Skip to main content

Spam Tales: Prime Subscription Expired

· 5 min read
Deirdre Hennigar
Deirdre Hennigar
Nerd-o

Overview​

Oh no, my Prime subscription expired!

Rendered Gmail message showing a fake Prime Video terms and conditions lure

Your Subscription has expired!
Your Subscription for Prime expired on 16/06/2026
UPDATE MY PAYMENT DETAILS

The message appears like this in the inbox:

From: comoe ber <[email protected]>
Subject: Re: Reaching Out
Date: Sun, 14 Jun 2026 17:36:16 -0700

The body impersonates Prime Video, but the subject says nothing about Prime. It uses Re: Reaching Out, which is wonderfully vague.

Rendered Gmail message showing fake Prime subscription expiration details

The invoice-ish bit claims:

Subscription ID: 48521556984
Product: Prime
Expiration Date: 16/06/2026

The footer says:

You received this email because you subscribed to our newsletter.
© 2026 Amazon.com, Inc. All rights reserved.

Classic payment-recovery bait. Nothing about the sender path, unsubscribe metadata, or link hosting belongs to Amazon.

Methodology​

For this sample, I preserved a few layers separately:

  1. Capture the rendered email before interacting with any links.
  2. Review the sender path, authentication results, and SMTP submission trail.
  3. Pull out the action URLs, image URLs, and unsubscribe URLs.
  4. Check whether the first-hop infrastructure is still alive.
  5. Separate reusable campaign-looking artifacts from one-off junk and copied residue.

Tools used​

  • Gmail original message view for headers and raw source
  • Local IOC extraction from the HTML and MIME body
  • Browser screenshots for the rendered lure and dead hosted object(s)

Email Headers​

Raw Email Headers
Delivered-To: [email protected]
Received: by 2002:a5d:4388:0:b0:45e:c606:5a52 with SMTP id i8csp801548wrq; Sun, 14 Jun 2026 17:36:18 -0700 (PDT)
X-Received: by 2002:a05:6a00:1255:b0:82c:20ec:6589 with SMTP id d2e1a72fcca58-8434d08fb02mr6040631b3a.3.1781483777888; Sun, 14 Jun 2026 17:36:17 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; t=1781483777; cv=none; d=google.com; s=arc-20240605; b=WXdSVVEbcWalqUt+DtNLzYELJ8MIlL5r/zW+zYUN4uJlzXJMwNRjiOfw1jDGLFtg3K MSipq63Y//xPdHr0xPRl6YT9raexezQw0ZL+cYGcgy2IJTjImUVEiXfNhbte6MsOi4FF zka/HHoLgRw+hawZlUtfMoI/4G3Zw0+kYc+L3VdAa6t04aa76J9yXBev+NacbX6VCFBr TozAuNMDroQEAfQy6mt7JurdNsWRBMoJ6PuWcJZvyKEWFsQO3HzSKFLonjTXXIG6Qd6b E1SxU38WmsE+uJvpwFGCcUV9ykK3WAXXqUy/Ik9q/ckSUd6UJzhd2T8uZKhk4Nwu5d2A 08mA==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=feedback-id:list-unsubscribe-post:feedback-id:content-id:cf-2025-91 :message-id:list-unsubscribe:content-transfer-enfcoding:references :feedback-id:mime-version:campaign_id:rcpt_domain:subject:errors-to :in-reply-to:cc:to:from:date:dkim-signature; bh=mTrkK2dTQwWekvdaUHi04OhpuIfdToDLenjNp7IBUG0=; fh=uCpEWAVPefAsuxydQrQ6jFza+PFTZWbqjgkrsdbsK38=; b=Ptv/3vp6JACgAQAq5uLmmTWv33sqyb051RWBIIEg4vjrEjw5DLCDthmXAoYI2xSqPE pWDaaEbquE85ryVjvCUD95Qydbycbsf5V5BQywNnvGBggERu9QfGxYq/ZNDVf/5/S1RJ O1avKjDFwDHj7DNW3SXhBZFg3nkRlZbAtJ23P+YCu12KGagp/HvtiJH3Fw13g/wKdjlx TlXIo8S/XiEDObNDD7OA4/OB5/V9KvxslryllgRR+ss3sA71PYlvpVKAGILrDGGZhtPu pDBqK78f3FtJvWXmc5QLxYVdLMGSfp1ifMd1mMda89wnDBoEZHwskdTLAJlxTPG+WEc2 uFxA==; dara=google.com
ARC-Authentication-Results: i=1; mx.google.com; dkim=pass [email protected] header.s=20251104 header.b=mWvC9KDg; spf=pass (google.com: domain of [email protected] designates 209.85.220.65 as permitted sender) [email protected]; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com; dara=pass [email protected]
Return-Path: <[email protected]>
Received: from mail-sor-f65.google.com (mail-sor-f65.google.com. [209.85.220.65]) by mx.google.com with SMTPS id d2e1a72fcca58-8434acd1953sor1901458b3a.1.2026.06.14.17.36.17 for <[email protected]> (Google Transport Security); Sun, 14 Jun 2026 17:36:17 -0700 (PDT)
Received-SPF: pass (google.com: domain of [email protected] designates 209.85.220.65 as permitted sender) client-ip=209.85.220.65;
Authentication-Results: mx.google.com; dkim=pass [email protected] header.s=20251104 header.b=mWvC9KDg; spf=pass (google.com: domain of [email protected] designates 209.85.220.65 as permitted sender) [email protected]; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com; dara=pass [email protected]
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1781483777; x=1782088577; dara=google.com; h=feedback-id:list-unsubscribe-post:feedback-id:content-id:cf-2025-91 :message-id:list-unsubscribe:content-transfer-enfcoding:references :feedback-id:mime-version:campaign_id:rcpt_domain:subject:errors-to :in-reply-to:cc:to:from:date:from:to:cc:subject:date:message-id :reply-to; bh=mTrkK2dTQwWekvdaUHi04OhpuIfdToDLenjNp7IBUG0=; b=mWvC9KDgsWQ1bTXsaOMw9pJSriAZptfpYubgIVY8BJbAevcmKU1ZA40FiwzXpcV7VL hNwQ7BnsyLvVwBw7mQg+aoN8EfsU45QwyzB/ATi95bGYxDQB+k2EOd674c/A8+ir5wTE Kf5MaScg3BrBn5VnohoiYaO1jVQW7WQjQAHAQMfx3S3s8Ad5DhXWlPZH4sBDxtScaa+e bUBthn+1QUOfhFoKWtuwOWK4wvu999pkXHLuG/klLvNUYe7kDhz2RUAcpDDJ0jbYTwOW vDEco4l4v9jW349XUE9YoPSyRZs28fNPmSw3WgvA3+tp5+LKeXKQUBbYg+iDbv3jiASV rlXw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781483777; x=1782088577; h=feedback-id:list-unsubscribe-post:feedback-id:content-id:cf-2025-91 :message-id:list-unsubscribe:content-transfer-enfcoding:references :feedback-id:mime-version:campaign_id:rcpt_domain:subject:errors-to :in-reply-to:cc:to:from:date:x-gm-gg:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=mTrkK2dTQwWekvdaUHi04OhpuIfdToDLenjNp7IBUG0=; b=MwwPg8NnEI7b8AWcFbfmRq3sp9JlySSjqiLflSrUKDE/ub9uzBS8WsnscCtu5N6F30 iAKuBtJUJ0kHtmXncN0S92YLfYje4udTdHAInQMff3qDYIJFyvfGwIs3mF8pHUHgITuG 86OKRBK8Y6eL/7B+e38ZhQGn48XIh1x9d6QqjRI4bS2Bym9QDPK17MxwA4XESYmnOGQt lLUryGZe1yiMb/FVqAf19hp9qUXQ5zP0uP/Qw+LI0moElsEFGLwmvLhO8D7eJdS/Z6bX aXi0UCUVCRVql0t6HUKT+nDKOFJG8dZBuzCUgWzNV9bTlxOmsSJbdQ1K7is5/izoSjqm 6rJA==
X-Gm-Message-State: AOJu0YxI8GYLJ96NfL0w+RBy/hF5rM48gQ0r3P6XKAA16EIcFfYmohng UTOWh+cOr3xN/TSnICZCHm/0670fN/Ddg3BdHgTcwE3jEkXG3TH8gL7QL7UYLiKS5agl7Js0
X-Gm-Gg: Acq92OFX8Z1YDCVzvedDSyrbpTJBJUyfOfwqoBGvESQmJnULj4OtZbaBHfpjWw87kKq MTEgf6o1Y0le/u04HhAXqUCxSa2CcawXYRR9N3pBdaBblGjWvV9NjRHOon/s4EB27iY0kIc3gSr 9C8DNroBpyUzViXz7mNjc7Ws75iHv8n9ePNOL1fKLD9VvfZM8dmQ5in/hLqqOPxP5eI7k54MCZ+ ak7vvVASBe8JS4U+8flYg/qjUUVlj8ElyqLtCgwiTTc6Ty/itabvK/hsKR1tqXMI4vtu/ll3RTM sfg5tbZWl8+Atpztk/ZmCrUWNh9T6fsO3TZSOm7ZwoH/74TD5EvIseOdjMLJuwMnc4/LEp1j3bv 7anDYgaaLcncu4AIMuGM5OPwDtkc/wDSh8pey3GA2n5m9MJ7VH8e8iKKxzHwahCtliCGbUIOS83 kUGfIkqFR/eqrUdjMvJNIafYu/zWB+juftrw+Uvmws0ZMaSSa/hvuDB8JNP8okla2R6nCSxQ+6d SIQMg2kgQRlQkMAuBkvfcHKeytSnIVK4BKfU4BJ71XVdhb5Oh/a3TpMqhY1y/dKfuDzFrSW/qvh SY2gQa2T3XpnsYQ=
X-Received: by 2002:a05:6a00:340d:b0:842:2cda:7aa2 with SMTP id d2e1a72fcca58-8434d0abff6mr13127653b3a.30.1781483777235; Sun, 14 Jun 2026 17:36:17 -0700 (PDT)
Return-Path: <[email protected]>
Received: from mail.Calixo.me (ec2-13-204-180-155.ap-south-1.compute.amazonaws.com. [13.204.180.155]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-8434accbc89sm8443948b3a.15.2026.06.14.17.36.16 for <[email protected]> (version=TLS1 cipher=ECDHE-ECDSA-AES128-SHA bits=128/128); Sun, 14 Jun 2026 17:36:16 -0700 (PDT)
Date: Sun, 14 Jun 2026 17:36:16 -0700 (PDT)
X-Google-Original-Date: [smtp_date]
From: comoe ber <[email protected]>
X-Google-Original-From: comoe ber <[email protected]>
To: "[email protected]" <[email protected]>
X-rpcampaign: stcsp99709194
X-SG-EID: [aa_7]/[aa_49]+/bXwD3nnE226p/imTTAl/87k5Ymm84hMsEQPntlZ3Kma7BgkFnHVg1BYF+87k5Ymm84hMsEQPntlZ3Kma7BgkFnHVg1BYF/vVAHG/ZliEmOU9KeL1zjpkig2seBqoM8PVwWvIpjcfWw7k2sj0RwsR+DZTbItn27lXc1NE/rUhaq7ywc0i9RCoXhZTpxyZJfZ2mqHAPlv==?
X-campaignid: rUhaq7ywc0i9RCoXhZTpxyZJfZ2mqHAPlv.lBMErXjNLv
CC: "[to]" <[to]>
X-Feedback-ID: 1781223:SG
In-Reply-To: <[email protected]><Zb1JlTI9ZVDf7PhkzRRdcGmtzJ3VbJBwpX3PrlZ52TcU@vVAHG-GOe47.sog.unc.edu>
Errors-To: [email protected]
X-Report-Abuse: <[email protected]>
Subject: Re: Reaching Out
X-Mailer: PHPMailer 6.9.2 (https://github.com/PHPMailer/PHPMailer)
X-SFMC-Stack: 7
rcpt_domain: gmail.com
X-SG-EID: [aa_7]/[aa_49]+/bXwD3nnE226p/imTTAl/87k5Ymm84hMsEQPntlZ3Kma7BgkFnHVg1BYF+87k5Ymm84hMsEQPntlZ3Kma7BgkFnHVg1BYF/vVAHG/ZliEmOU9KeL1zjpkig2seBqoM8PVwWvIpjcfWw7k2sj0RwsR+DZTbItn27lXc1NE/rUhaq7ywc0i9RCoXhZTpxyZJfZ2mqHAPlv==?
X-JMailer: ip-10-55-95-109.ec2.internal
X-Kmail-Account: f0cVbI
campaign_id: 511517
MIME-Version: 1.0
Feedback-ID: f0cVbI:4OYyS5k0Ot9:forms::container:CK
X-Report-Spam: <[email protected]>
X-TM-ID: 8698350323148187.99709194.27060
X-Entity-ID: 23agIQTx4WWT24fC67Lvzn==?=
References: <[email protected]> <[email protected]>
Content-Transfer-Enfcoding: 7bit
List-Unsubscribe: <https://www.sog.unc.edu/unsubscribe/?aZ9hLS37Zd91hzoEfxXskzOuF6tK2qoHOjqyBJ8LXAPAdw49cpQcH57p7niszKuQmwiHdTyMadmLsZ8zqpABkd2yJvmKTlhwCKQ9Ho3Nr0ihGN0LEHN1NTz47==>
Message-ID: <AC500000000pYOJKYIyXXKPWBjLmscom_mkt_prod8@[placeholde1]>
X-Auto-Response-Suppress: OOF, AutoReply
X-Feedback-ID: 1835:99709194:campaign:sailthru
X-Campaign: rUhaq7ywc0i9RCoXhZTpxyZJfZ2mqHAPlv.lBMErXjNLv
X-SFMC-Stack: 7
cf-2025-91: 
X-Google-Original-From: "GoogleAlerts" <[email protected]>
Content-Id: <[email protected]>
X-Mailer: AWeber Composer 2.72.4
X-Unsubscribe-Web: https://sog.unc.edu/oc/Mn0nfocytOPSbvR5uBz8TB3HvVuAyL.9dzs/7b80de18
Feedback-ID: f0cVbI:4OYyS5k0Ot9:04
List-Unsubscribe-Post: List-Unsubscribe=One-Click
Content-Type: multipart/signed; boundary="-------3dAw2PEf--==--9dzs-==--3dAw2PEf--==--"; type="multipart/alternative"
Feedback-ID: ::1.ap-southeast-1.pYOJKYIyXXKPWBjL+cezwlDkKAyWMxqc3po7Y=:AmazonSES
X-SES-Outgoing: 2026.03.16-172.31.15.162

---------3dAw2PEf--==--9dzs-==--3dAw2PEf--==--
Content-Type: multipart/report; boundary="_-------nhrZSyTQIA3kZSwurm8O.DZTbItn27lXc1NE-959873471455850nhrZSyTQIA3kZSwurm8O.DZTbItn27lXc1NE=:"

--_-------nhrZSyTQIA3kZSwurm8O.DZTbItn27lXc1NE-959873471455850nhrZSyTQIA3kZSwurm8O.DZTbItn27lXc1NE=:
Content-Type: text/html;charset="UTF-8"

<!DOCTYPE html>
<html lang="en">
<head>
  <meta charset="UTF-8">
  <title>bXwD3nnE226p</title>

  <style>
    body.app-root {
      margin: 0;
      padding: 50px 0;
      background-color: #ffffff;
      font-family: Arial, Helvetica, sans-serif;
      text-align: center;
    }

    table.layout-grid {
      width: 100%;
      border-collapse: collapse;
    }

    template-container {
      display: block;
    }

    .module-wrapper {
      width: 95%;
      max-width: 720px;
      background-color: #1f0b09;
      border-radius: 16px;
      box-shadow: 0 0 36px rgba(255, 99, 71, 0.45);
      overflow: hidden;
      border: 1px solid white;
    }

    .banner-block {
      background: linear-gradient(135deg, #020617, #1e40af, #3b82f6);
      padding: 38px;
      text-align: center;
      position: relative;
    }

    .banner-block::after {
      content: "";
      display: block;
      width: 100%;
      height: 4px;
      background-color: #93c5fd;
      margin-top: 18px;
      box-shadow: 0 0 16px #3b82f6;
    }

    .banner-anchor {
      color: #eaf6ff;
      font-size: 32px;
      font-weight: 700;
      text-decoration: none;
      letter-spacing: 0.5px;
      text-shadow: 0 0 16px rgba(59, 130, 246, 0.6);
    }

    .image-block {
      line-height: 0;
    }

    .image-block img {
      display: block;
      width: 100%;
      max-width: 720px;
      border: 0;
    }

    .footer-block {
      background-color: #ffffff;
      padding: 24px;
      font-size: 12px;
      color: #fed7d7;
      text-align: center;
    }
  </style>
</head>

<body class="app-root">

  <table class="layout-grid" cellpadding="0" cellspacing="0" border="0">
    <tr>
      <td align="center">

        <table class="module-wrapper" cellpadding="0" cellspacing="0" border="0">

          <tr>
            <td class="banner-block">
              <a href="https://hnbvcwbxbubu.sfo2.digitaloceanspaces.com/1.html#cl/334356_md/1299/15346052/1011/206/22373" class="banner-anchor">
                Terms and Conditions
              </a>
            </td>
          </tr>

          <tr>
            <td class="image-block">
              <a href="https://hnbvcwbxbubu.sfo2.digitaloceanspaces.com/1.html#cl/334356_md/1299/15346052/1011/206/22373">
                <img src="https://hnbvcwbxbubu.sfo2.digitaloceanspaces.com/1.png" originalsrc="https://hnbvcwbxbubu.sfo2.digitaloceanspaces.com/1.png" alt="">
              </a>
            </td>
          </tr>

          <tr>
            <td class="image-block">
              <a href="https://hnbvcwbxbubu.sfo2.digitaloceanspaces.com/2.html#un/334356_md/1299/15346052/1011/206/22373">
                <img src="https://hnbvcwbxbubu.sfo2.digitaloceanspaces.com/2.png" originalsrc="https://hnbvcwbxbubu.sfo2.digitaloceanspaces.com/2.png" alt="">
              </a>
            </td>
          </tr>

          <tr>
            <td class="footer-block">
            </td>
          </tr>

        </table>

      </td>
    </tr>
  </table>

</body>
</html>
<title>
Thanks, Steve!
+ the DL for their awareness as well.
Original Message
From: Grimes, Stephen H.
Sent: Friday, September 06, 2013 9:11 AM
To: Kimball, Emilie A.
Subject: FW: POTUS/FLOTUS gifts received in Russia
Emilie,
could you please draft a letter thanking H.E. Xi Jinping for his gift!
Thanks.
Steve
Original Message
From: Garland, Leigh [mailto:[email protected]]
Sent: Friday, September 06, 2013 9:04 AM
To: Mosteller, Brian D.; Decker Breckenridge, Anita; Nicholson, Marvin D.; Winter, Melissa
Cc: Grimes, Stephen H.; Jones, Natalie R; Pan, Elizabeth; Freshwater, Meg; Henning, Sarah R; Paolino, Jennifer C; Wham,
Jennifer L; Roberts, Asel K
Subject: POTUS/FLOTUS gifts received in Russia
Dear Brian, Anita, Marvin, and Melissa:
Please see the below list of gifts received by POTUS and FLOTUS in Russia:
His Excellency Vladimir Putin, President of the Russian Federation, gifted POTUS: a large porcelain tea set (with two
cups, saucers, and a teapot), a porcelain plate, and a DVD of Russian ballet. These are the standard leader gifts that all
G20 participants received.
His Excellency Vladimir Putin, President of the Russian Federation, gifted FLOTUS: a small porcelain tea set (with two
cups, saucers, and a teapot) and a porcelain plate. These are the gifts that all spouses of G20 leaders received.
His Excellency Xi Jinping, President of the People's Republic of China, gifted POTUS: a large porcelain vase with a lotus,
1
J
The Russian G20 Organizing Committee gifted POTUS: a black leather Tumi laptop bag, a fountain pen, an umbrella, a
thumb drive, a iPhone/iPad battery, and two notebooks.
All gifts were received via protocol. Please let me know if you have any questions.
Thank you!
Leigh 

<table border="1">
<tbody>
<tr><td>1</td></tr>
<tr><td>Global Agriculture and Food Security Program</td></tr>
<tr><td>From: comoe bernard <[email protected]></td></tr>
<tr><td>Sent: Monday</td><td> September 16</td><td> 2019 2:59 PM</td></tr>
<tr><td>To: Global Agriculture and Food Security Program</td></tr>
<tr><td>Cc: Nouhoun Coulibaly; Gaiji</td><td> Samy (FAOCI); [email protected];</td></tr>
<tr><td>[email protected]</td></tr>
<tr><td>Subject: Re: GAFSP Côte d'Ivoire Submission- Batch 1/3</td></tr>
<tr><td>[External]</td></tr>
<tr><td>Dear GAFSP Coordination Unit</td><td></td></tr>
<tr><td>For your request</td><td> below is an indicative note of the Agriculture and Food Security Development Strategy.</td></tr>
<tr><td>I send to you some specific sector strategies by « wetransfer ». Kindly acknowledge receipt of the documents</td></tr>
<tr><td>Note on Agricultural and Food Security development strategy</td></tr>
<tr><td>The agricultural and food security development in Côte d’Ivoire is organized as follows:</td></tr>
<tr><td>At the first level: the Agricultural Orientation Law that was adopted in 2015</td><td> and represents the framework for the</td></tr>
<tr><td>application of agricultural development policies and strategies. It enables the harmonization and the</td></tr>
<tr><td>adjustment/enrichment of the shortcomings of the existing specific laws in the agricultural sector.</td></tr>
<tr><td>At the second level: the National Agricultural Investment Programme (NAIP) Adopted in 2017. The NAIP provides a</td></tr>
<tr><td>coherent framework for the programming of public and private investments in the agricultural and food security sector</td></tr>
<tr><td>and aims at stimulating sectoral growth to reduce poverty and achieve “zero hunger” by 2025.</td></tr>
<tr><td> Finally</td><td> this investment programme is operationalized through specific strategies for the development of agricultural</td></tr>
<tr><td>sub-sectors</td><td> cross-cutting approaches to agricultural development challenges. The most important of these subsector development strategies are:</td></tr>
<tr><td>- For the oil palm sector</td><td> the 3rd Palm plan;</td></tr>
<tr><td>- For Hevea sector</td><td> the 7th Hevea project</td><td></td></tr>
<tr><td>- For cocoa and coffee</td><td> the Quantity</td><td> Quality and Growth (2QC) plan</td><td></td></tr>
<tr><td>- For food crops</td><td> National Food Crop Development Strategy other than rice;</td></tr>
<tr><td>- For the rice sector</td><td> National Strategy for the development of the rice sector</td><td></td></tr>
<tr><td>- For agricultural tracks</td><td> National Rural Roads Strategy</td></tr>
<tr><td>- For rural land</td><td> the Rural Land Policy;</td></tr>
<tr><td>- For irrigation</td><td> Irrigation Strategic Plan;</td></tr>
<tr><td>- For the animal and fisheries sectors</td><td> Strategy for the Development of Livestock</td><td> Fisheries and Aquaculture;</td></tr>
<tr><td>- For resilience</td><td> a “Country Resilience Priority” program;</td></tr>
<tr><td>- For climate change</td><td> a Climate Intelligence Agriculture Investment Plan in Côte d’Ivoire.</td></tr>
<tr><td>Other specific cross-cutting strategies such as the national agricultural training strategy</td><td> the national</td></tr>
<tr><td>agricultural international cooperation strategy</td><td> the agricultural communication strategy</td><td> the strategy for the</td></tr>
<tr><td>development of the cashew industry in Côte d'Ivoire currently being formulated will complement the abovementioned.</td></tr>
<tr><td>2</td></tr>
<tr><td>In sum</td><td> the Agricultural Orientation Law is the fundamental basis of the agricultural development and food</td></tr>
<tr><td>security policy in Côte d'Ivoire</td><td> from which PNIA and other specific strategies derive from.</td></tr>
<tr><td>Le 12 sept. 2019 à 01:11</td><td> Global Agriculture and Food Security Program <[email protected]> a</td></tr>
<tr><td>écrit :</td></tr>
<tr><td>Dear Mr Comoe</td></tr>
<tr><td>Thank you again for sending Cote d'Ivoire's submission to GAFSP. We have reviewed the submission</td></tr>
<tr><td>package and wanted to revert to you for clarification on one document</td><td> the country's Agriculture and</td></tr>
<tr><td>Food Security Strategy document (#6 on the GAFSP submission Document Checklist).</td></tr>
<tr><td>The CU notes that the submitted strategy document appears more to be an Agricultural Law</td></tr>
<tr><td>document. Could we confirm that this is submitted as your Agriculture Strategy document?</td></tr>
<tr><td>If you would wish to provide any alternate or complementary documentation in fulfilment of the</td></tr>
<tr><td>required Agriculture and Food Security Strategy</td><td> please do so by Monday 16th September</td><td> 2019. This is</td></tr>
<tr><td>the extended deadline for additional documents and we will not be able to accept any documents sent</td></tr>
<tr><td>after this deadline.</td></tr>
<tr><td>Best regards</td><td></td></tr>
<tr><td>GAFSP Coordination Unit</td></tr>
<tr><td>-----Original Message-----</td></tr>
<tr><td>From: Global Agriculture and Food Security Program</td></tr>
<tr><td>Sent: Tuesday</td><td> September 10</td><td> 2019 2:08 PM</td></tr>
<tr><td>To: comoe bernard <[email protected]></td></tr>
<tr><td>Cc: Natasha Hayward <[email protected]>; Nouhoun Coulibaly <[email protected]>; Gaiji</td><td></td></tr>
<tr><td>Samy (FAOCI) <[email protected]>; [email protected];</td></tr>
<tr><td>[email protected]; [email protected]</td></tr>
<tr><td>Subject: RE: GAFSP Côte d'Ivoire Submission- Batch 1/3</td></tr>
<tr><td>Dear Mr Comoe</td></tr>
<tr><td>Thank you for sending the government of Cote d'Ivoire’s submission to the Global Agriculture and Food</td></tr>
<tr><td>Security Program 2019 Call for Proposals. I am writing on behalf of the GAFSP Coordination Unit (CU) to</td></tr>
<tr><td>acknowledge receipt of the submitted application.</td></tr>
<tr><td>I note that the submission has been sent in three separate email transmissions and confirm receipt of all</td></tr>
<tr><td>three messages</td><td> plus one final (fourth) communication via 'wetransfer'.</td></tr>
<tr><td>The application package will shortly be reviewed by the CU for completeness and eligibility and we will</td></tr>
<tr><td>revert if any additional information is required. If everything is in order</td><td> you would be notified and the</td></tr>
<tr><td>application package will then be forwarded to the Technical Advisory Committee for their review.</td></tr>
<tr><td>Best regards</td><td></td></tr>
<tr><td>GAFSP Coordination Unit</td></tr>
<tr><td>-----Original Message-----</td></tr>
<tr><td>From: comoe bernard <[email protected]></td></tr>
<tr><td>Sent: Tuesday</td><td> September 10</td><td> 2019 1:39 PM</td></tr>
<tr><td>To: Global Agriculture and Food Security Program <[email protected]></td></tr>
<tr><td>3</td></tr>
<tr><td>Cc: Natasha Hayward <[email protected]>; Nouhoun Coulibaly <[email protected]>; Gaiji</td><td></td></tr>
<tr><td>Samy (FAOCI) <[email protected]>; [email protected];</td></tr>
<tr><td>[email protected]</td></tr>
<tr><td>Subject: GAFSP Côte d'Ivoire Submission- Batch 1/3</td></tr>
<tr><td>[External]</td></tr>
<tr><td>Dear GAFSP Coordinator</td><td></td></tr>
<tr><td>Please</td><td> find herewith attached the Cote d’Ivoire submission in response to the 5th call for proposal.</td></tr>
<tr><td>Because of the size of files</td><td> the documents will be sent in batches</td></tr>
<tr><td>Kindly acknowledge receipt of the documents</td></tr>
<tr><td>We remain at your disposal for further information</td></tr>
<tr><td>Best regards</td></tr>
<tr><td>Bernard COMOE</td></tr>
<tr><td>Director of Planning</td><td> Program and Finance</td></tr>
<tr><td>MINISTRY OF AGRICULTURE AND RURAL DEVELOPMENT</td></tr>
<tr><td>COTE D’IVOIRE</td><td></td></tr>
<tr><td>Contact: +225 07 06 48 22/ +225 20 21 20 39</td></tr>
</tbody>
</table>
--_----------=bollinvlqz8U7elIuryLUds4.bXwD3nnE226p--
--_-------nhrZSyTQIA3kZSwurm8O.DZTbItn27lXc1NE-959873471455850nhrZSyTQIA3kZSwurm8O.DZTbItn27lXc1NE=:
--_-------nhrZSyTQIA3kZSwurm8O.DZTbItn27lXc1NE-959873471455850nhrZSyTQIA3kZSwurm8O.DZTbItn27lXc1NE=:--
---------3dAw2PEf--==--9dzs-==--3dAw2PEf--==--

<table border="1">
<tbody>
<tr><td>1</td></tr>
<tr><td>Global Agriculture and Food Security Program</td></tr>
<tr><td>From: comoe bernard <[email protected]></td></tr>
<tr><td>Sent: Monday</td><td> September 16</td><td> 2019 2:59 PM</td></tr>
<tr><td>To: Global Agriculture and Food Security Program</td></tr>
<tr><td>Cc: Nouhoun Coulibaly; Gaiji</td><td> Samy (FAOCI); [email protected];</td></tr>
<tr><td>[email protected]</td></tr>
<tr><td>Subject: Re: GAFSP Côte d'Ivoire Submission- Batch 1/3</td></tr>
<tr><td>[External]</td></tr>
<tr><td>Dear GAFSP Coordination Unit</td><td></td></tr>
<tr><td>For your request</td><td> below is an indicative note of the Agriculture and Food Security Development Strategy.</td></tr>
<tr><td>I send to you some specific sector strategies by « wetransfer ». Kindly acknowledge receipt of the documents</td></tr>
<tr><td>Note on Agricultural and Food Security development strategy</td></tr>
<tr><td>The agricultural and food security development in Côte d’Ivoire is organized as follows:</td></tr>
<tr><td>At the first level: the Agricultural Orientation Law that was adopted in 2015</td><td> and represents the framework for the</td></tr>
<tr><td>application of agricultural development policies and strategies. It enables the harmonization and the</td></tr>
<tr><td>adjustment/enrichment of the shortcomings of the existing specific laws in the agricultural sector.</td></tr>
<tr><td>At the second level: the National Agricultural Investment Programme (NAIP) Adopted in 2017. The NAIP provides a</td></tr>
<tr><td>coherent framework for the programming of public and private investments in the agricultural and food security sector</td></tr>
<tr><td>and aims at stimulating sectoral growth to reduce poverty and achieve “zero hunger” by 2025.</td></tr>
<tr><td> Finally</td><td> this investment programme is operationalized through specific strategies for the development of agricultural</td></tr>
<tr><td>sub-sectors</td><td> cross-cutting approaches to agricultural development challenges. The most important of these subsector development strategies are:</td></tr>
<tr><td>- For the oil palm sector</td><td> the 3rd Palm plan;</td></tr>
<tr><td>- For Hevea sector</td><td> the 7th Hevea project</td><td></td></tr>
<tr><td>- For cocoa and coffee</td><td> the Quantity</td><td> Quality and Growth (2QC) plan</td><td></td></tr>
<tr><td>- For food crops</td><td> National Food Crop Development Strategy other than rice;</td></tr>
<tr><td>- For the rice sector</td><td> National Strategy for the development of the rice sector</td><td></td></tr>
<tr><td>- For agricultural tracks</td><td> National Rural Roads Strategy</td></tr>
<tr><td>- For rural land</td><td> the Rural Land Policy;</td></tr>
<tr><td>- For irrigation</td><td> Irrigation Strategic Plan;</td></tr>
<tr><td>- For the animal and fisheries sectors</td><td> Strategy for the Development of Livestock</td><td> Fisheries and Aquaculture;</td></tr>
<tr><td>- For resilience</td><td> a “Country Resilience Priority” program;</td></tr>
<tr><td>- For climate change</td><td> a Climate Intelligence Agriculture Investment Plan in Côte d’Ivoire.</td></tr>
<tr><td>Other specific cross-cutting strategies such as the national agricultural training strategy</td><td> the national</td></tr>
<tr><td>agricultural international cooperation strategy</td><td> the agricultural communication strategy</td><td> the strategy for the</td></tr>
<tr><td>development of the cashew industry in Côte d'Ivoire currently being formulated will complement the abovementioned.</td></tr>
<tr><td>2</td></tr>
<tr><td>In sum</td><td> the Agricultural Orientation Law is the fundamental basis of the agricultural development and food</td></tr>
<tr><td>security policy in Côte d'Ivoire</td><td> from which PNIA and other specific strategies derive from.</td></tr>
<tr><td>Le 12 sept. 2019 à 01:11</td><td> Global Agriculture and Food Security Program <[email protected]> a</td></tr>
<tr><td>écrit :</td></tr>
<tr><td>Dear Mr Comoe</td></tr>
<tr><td>Thank you again for sending Cote d'Ivoire's submission to GAFSP. We have reviewed the submission</td></tr>
<tr><td>package and wanted to revert to you for clarification on one document</td><td> the country's Agriculture and</td></tr>
<tr><td>Food Security Strategy document (#6 on the GAFSP submission Document Checklist).</td></tr>
<tr><td>The CU notes that the submitted strategy document appears more to be an Agricultural Law</td></tr>
<tr><td>document. Could we confirm that this is submitted as your Agriculture Strategy document?</td></tr>
<tr><td>If you would wish to provide any alternate or complementary documentation in fulfilment of the</td></tr>
<tr><td>required Agriculture and Food Security Strategy</td><td> please do so by Monday 16th September</td><td> 2019. This is</td></tr>
<tr><td>the extended deadline for additional documents and we will not be able to accept any documents sent</td></tr>
<tr><td>after this deadline.</td></tr>
<tr><td>Best regards</td><td></td></tr>
<tr><td>GAFSP Coordination Unit</td></tr>
<tr><td>-----Original Message-----</td></tr>
<tr><td>From: Global Agriculture and Food Security Program</td></tr>
<tr><td>Sent: Tuesday</td><td> September 10</td><td> 2019 2:08 PM</td></tr>
<tr><td>To: comoe bernard <[email protected]></td></tr>
<tr><td>Cc: Natasha Hayward <[email protected]>; Nouhoun Coulibaly <[email protected]>; Gaiji</td><td></td></tr>
<tr><td>Samy (FAOCI) <[email protected]>; [email protected];</td></tr>
<tr><td>[email protected]; [email protected]</td></tr>
<tr><td>Subject: RE: GAFSP Côte d'Ivoire Submission- Batch 1/3</td></tr>
<tr><td>Dear Mr Comoe</td></tr>
<tr><td>Thank you for sending the government of Cote d'Ivoire’s submission to the Global Agriculture and Food</td></tr>
<tr><td>Security Program 2019 Call for Proposals. I am writing on behalf of the GAFSP Coordination Unit (CU) to</td></tr>
<tr><td>acknowledge receipt of the submitted application.</td></tr>
<tr><td>I note that the submission has been sent in three separate email transmissions and confirm receipt of all</td></tr>
<tr><td>three messages</td><td> plus one final (fourth) communication via 'wetransfer'.</td></tr>
<tr><td>The application package will shortly be reviewed by the CU for completeness and eligibility and we will</td></tr>
<tr><td>revert if any additional information is required. If everything is in order</td><td> you would be notified and the</td></tr>
<tr><td>application package will then be forwarded to the Technical Advisory Committee for their review.</td></tr>
<tr><td>Best regards</td><td></td></tr>
<tr><td>GAFSP Coordination Unit</td></tr>
<tr><td>-----Original Message-----</td></tr>
<tr><td>From: comoe bernard <[email protected]></td></tr>
<tr><td>Sent: Tuesday</td><td> September 10</td><td> 2019 1:39 PM</td></tr>
<tr><td>To: Global Agriculture and Food Security Program <[email protected]></td></tr>
<tr><td>3</td></tr>
<tr><td>Cc: Natasha Hayward <[email protected]>; Nouhoun Coulibaly <[email protected]>; Gaiji</td><td></td></tr>
<tr><td>Samy (FAOCI) <[email protected]>; [email protected];</td></tr>
<tr><td>[email protected]</td></tr>
<tr><td>Subject: GAFSP Côte d'Ivoire Submission- Batch 1/3</td></tr>
<tr><td>[External]</td></tr>
<tr><td>Dear GAFSP Coordinator</td><td></td></tr>
<tr><td>Please</td><td> find herewith attached the Cote d’Ivoire submission in response to the 5th call for proposal.</td></tr>
<tr><td>Because of the size of files</td><td> the documents will be sent in batches</td></tr>
<tr><td>Kindly acknowledge receipt of the documents</td></tr>
<tr><td>We remain at your disposal for further information</td></tr>
<tr><td>Best regards</td></tr>
<tr><td>Bernard COMOE</td></tr>
<tr><td>Director of Planning</td><td> Program and Finance</td></tr>
<tr><td>MINISTRY OF AGRICULTURE AND RURAL DEVELOPMENT</td></tr>
<tr><td>COTE D’IVOIRE</td><td></td></tr>
<tr><td>Contact: +225 07 06 48 22/ +225 20 21 20 39</td></tr>
</tbody>
</table>

---------3dAw2PEf--==--9dzs-==--3dAw2PEf--==----

There are SO MANY different elements:

X-Mailer: PHPMailer 6.9.2 - local PHP mailer residue
X-Mailer: AWeber Composer 2.72.4 - newsletter-platform 
X-Feedback-ID: 1781223:SG - SendGrid-shaped feedback identifier
X-Feedback-ID: 1835:99709194:campaign:sailthru - campaign feedback identifier
Feedback-ID: ...:AmazonSES - feedback identifier
X-SES-Outgoing: 2026.03.16-172.31.15.162 - feedback trace
X-SFMC-Stack: 7 - Salesforce Marketing Cloud-looking stack marker
List-Unsubscribe: https://www.sog.unc.edu/unsubscribe/...
X-Unsubscribe-Web: https://sog.unc.edu/oc/...
Kmail - X-Kmail-Account account marker

Duplicate X-Google-Original-From fields:

X-Google-Original-From: comoe ber <[email protected]>
X-Google-Original-From: "GoogleAlerts" <[email protected]>

Gmail adds X-Google-Original-From when it rewrites a submitted sender address, but this message has two of them.

Email Artifacts​

ArtifactWhat it pretends to beWhat it actually suggests
Prime Video brandingA subscription renewal noticePayment-update phishing
Re: Reaching OutA normal reply-chain emailConversation camouflage
Gmail senderA normal personal accountAuthenticated-account abuse or scripted Gmail submission
AWS EC2 submitterOrdinary cloud mail clientCloud-hosted sending infrastructure
DigitalOcean Spaces linksTerms/payment/unsubscribe pagesFirst-stage lure hosting
sog.unc.edu unsubscribe headersUnsubscribe plumbingBorrowed or copied bulk-mail residue
PHPMailer, AWeber, SG, Sailthru, SES, SFMCBulk-mail legitimacyToo many in a single mail message
Copied POTUS/GAFSP textNormal body contentSpam-filter padding

Email Authentication​

The Gmail authentication result is technically clean; this is the important boring-but-useful distinction:

SPF:   PASS for [email protected]
DKIM:  PASS for gmail.com
DMARC: PASS for gmail.com

It means Gmail authenticated Gmail. Helpful!

The more useful line is the SMTP submission:

Received: from mail.Calixo.me
  (ec2-13-204-180-155.ap-south-1.compute.amazonaws.com. [13.204.180.155])
  by smtp.gmail.com with ESMTPSA

ESMTPSA is important because it indicates authenticated SMTP submission to Gmail. In plain English: something logged in to Gmail SMTP and submitted this message from an AWS EC2 host.

This is why authenticated mail can still be trash. A message can pass SPF, DKIM, and DMARC for the account that sent it, while the content is still pretending to be something else entirely.

The metadata points to UNC School of Government infrastructure:

List-Unsubscribe: https://www.sog.unc.edu/unsubscribe/...
X-Unsubscribe-Web: https://sog.unc.edu/oc/Mn0nfocytOPSbvR5uBz8TB3HvVuAyL.9dzs/7b80de18
List-Unsubscribe-Post: List-Unsubscribe=One-Click

First-Hop Infrastructure​

The actual action links and rendered images lived in a DigitalOcean Spaces bucket:

https://hnbvcwbxbubu.sfo2.digitaloceanspaces.com/1.html#cl/334356_md/1299/15346052/1011/206/22373
https://hnbvcwbxbubu.sfo2.digitaloceanspaces.com/2.html#un/334356_md/1299/15346052/1011/206/22373

The images were hosted from the same bucket:

https://hnbvcwbxbubu.sfo2.digitaloceanspaces.com/1.png
https://hnbvcwbxbubu.sfo2.digitaloceanspaces.com/2.png

The fragments are the useful shape:

#cl/334356_md/1299/15346052/1011/206/22373
#un/334356_md/1299/15346052/1011/206/22373

The cl branch appears to be the click path, while un appears to be the unsubscribe path. Both reuse the same campaign or recipient-looking values.

By the time I checked, every first-stage object returned:

DigitalOcean Spaces XML AccessDenied response for the first-stage HTML object

The screenshot captured:

<Code>AccessDenied</Code>
<Message>Access Denied.</Message>
<Resource>hnbvcwbxbubu/1.html</Resource>

Closing Text Padding​

After the visible HTML, the raw source wanders off into unrelated content. There is an old-looking political gift email thread, a Global Agriculture and Food Security Program thread, FAO/World Bank-looking contacts, and other copied text.

Snippets include:

POTUS/FLOTUS gifts received in Russia
Global Agriculture and Food Security Program
GAFSP Cote d'Ivoire Submission

IOCs​

[email protected]
mail.Calixo.me
hnbvcwbxbubu.sfo2.digitaloceanspaces.com

Observations & Conclusions​

  • The first-hop lure used a DigitalOcean Spaces bucket in sfo2.
  • The click and unsubscribe URLs carried matching fragment-style tracking paths.
  • The duplicate X-Google-Original-From headers, unrelated sog.unc.edu unsubscribe URLs, and grab-bag of bulk-mail platform headers make this look assembled from mismatched template parts
Indicators of Compromise (IOCs)
IOCs (domains, IP addresses, files, hashes, etc.) from this analysis are available on GitHub.
View on GitHub →