#177264 by buried under 419s
Thu Sep 26, 2013 5:30 am
another fraud that leads to fake site that forwards to
http://eurekabookhouse.com/feeds/application.htm
Return-path: <[email protected]>
Envelope-to:
Delivery-date: Thu, 26 Sep 2013 02:11:15 -0700
Received: from mail.ship.edu ([157.160.249.15]:48995)
by with esmtps (TLSv1:AES128-SHA:128)
(Exim 4.80)
(envelope-from <[email protected]>)
id 1VP7bL-00072d-SY
for ; Thu, 26 Sep 2013 02:11:15 -0700
Received: from s66-76-122-54.helncmta01.hlnaar.lr.sta.suddenlink.net
(66.76.122.54) by mail.ship.edu (192.168.7.51) with Microsoft SMTP Server
(TLS) id 14.3.158.1; Thu, 26 Sep 2013 05:11:05 -0400
Message-ID: <3B0303CD9C2A4755BE5ADA38FF9AE89E@A4HS-HMO>
From: Mystery Shopper Inc <[email protected]>
Subject: JOB OPPORTUNITY
Date: Thu, 26 Sep 2013 04:04:11 -0500
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_0289_01CEBA6D.74F97470"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Windows Mail 6.0.6001.18000
X-MimeOLE: Produced By Microsoft MimeOLE V6.0.6001.18049
To: Undisclosed recipients:;
X-Originating-IP: [66.76.122.54]
X-Spam-Status: No, score=6.3
X-Spam-Score: 63
X-Spam-Bar: ++++++
X-Ham-Report: Spam detection software, running on the system "", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: Dear Shopper. Please click here to read about job description
http://www.secretshopper.com [...]
Content analysis details: (6.3 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 SUBJ_ALL_CAPS Subject is all capitals
-0.0 RP_MATCHES_RCVD Envelope sender domain matches handover relay domain
0.0 HTML_MESSAGE BODY: HTML included in message
0.8 BAYES_50 BODY: Bayes spam probability is 40 to 60%
[score: 0.5105]
0.8 HTML_TAG_BALANCE_HEAD BODY: HTML has unbalanced "head" tags
3.2 AXB_XMAILER_MIMEOLE_OL_7EB15 AXB_XMAILER_MIMEOLE_OL_7EB15
X-Spam-Flag: NO
------=_NextPart_000_0289_01CEBA6D.74F97470
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Dear Shopper.
Please click here to read about job description
http://www.secretshopper.com
Regards
Secret Shopper
------=_NextPart_000_0289_01CEBA6D.74F97470
Content-Type: text/html; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META content=3D"text/html; charset=3Dutf-8" http-equiv=3DContent-Type>
<META name=3DGENERATOR content=3D"MSHTML 8.00.6001.18854">
<BODY><PRE><FONT size=3D4>Dear Shopper.
Please click here to read about job description
</FONT><A title=3D"" onclick=3DonClickUnsafeLink(event); href=3D"http://www.mim.org.my//images/stories/fruit/export.php" target=3D_blank><FONT siz=
e=3D4>www.secretshopper.com</FONT></A>
<FONT size=3D4>Regards
Secret Shopper</FONT></PRE></BODY></HTML>
------=_NextPart_000_0289_01CEBA6D.74F97470--
http://eurekabookhouse.com/feeds/application.htm
Return-path: <[email protected]>
Envelope-to:
Delivery-date: Thu, 26 Sep 2013 02:11:15 -0700
Received: from mail.ship.edu ([157.160.249.15]:48995)
by with esmtps (TLSv1:AES128-SHA:128)
(Exim 4.80)
(envelope-from <[email protected]>)
id 1VP7bL-00072d-SY
for ; Thu, 26 Sep 2013 02:11:15 -0700
Received: from s66-76-122-54.helncmta01.hlnaar.lr.sta.suddenlink.net
(66.76.122.54) by mail.ship.edu (192.168.7.51) with Microsoft SMTP Server
(TLS) id 14.3.158.1; Thu, 26 Sep 2013 05:11:05 -0400
Message-ID: <3B0303CD9C2A4755BE5ADA38FF9AE89E@A4HS-HMO>
From: Mystery Shopper Inc <[email protected]>
Subject: JOB OPPORTUNITY
Date: Thu, 26 Sep 2013 04:04:11 -0500
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_0289_01CEBA6D.74F97470"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Windows Mail 6.0.6001.18000
X-MimeOLE: Produced By Microsoft MimeOLE V6.0.6001.18049
To: Undisclosed recipients:;
X-Originating-IP: [66.76.122.54]
X-Spam-Status: No, score=6.3
X-Spam-Score: 63
X-Spam-Bar: ++++++
X-Ham-Report: Spam detection software, running on the system "", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: Dear Shopper. Please click here to read about job description
http://www.secretshopper.com [...]
Content analysis details: (6.3 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 SUBJ_ALL_CAPS Subject is all capitals
-0.0 RP_MATCHES_RCVD Envelope sender domain matches handover relay domain
0.0 HTML_MESSAGE BODY: HTML included in message
0.8 BAYES_50 BODY: Bayes spam probability is 40 to 60%
[score: 0.5105]
0.8 HTML_TAG_BALANCE_HEAD BODY: HTML has unbalanced "head" tags
3.2 AXB_XMAILER_MIMEOLE_OL_7EB15 AXB_XMAILER_MIMEOLE_OL_7EB15
X-Spam-Flag: NO
------=_NextPart_000_0289_01CEBA6D.74F97470
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Dear Shopper.
Please click here to read about job description
http://www.secretshopper.com
Regards
Secret Shopper
------=_NextPart_000_0289_01CEBA6D.74F97470
Content-Type: text/html; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META content=3D"text/html; charset=3Dutf-8" http-equiv=3DContent-Type>
<META name=3DGENERATOR content=3D"MSHTML 8.00.6001.18854">
<BODY><PRE><FONT size=3D4>Dear Shopper.
Please click here to read about job description
</FONT><A title=3D"" onclick=3DonClickUnsafeLink(event); href=3D"http://www.mim.org.my//images/stories/fruit/export.php" target=3D_blank><FONT siz=
e=3D4>www.secretshopper.com</FONT></A>
<FONT size=3D4>Regards
Secret Shopper</FONT></PRE></BODY></HTML>
------=_NextPart_000_0289_01CEBA6D.74F97470--
Questions about scams? fraudatiocruor @ gmail.com to contact remove spaces