

Received-SPF: Pass (mailfrom) identity=mailfrom Ĭlient-ip=209.85.166.198 OpenDKIM Filter v2.11.0 DF19A80A6D5Īuthentication-Results: ĭkim=pass (2048-bit key) header.d= header.b="JIWiIIIU" People work with shared Google Drive documents all the time as their daily business and those share indications are not spam, its just day-to-day business for most. This approach will very likely pass a lot of different types of spam-filtering. When the mail arrives, it would contain something like this: If you add a new user to work on the same shared file, you can add own input. The trick is in the comment of the share. Shared presentation looks like this (hint: its completely blank): There is no content in the presentation, it will be completely empty and then they'll share the document with me. What the scammers do with the account is on Google Drive they'll create a presentation. How in detail the operation works, is to either exploit some innocent person's Google Account or create a ton of brand new Google Accounts to be used briefly and then thrown away. The general idea for this spam delivery method is for the spam to originate from Google. Ok, not flooding, but during past week I've got 7 different ones.

A completely new type of spam has been flooding my mailbox.
