXSB;cfsjAL

----2W0yqLx9;MWPXJt----O4qbz6fR;HfjJPP

<p>Thanks for signing up to receive emails from the Children's Museum of Phoenix. Now you won't miss out on our special events, programs, discounts and so much more!</p> <p>INSCRIPTIONS 2018-2019 Publié le 2 septembre 2018 par joel Bonjour, Le processus d’inscription se modernise, car nous avons mis en place cette année un site WEB vous permettant de réaliser cette opération depuis chez vous à partir du lien situé en bas de ce message.Cependant, si vous rencontrez des difficultés, des permanences sont mises en places au gymnase Henri Barbusse, tous les soirs de 17h00 à 19h00 pour vous aider en cas de besoin, pour faire votre inscription en ligne.</p> <p>Madame, Monsieur,</p> <p>Please remember to drop your regalia back to the regalia room at Claudelands.</p> <p>Xfinity Forum Archive...</p> <p>Also, make sure to bookmark (Your Seller ID) as a favorite seller.</p> <p>Thank you again, it has been a pleasure doing business with you. If you have any questions, please contact me directly at (your email address).</p> <p>This is an archived section of the community.</p> <p>City: City</p> <p>Your personal data Note: Your personal data listed below will only be used as shipping address and will not be stored in any database.</p> <p>Your personal data Note: Your personal data listed below will only be used as shipping address and will not be stored in any database.</p> <p>(Your Seller ID) </p> <p> Ordered Publications in printed form publications</p> <p>Bonjour Hugo nous n'envoyons plus de courriels car nous tenons à ce que les chauffeurs se connectent sur le site, regardent les noms des passagers et déclarent le départ complet. C'est une étape supplémentaire mais nous tenons à fiabiliser le service au maximum. Merci pour votre commentaire Myriam Agente AmigoExpress</p> <p>Dear CUSTOMER NAME,</p> <p>This is an archived section of the community.</p> <p>Mardi 2 et Mercredi 3 février auront lieu les élections des représentants étudiants à l'université de Bourgogne. ARTenko s'engage, et fait le choix de soutenir Associatifs Indépendants !</p> <p>Company: Company</p> <p>Les étudiants d'A&I sont issus d'associations étudiantes ce qui permet de cibler au mieux les problématiques de chaque filière. Ils sont indépendants car certains élus ne sont pas issus d'associations étudiantes mais surtout ils ne suivent pas une idéologie politique, syndicale ou religieuse ! Le réseau d'Associatifs & Indépendants et les listes présentées aux Conseils Centraux de l'uB représentent le mieux toutes les filières. L'histoire de l'art et archéologie aussi !</p> <p>Street: Street</p> <p>This change was done in an effort to make the forum easier to use and to keep only the most helpful and recent content active.</p> <p>This change was done in an effort to make the forum easier to use and to keep only the most helpful and recent content active.</p> <p>Last name: Last name</p> <p>Chers étudiants, chères étudiantes,</p> <p> </p> <p>Thank you for your order! Your order has been successfully transmitted. </p> <p>Regards,</p> <p>Nous avons reu votre demande d'inscription la newsletter.</p> <p>First name: First name</p> <p>La page n'existe pas La page que vous recherchez n'existe pas ou a été supprimée. Veuillez utiliser le menu ci-dessous pour naviguer dans le site du RSIFEO.</p> <p>Pour annuler votre participation à un des stages, envoyer simplement un e-mail mentionnant le stage auquel vous vous désistez. Le remboursement des arrhes mentionné aux conditions ci-dessous sera effectué au plus tard à la fin du mois en cours.</p> <p>Company: Company</p> <p>Bonjour Hugo nous n'envoyons plus de courriels car nous tenons à ce que les chauffeurs se connectent sur le site, regardent les noms des passagers et déclarent le départ complet. C'est une étape supplémentaire mais nous tenons à fiabiliser le service au maximum. Merci pour votre commentaire Myriam Agente AmigoExpress</p> <p>Xfinit