diff --git a/content/spam/2023-12-27-one-way-to-inspect-possible-spam/index.md b/content/spam/2023-12-27-one-way-to-inspect-possible-spam/index.md
new file mode 100644
index 0000000..2c35c82
--- /dev/null
+++ b/content/spam/2023-12-27-one-way-to-inspect-possible-spam/index.md
@@ -0,0 +1,47 @@
+---
+title: "One Way to Inspect Possible Spam"
+date: 2023-12-25T07:46:21+01:00
+draft: true
+description: ""
+---
+
+image of empty email
+
+look into attachments list
+
+view text part -> empty
+view html part with TYPE not in browser (source code inspect)
+
+search for "href"...
+
+~~~html {hl_lines=12}
+<table class="" style="padding: 0PX;background: rgb(77, 20, 140) none repeat scroll 0% center;-moz-background-clip: -moz-initial;-moz-background-origin:
+-moz-initial;-moz-background-inline-policy: -moz-initial;font-size: 11px;font-family: -apple-system,BlinkMacSystemFont,;WIDTH: 198PX;MARGIN-LEFT: 18PX;"
+helvetica="" neue","segoe="" ui",arial,sans-serif,"apple="" color="" emoji","segoe="" ui="" symbol";="" width:="" 272px;="" border-collapse:="" separate;=""
+table-layout:="" fixed;="" font-weight:="" 400;="" line-height:="" normal;="" margin-left:="" 21px;"="" border="0" cellpadding="0" cellspacing="0"
+width="100%">
+<tbody>
+<tr class="" style="font-family: Barlow,Montserrat," arial="" important";="" width:="" 560px;="" min-height:="" 40px;"="" height="40">
+
+<td class="" id="yiv8547566208center-td" style="background: rgb(77, 20, 140) none repeat scroll 0% 50%;-moz-background-clip:
+-moz-initial;-moz-background-origin: -moz-initial;-moz-background-inline-policy: -moz-initial;font-size: 10px;font-family:
+Montserrat,Arial,Helvetica,sans-serif;width: 50PX;font-weight: normal;color: white;text-align: center;min-height: 40px;" height="40" width="70%"><a
+data-disabled="true" target="_blank" href="https://t.ly/97rBk" disabled="" aria-disabled="true" style="font-size: 16px; font-family:
+Montserrat,Arial,Helvetica,sans-serif; font-weight: bold; color: white; display: block;">Versand
+des Paket</a></td>
+</tr>
+</tbody>
+</table>
+~~~
+
+sometimes they link direclty, sometimes they use shorteners
+
+expand link if shortener used
+
+search for "expand short url"
+
+→ image of short url expander
+
+most deliver a preview already... mostly resolves to strange URLs
+
+