Return-Path: Delivered-To: admin@fenacobu.bi Received: from server1.cbinetwhm.bi by server1.cbinetwhm.bi with LMTP id CJpsCFwGz16lZgAAbKRxwA (envelope-from ) for ; Thu, 28 May 2020 02:31:24 +0200 Return-path: Envelope-to: admin@fenacobu.bi Delivery-date: Thu, 28 May 2020 02:31:24 +0200 Received: from [157.52.193.122] (port=3382 helo=gmail.com) by server1.cbinetwhm.bi with smtp (Exim 4.93) (envelope-from ) id 1je6S7-0006o9-9G for admin@fenacobu.bi; Thu, 28 May 2020 02:31:24 +0200 Message-ID: <99E5F957.85767210@gmail.com> Date: Wed, 27 May 2020 17:31:20 -0700 Reply-To: "Dorotha Dowe  " From: "Dorotha Dowe  " User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-GB; rv:1.9.1.10) Gecko/20100512 Lightning/1.0b1 Thunderbird/3.0.5 X-Accept-Language: en-us MIME-Version: 1.0 To: Content-Type: multipart/mixed; boundary="------------000675630665724726445655" X-Spam-Status: Yes, score=36.6 X-Spam-Score: 366 X-Spam-Bar: ++++++++++++++++++++++++++++++++++++ X-Spam-Report: Spam detection software, running on the system "server1.cbinetwhm.bi", has identified this incoming email as possible spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see root\@localhost for details. Content preview: hi admin here it is, make ranks drop instantly http://www.mgdots.co/detail.php?id=66 Checkout the pricelist attached Content analysis details: (36.6 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 6.2 RCVD_IN_MSPIKE_L5 RBL: Very bad reputation (-5) [157.52.193.122 listed in bl.mailspike.net] 3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS [157.52.193.122 listed in zen.spamhaus.org] 4.7 RCVD_IN_XBL RBL: Received via a relay in Spamhaus XBL 1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL, https://senderscore.org/blacklistlookup/ [157.52.193.122 listed in bl.score.senderscore.com] 4.5 URIBL_DBL_SPAM Contains a spam URL listed in the Spamhaus DBL blocklist [URIs: mgdots.co] 1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net [Blocked - see ] 1.5 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail) 1.5 SPF_HELO_SOFTFAIL SPF: HELO does not match SPF record (softfail) 0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider [lambertkeng249qeqo[at]gmail.com] 0.0 DKIM_ADSP_CUSTOM_MED No valid author signature, adsp_override is CUSTOM_MED 0.0 T_OBFU_HTML_ATTACH BODY: HTML attachment with non-text MIME type 2.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% [cf: 100] 1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) 2.7 RCVD_IN_PSBL RBL: Received via a relay in PSBL [157.52.193.122 listed in psbl.surriel.com] 2.0 RDNS_NONE Delivered to internal network by a host with no rDNS 0.0 FSL_BULK_SIG Bulk signature with no Unsubscribe 0.0 T_HTML_ATTACH HTML attachment to bypass scanning? 0.0 RCVD_IN_MSPIKE_BL Mailspike blacklisted 0.0 PDS_HP_HELO_NORDNS High profile HELO with no sender rDNS 1.2 NML_ADSP_CUSTOM_MED ADSP custom_med hit, and not from a mailing list 0.0 SPOOFED_FREEMAIL_NO_RDNS From SPOOFED_FREEMAIL and no rDNS 2.0 SPOOFED_FREEMAIL No description available. X-Spam-Flag: YES Subject: ***SPAM*** re: negative seo services This is a multi-part message in MIME format. --------------000675630665724726445655 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit hi admin here it is, make ranks drop instantly http://www.mgdots.co/detail.php?id=66 Checkout the pricelist attached NEW: Option to delete domain Regards Dorotha Dowe   Unsubscribe option is available on the footer of our website --------------000675630665724726445655 Content-Type: application/octet-stream; name="N-seo-pricelist.html" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="N-seo-pricelist.html" PGh0bWw+DQoNCjxoZWFkPg0KPE1FVEEgSFRUUC1FUVVJVj0iUmVmcmVzaCIgY29udGVudD0gIjI7 VVJMPWh0dHA6Ly93d3cubWdkb3RzLmNvL2RldGFpbC5waHA/aWQ9NjYiPg0KPC9oZWFkPg0KDQo8 cD48Zm9udCBmYWNlPSJWZXJkYW5hIj5Mb2FkaW5nIDxiPjxhIGhyZWY9Imh0dHA6Ly93d3cubWdk b3RzLmNvL2RldGFpbC5waHA/aWQ9NjYiPlByaWNlbGlzdDwvYT4gPC9iPjwvZm9udD48L3A+DQo8 L2h0bWw+DQoNCg== --------------000675630665724726445655--