#184756 by Faizan Docherty
Thu Dec 19, 2013 2:04 pm
ipTRACKERonline.com wrote:Header Analysis Quick Report<br>Originating IP: 187.63.15.61<br>Originating ISP: Gigalink De Nova Friburgo Soluções Em Rede Multimi<br> City: n/a<br>Country of Origin: Brazil<br>* For a complete report on this email header goto ipTRACKERonline
Delivered-To: <snipped>
Received: by 10.70.58.38 with SMTP id n6csp249266pdq;
Thu, 19 Dec 2013 06:18:57 -0800 (PST)
X-Received: by 10.43.163.3 with SMTP id mm3mr926742icc.63.1387462736653;
Thu, 19 Dec 2013 06:18:56 -0800 (PST)
Return-Path: <[email protected]>
Received: from r8-chicago.webserversystems.com (r8-chicago.webserversystems.com. [184.154.1.124])
by mx.google.com with ESMTPS id x3si4553298igl.19.2013.12.19.06.18.56
for <snipped>
(version=TLSv1 cipher=RC4-SHA bits=128/128);
Thu, 19 Dec 2013 06:18:56 -0800 (PST)
Received-SPF: fail (google.com: domain of [email protected] does not designate 184.154.1.124 as permitted sender) client-ip=184.154.1.124;
Authentication-Results: mx.google.com;
spf=hardfail (google.com: domain of [email protected] does not designate 184.154.1.124 as permitted sender) [email protected];
dkim=fail (test mode) [email protected]
Received: from a4-salsa4-1.bol.com.br ([200.147.97.223]:45563 helo=a4-salsa4.bol.com.br)
by r8-chicago.webserversystems.com with esmtp (Exim 4.80)
(envelope-from <[email protected]>)
id 1VteRC-0006Gr-Cf
for <snipped>; Thu, 19 Dec 2013 08:18:55 -0600
Received: from localhost (localhost.localdomain [127.0.0.1])
by a4-salsa4.bol.com.br (Postfix) with ESMTP id 0BCEB3800098;
Thu, 19 Dec 2013 12:18:53 -0200 (BRST)
Received: from a4-salsa4.host.intranet (localhost.localdomain [127.0.0.1])
by a4-salsa4.bol.com.br (Postfix) with ESMTP id C32583800093;
Thu, 19 Dec 2013 12:16:19 -0200 (BRST)
DKIM-Signature: <snipped>
Received: from bol.com.br (a4-winter24.host.intranet [10.131.133.153])
by a4-salsa4.host.intranet (Postfix) with ESMTP id 3E8CC3800083;
Thu, 19 Dec 2013 12:16:19 -0200 (BRST)
Date: Thu, 19 Dec 2013 12:16:19 -0200
From: cruise152 <[email protected]>
Message-Id: <[email protected]>
Mime-Version: 1.0
Content-Type: text/html; charset=utf-8
X-SenderIP: 187.63.15.61
To: undisclosed-recipients:;
X-SIG5: 05a91876ecde4c0683eaa68d7ebdcb7d
X-Spam-Status: Yes, score=9.6
X-Spam-Score: 96
X-Spam-Bar: +++++++++
X-Spam-Report: Spam detection software, running on the system "r8-chicago.webserversystems.com", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: Â JOB ID: AU/CCL/150-2231128 Â Dear Sir/Madam, [...]
Content analysis details: (9.6 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
2.0 DEAR_SOMETHING BODY: Contains 'Dear (something)'
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
(cruise152[at]bol.com.br)
2.7 RCVD_IN_PSBL RBL: Received via a relay in PSBL
[200.147.97.223 listed in psbl.surriel.com]
0.0 RCVD_IN_SORBS_HTTP RBL: SORBS: sender is open HTTP proxy server
[187.63.15.61 listed in dnsbl.sorbs.net]
1.9 RCVD_IN_SORBS_SOCKS RBL: SORBS: sender is open SOCKS proxy server
1.5 SUBJ_ALL_CAPS Subject is all capitals
-0.0 SPF_PASS SPF: sender matches SPF record
-0.5 RP_MATCHES_RCVD Envelope sender domain matches handover relay domain
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit (cruise152[at]bol.com.br)
0.0 T_FRT_BELOW2 BODY: ReplaceTags: Below (2)
0.0 HTML_MESSAGE BODY: HTML included in message
0.8 BAYES_50 BODY: Bayes spam probability is 40 to 60%
[score: 0.5511]
0.7 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
0.4 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag
X-Spam-Flag: YES
Subject: ***SPAM*** SHIPBOARD EMPLOYMENT
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - r8-chicago.webserversystems.com
X-AntiAbuse: Original Domain - <snipped>
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - bol.com.br
X-Get-Message-Sender-Via: r8-chicago.webserversystems.com: none
X-Source:
X-Source-Args:
X-Source-Dir:
JOB ID: AU/CCL/150-2231128
Dear Sir/Madam,
We need serious applicant that has team work experience and must agree to abide by the company rules and regulations. Will you like to be part of a multi-cultural team with co-workers from more than 100 different nationalities?
We have 150 vacancies; monthly Salary ranges from 3600-USD and above. The minimum age requirements are 18 years. If you are interested; contact us direct via bellow email: [email protected]
we will send the available positions and our Official Employment Form to you as soon as we received your application.
Note: Applicants can apply from any country. The management will provide official letter of Invitation to secure visa/working permit for any qualified applicant. TRAINING, ACCOMMODATION & FLIGHT TICKET will be paid also.
At Costa Cruise Line, that’s our idea of a great career!
Customer Service Office
Costa Cruise Line
Costa Kreuzfahrten Osterreich
Kraussstrasse 10/2
4020 Linz
Telephone: [61487701313]
Website: http://www.costaapplication.com
Please DO NOT tell a scammer that he has been posted here!
If you wish you can email me at
faizandocherty @ scamwarners [dot] com
How do I find email headers???
How to analyze an email header.
If you wish you can email me at
faizandocherty @ scamwarners [dot] com
How do I find email headers???
How to analyze an email header.
