Mystery Shopper

Another (hijacked) site set up for fraud


Mystery Shoppers, Inc.
PO Box 50578 • Knoxville, TN 37950
Fake url
http://www.gdmconsultora.com.ar/wp-cont ... cation.htm = 216.59.32.14



Return-path: <[email protected]>
Envelope-to:
Delivery-date: Tue, 01 Oct 2013 02:32:07 -0700
Received: from pearl.garlic.com ([216.139.0.87]:50022 helo=noc-auth1.garlic.com)
by with esmtps (TLSv1:DHE-RSA-AES256-SHA:256)
(Exim 4.80)
(envelope-from <[email protected]>)
id 1VQwJH-0002os-MN
for ; Tue, 01 Oct 2013 02:32:07 -0700
Received: from mail1.dcgcpas.com (unknown [67.50.83.90])
(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
(No client certificate requested)
by noc-auth1.garlic.com (Postfix) with ESMTPSA id DCAF5980DE0;
Tue, 1 Oct 2013 02:28:28 -0700 (PDT)
Message-ID: <9DA0DB44E3204FA98891D783DA4D71D1@ruserver11>
From: =?utf-8?B?TXlzdGVyeSBTaG9wcGVyIEluY8Ku?= <[email protected]>
Subject: Job Opportunity
Date: Tue, 1 Oct 2013 03:25:39 -0600
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_01B0_01CEBE55.E721C250"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.5843
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5579
X-Spam-Status: No, score=5.2
X-Spam-Score: 52
X-Spam-Bar: +++++
X-Ham-Report: Spam detection software, running on the system "", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.

Content preview: Please click here to read about job description www.secretshopper.com
Regards James Smith Please click here to read about job description [...]


Content analysis details: (5.2 points, 7.0 required)

pts rule name description
---- ---------------------- --------------------------------------------------
-0.7 RCVD_IN_DNSWL_LOW RBL: Sender listed at http://www.dnswl.org/, low
trust
[216.139.0.87 listed in list.dnswl.org]
0.0 SPF_FAIL SPF: sender does not match SPF record (fail)
[SPF failed: Please see http://www.openspf.org/Why?s=mfrom;id=i ... roject.com]
1.0 MISSING_HEADERS Missing To: header
0.0 HTML_MESSAGE BODY: HTML included in message
0.8 BAYES_50 BODY: Bayes spam probability is 40 to 60%
[score: 0.5739]
0.6 URIBL_PH_SURBL Contains an URL listed in the PH SURBL blocklist
[URIs: naturalgardencenter.com.br]
3.5 TO_NO_BRKTS_MSFT To: misformatted and supposed Microsoft tool
X-Spam-Flag: NO

This is a multi-part message in MIME format.

------=_NextPart_000_01B0_01CEBE55.E721C250
Content-Type: text/plain;
charset="utf-8"
Content-Transfer-Encoding: quoted-printable

Please click here to read about job description
www.secretshopper.com

Regards
James Smith --