From Thu Nov 21 21:31:02 2019 Received: from [] (port=1433 by with smtp (Exim 4.92) (envelope-from ) id 1iXt6O-0005DL-Nq for; Thu, 21 Nov 2019 21:31:02 +0100 Received: from unknown (HELO (Thu, 21 Nov 2019 09:26:41 -0300) by with LOCAL; Thu, 21 Nov 2019 09:26:41 -0300 Message-ID: <> Date: Thu, 21 Nov 2019 09:22:46 -0300 From: "Greyson" User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-GB; rv: Gecko/20080421 Thunderbird/ MIME-Version: 1.0 To: Content-Type: multipart/mixed; boundary="------------016781204422200415517311" X-Spam-Status: Yes, score=38.9 X-Spam-Score: 389 X-Spam-Bar: ++++++++++++++++++++++++++++++++++++++ X-Spam-Report: Spam detection software, running on the system "", has identified this incoming email as possible spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see root\@localhost for details. Content preview: hi here it is Pricelist attached Content analysis details: (38.9 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See for more information. [URIs:] 4.5 URIBL_DBL_SPAM Contains a spam URL listed in the Spamhaus DBL blocklist [URIs:] 2.7 RCVD_IN_PSBL RBL: Received via a relay in PSBL [ listed in] 1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in [Blocked - see ] 4.7 RCVD_IN_XBL RBL: Received via a relay in Spamhaus XBL [ listed in] 2.6 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL 0.0 RCVD_IN_DNSWL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to DNSWL was blocked. See for more information. [ listed in] 1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL, [ listed in] 6.2 RCVD_IN_MSPIKE_L5 RBL: Very bad reputation (-5) [ listed in] 1.8 FSL_HELO_FAKE No description available. 0.0 DKIM_ADSP_CUSTOM_MED No valid author signature, adsp_override is CUSTOM_MED 0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider (janiceking866asmei[at] 1.5 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail) 1.5 SPF_HELO_SOFTFAIL SPF: HELO does not match SPF record (softfail) 0.0 T_OBFU_HTML_ATTACH BODY: HTML attachment with non-text MIME type 1.7 RAZOR2_CHECK Listed in Razor2 ( 2.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% [cf: 100] 0.8 CPANEL_LOTS_OF_EMPTY_LINE RAW: Spam that has large block of empty lines 0.0 RCVD_IN_MSPIKE_BL Mailspike blacklisted 2.0 RDNS_NONE Delivered to internal network by a host with no rDNS 0.0 T_HTML_ATTACH HTML attachment to bypass scanning? 0.0 PDS_HP_HELO_NORDNS High profile HELO with no sender rDNS 1.2 NML_ADSP_CUSTOM_MED ADSP custom_med hit, and not from a mailing list 0.7 SPOOFED_FREEMAIL_NO_RDNS From SPOOFED_FREEMAIL and no rDNS 2.0 SPOOFED_FREEMAIL No description available. X-Spam-Flag: YES Subject: ***SPAM*** fw: premium organic traffic This is a multi-part message in MIME format. --------------016781204422200415517311 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit hi here it is Pricelist attached Thu, 21 Nov 2019 09:22:46 -0300, tr, 19:37 admin raše: Ok, send me the link for&$ the unique visits for my website offer. --------------016781204422200415517311 Content-Type: application/octet-stream; name="BusinessTraffic-Pricelist.html" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="BusinessTraffic-Pricelist.html" PGh0bWw+DQoNCjxoZWFkPg0KPE1FVEEgSFRUUC1FUVVJVj0iUmVmcmVzaCIgY29udGVudD0gIjI7 VVJMPWh0dHA6Ly93d3cuYmFzZWRidXNpbmVzc3RyYWZmaWMuY28vb3JkZXJwYWdlLyI+DQo8L2hl YWQ+DQoNCjxwPjxmb250IGZhY2U9IlZlcmRhbmEiPkxvYWRpbmcgPGI+PGEgaHJlZj0iaHR0cDov L3d3dy5iYXNlZGJ1c2luZXNzdHJhZmZpYy5jby9vcmRlcnBhZ2UvIj5QcmljZWxpc3Q8L2E+IDwv Yj48L2ZvbnQ+PC9wPg0KPC9odG1sPg0KDQo= --------------016781204422200415517311--