[email protected] fed ex

[buried under 419s]

Return-path: <[email protected]>
Envelope-to:
Delivery-date: Sat, 10 Jun 2017 08:56:58 -0700
Received: from mxmailserv.tmwnet.com.br ([177.38.124.2]:47452)
by with esmtp (Exim 4.89)
(envelope-from <[email protected]>)
id 1dJikv-0006Su-Sp
for ; Sat, 10 Jun 2017 08:56:58 -0700
Received: from localhost (localhost.domain [127.0.0.1])
by mxmailserv.tmwnet.com.br (Postfix) with ESMTP id 75968973C4;
Sat, 10 Jun 2017 10:43:40 -0300 (BRT)
Received: from mxmailserv.tmwnet.com.br ([127.0.0.1])
by localhost (mxmailserv.tmwnet.com.br [127.0.0.1]) (amavisd-new, port 10032)
with ESMTP id YLM8-g8O6tbK; Sat, 10 Jun 2017 10:43:37 -0300 (BRT)
Received: from localhost (localhost.domain [127.0.0.1])
by mxmailserv.tmwnet.com.br (Postfix) with ESMTP id 95791A5D90;
Sat, 10 Jun 2017 06:27:16 -0300 (BRT)
X-Virus-Scanned: amavisd-new at mxmailserv.tmwnet.com.br
Received: from mxmailserv.tmwnet.com.br ([127.0.0.1])
by localhost (mxmailserv.tmwnet.com.br [127.0.0.1]) (amavisd-new, port 10026)
with ESMTP id 4EkzQaLKu3Fs; Sat, 10 Jun 2017 06:27:14 -0300 (BRT)
Received: from DESKTOP-LT9OS0T.dlinkrouter (unknown [86.99.110.96])
by mxmailserv.tmwnet.com.br (Postfix) with ESMTPSA id 13C1797BB9;
Sat, 10 Jun 2017 02:52:08 -0300 (BRT)
Content-Type: multipart/mixed; boundary="===============0982957161=="
MIME-Version: 1.0
To: Recipients <[email protected]>
From: "FedEx" <[email protected]>
Date: Sat, 10 Jun 2017 09:56:20 +0400
Reply-To: [email protected]
X-Antivirus: Avast (VPS 170609-4, 06/09/2017), Outbound message
X-Antivirus-Status: Clean
Message-Id: <[email protected]>
X-Spam-Status: Yes, score=9.2
X-Spam-Score: 92
X-Spam-Bar: +++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.

Content preview: We have a winning package in your name to be delivered to
you. This is not a virus attached message okay. The file attached is safe
and is about your winning package. Open the file attached for more details
regarding your delivery. [...]

Content analysis details: (9.2 points, 7.0 required)

pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[177.38.124.2 listed in list.dnswl.org]
4.4 RCVD_IN_BRBL_LASTEXT RBL: No description available.
[177.38.124.2 listed in bb.barracudacentral.org]
-0.0 SPF_PASS SPF: sender matches SPF record
0.0 HTML_MESSAGE BODY: HTML included in message
1.1 HTML_IMAGE_ONLY_16 BODY: HTML: images with 1200-1600 bytes of words
1.5 BAYES_60 BODY: Bayes spam probability is 60 to 80%
[score: 0.7470]
0.0 HTML_SHORT_LINK_IMG_2 HTML is very short with a linked image
0.0 LOTS_OF_MONEY Huge... sums of money
2.1 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
0.0 T_WON_MONEY_ATTACH You won lots of money! See attachment.
0.0 T_REMOTE_IMAGE Message contains an external image
X-Spam-Flag: YES
Subject: ***SPAM*** Your Package of $6.480,000.00USD


We have a winning package in your name to be delivered to you. This is not a virus
attached message okay. The file attached is safe and is about your winning package.
Open the file attached for more details regarding your delivery.