Scammed.by Scam email RSShttp://scammed.byLive feed of scam emailsWhat happens if your heating shuts down?http://scammed.by/scam.php?id=208187 What happens if your heating shuts down? The brains of the priest that Tarzan had thrown at the head of Lu-don had been dashed out against the temple wall while the high priest himself had escaped with only a few bruises, sustained in his fall to the hard pavement. Quickly scrambling to his feet he looked around in fear, in terror and finally in bewilderment, for he had not been a witness to the ape-man's escape. "Seize him," he cried; "seize the blasphemer," and he continued to look around in search of his victim with such a ridiculous expression of bewilderment that more than a single warrior was compelled to hide his smiles beneath his palm. SpamAssassin Report (spam score: 5.9) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [74.125.82.42 listed in list.dnswl.org] 3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS [168.139.33.19 listed in zen.spamhaus.org] -0.0 SPF_PASS SPF: sender matches SPF record 0.7 HTML_IMAGE_ONLY_28 BODY: HTML: images with 2400-2800 bytes of words 0.0 HTML_MESSAGE BODY: HTML included in message 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 0.0 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars 0.5 RCVD_IN_SORBS_SPAM RBL: SORBS: sender is a spam source [74.125.82.42 listed in dnsbl.sorbs.net] 0.0 T_HTML_TAG_BALANCE_CENTER Malformatted HTML 0.0 T_REMOTE_IMAGE Message contains an external image 2016-12-10 10:06:44What happens if your heating shuts down?http://scammed.by/scam.php?id=208186 What happens if your heating shuts down? And thus it was that Achmet Zek, the Arab, found him. Achmet's followers were for running a spear through the body of their hereditary enemy; but Achmet would have it otherwise. First he would question the Belgian. It were easier to question a man first and kill him afterward, than kill him first and then question him. SpamAssassin Report (spam score: 1.7) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address -0.7 RCVD_IN_DNSWL_LOW RBL: Sender listed at http://www.dnswl.org/, low trust [209.85.223.174 listed in list.dnswl.org] -0.0 SPF_PASS SPF: sender matches SPF record 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: nehoonge.xyz] 1.3 HTML_IMAGE_ONLY_24 BODY: HTML: images with 2000-2400 bytes of words 0.0 HTML_MESSAGE BODY: HTML included in message 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 0.0 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars 0.0 T_HTML_TAG_BALANCE_CENTER Malformatted HTML 0.0 T_REMOTE_IMAGE Message contains an external image 2016-12-10 09:52:08Mailbox Termination Noticehttp://scammed.by/scam.php?id=208185 Hi soludopublishing@gmail.com, We detected a problem with your email address, Your Email account will be close if you fail to verify. Please use this link to complete verification. Have a great day! E-Mail Team Replies sent to this email address cannot be answered. SpamAssassin Report (spam score: 9.4) pts rule name description ---- ---------------------- -------------------------------------------------- 0.5 RCVD_IN_SORBS_SPAM RBL: SORBS: sender is a spam source [209.85.223.169 listed in dnsbl.sorbs.net] 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address -0.7 RCVD_IN_DNSWL_LOW RBL: Sender listed at http://www.dnswl.org/, low trust [209.85.223.169 listed in list.dnswl.org] 2.6 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL [37.203.214.180 listed in zen.spamhaus.org] 3.6 RCVD_IN_SORBS_WEB RBL: SORBS: sender is an abusable web server [37.203.214.180 listed in dnsbl.sorbs.net] -0.0 SPF_PASS SPF: sender matches SPF record 0.0 MSGID_FROM_MTA_HEADER Message-Id was added by a relay 0.0 TVD_SPACE_RATIO TVD_SPACE_RATIO 0.9 MIME_NO_TEXT No (properly identified) text body parts 2.5 TVD_SPACE_RATIO_MINFP Space ratio 2016-12-10 09:32:24WITH MASSIVE RESPECThttp://scammed.by/scam.php?id=208183 Hello Dear I caught interest in your profile and I decided to contact you and I will appreciate if you give my mail the due attention and consideration it deserves. I am Barrister Benjamin Lawson a lawyer in Port Novo Benin Republic. Mr George shachak, a gold merchant, who was my client died as a result of Ebola Virus. Now I will like to present you as the next of kin to Mr George Bank so that the money left behind by Mr. George can be transfer to your account through my help. The money value of 10.5 Million was deposited in a bank here by Mr. George before his Death on 23 June 2014 Please send me your email address through(benjaminlawson919@gmail.com) so that i can send more details to you. Best regards, Barrister Benjamin Lawson SpamAssassin Report (spam score: 5.5) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address 0.6 FROM_STARTS_WITH_NUMS From: starts with several numbers -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [209.85.210.170 listed in list.dnswl.org] 0.5 RCVD_IN_SORBS_SPAM RBL: SORBS: sender is a spam source [209.85.223.171 listed in dnsbl.sorbs.net] 1.6 SUBJ_ALL_CAPS Subject is all capitals -0.0 SPF_PASS SPF: sender matches SPF record 1.9 REPLYTO_WITHOUT_TO_CC REPLYTO_WITHOUT_TO_CC 0.9 MIME_NO_TEXT No (properly identified) text body parts 2016-12-10 09:28:38WITH MASSIVE RESPECThttp://scammed.by/scam.php?id=208184 Hello Dear I caught interest in your profile and I decided to contact you and I will appreciate if you give my mail the due attention and consideration it deserves. I am Barrister Benjamin Lawson a lawyer in Port Novo Benin Republic. Mr George shachak, a gold merchant, who was my client died as a result of Ebola Virus. Now I will like to present you as the next of kin to Mr George Bank so that the money left behind by Mr. George can be transfer to your account through my help. The money value of 10.5 Million was deposited in a bank here by Mr. George before his Death on 23 June 2014 Please send me your email address through(benjaminlawson919@gmail.com) so that i can send more details to you. Best regards, Barrister Benjamin Lawson SpamAssassin Report (spam score: 5.5) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address 0.6 FROM_STARTS_WITH_NUMS From: starts with several numbers 0.5 RCVD_IN_SORBS_SPAM RBL: SORBS: sender is a spam source [209.85.223.181 listed in dnsbl.sorbs.net] -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [209.85.223.179 listed in list.dnswl.org] 1.6 SUBJ_ALL_CAPS Subject is all capitals -0.0 SPF_PASS SPF: sender matches SPF record 1.9 REPLYTO_WITHOUT_TO_CC REPLYTO_WITHOUT_TO_CC 0.9 MIME_NO_TEXT No (properly identified) text body parts 2016-12-10 09:28:38Mailbox Termination Noticehttp://scammed.by/scam.php?id=208182 Hi soludopublishing@gmail.com, We detected a problem with your email address, Your Email account will be close if you fail to verify. Please use this link to complete verification. Have a great day! E-Mail Team Replies sent to this email address cannot be answered. SpamAssassin Report (spam score: 10.1) pts rule name description ---- ---------------------- -------------------------------------------------- -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [74.125.82.44 listed in list.dnswl.org] 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address 2.6 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL [37.203.214.180 listed in zen.spamhaus.org] 0.5 RCVD_IN_SORBS_SPAM RBL: SORBS: sender is a spam source [209.85.223.169 listed in dnsbl.sorbs.net] 3.6 RCVD_IN_SORBS_WEB RBL: SORBS: sender is an abusable web server [37.203.214.180 listed in dnsbl.sorbs.net] -0.0 SPF_PASS SPF: sender matches SPF record 0.0 MSGID_FROM_MTA_HEADER Message-Id was added by a relay 0.0 TVD_SPACE_RATIO TVD_SPACE_RATIO 0.9 MIME_NO_TEXT No (properly identified) text body parts 2.5 TVD_SPACE_RATIO_MINFP Space ratio 2016-12-10 09:28:25BMW LOTTERY DEPARTMENThttp://scammed.by/scam.php?id=208181 BMW LOTTERY DEPARTMENT 5070 WILSHIRE BLVD LOS ANGELES. CA 90036 UNITED STATES OF AMERICA. NOTE: If you received this message in your SPAM/JUNK folder, that is because of the restrictions implemented by your Internet Service Provider, we (BMW) urge you to treat it genuinely. Dear Winner This is to inform you that you have been selected for a prize of a brand new 2015/2016 Model BMW 7 Series Car and a Cheque of $1,500,000.00 USD from the international balloting programs held on the 2nd section in the UNITED STATE OF AMERICA. Description of prize vehicle; Model: 760Li Color (exterior): Metallic Silver Mileage: 5 Transmission: Automatic 6 Speed Options: Cold weather package, premium package, fold down rear seats w/ski bag, am fm stereo with single in dash compact disc player. The selection process was carried out through random selection in our computerized email selection system (ESS) from a database of over 250,000 email addresses drawn from all the continents of the world which you were selected. The BMW Lottery is approved by the British Gaming Board and also licensed by the International Association of Gaming Regulators (IAGR).To begin the processing of your prize you are to contact our fiduciary claims department for more information as regards procedures to claim your prize. Fiduciary Agent: Mr.Steve Mark Contact Email: stevemark228@gmail.com Hotline: +1 510-417-3904 (Text only) Contact him by providing him with your secret pin code Number BMW:255175HGDY03/23.As the subject of your email for swift response You are also advised to provide him with the under listed information as soon as possible: 1. Name In Full : 2. Residential Address : 3. Nationality : 4. Age : 5. Sex 6. Occupation : 7. Direct Phone : 8. Present Country : 9. Email address : 10. pin code Number BMW:255175HGDY03/23 Note that you have to send email to Mr.Steve Mark or call +1 510-417-3904.You are to provide him with the above listed details as soon as possible so he can begin with the processing of your prize winnings. Ms Englert. --------------------- THE DIRECTOR PROMOTIONS BMW LOTTERY DEPARTMENT UNITED STATES OF AMERICA SpamAssassin Report (spam score: 19.3) pts rule name description ---- ---------------------- -------------------------------------------------- -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [209.85.223.170 listed in list.dnswl.org] 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: altfm.ru] 3.1 DEAR_WINNER BODY: Spam with generic salutation of "dear winner" 0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address 0.0 NSL_RCVD_HELO_USER Received from HELO User 0.5 RCVD_IN_SORBS_SPAM RBL: SORBS: sender is a spam source [212.74.212.59 listed in dnsbl.sorbs.net] 3.6 RCVD_IN_SORBS_WEB RBL: SORBS: sender is an abusable web server [184.187.11.234 listed in dnsbl.sorbs.net] 1.6 SUBJ_ALL_CAPS Subject is all capitals -0.0 SPF_PASS SPF: sender matches SPF record 1.2 MISSING_HEADERS Missing To: header 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid 0.0 BIGNUM_EMAILS Lots of email addresses/leads 0.0 LOTS_OF_MONEY Huge... sums of money 0.0 FROM_MISSP_XPRIO Misspaced FROM + X-Priority 1.9 REPLYTO_WITHOUT_TO_CC REPLYTO_WITHOUT_TO_CC 0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool 1.0 HK_LOTTO HK_LOTTO 0.0 FSL_NEW_HELO_USER Spam's using Helo and User 0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait 0.0 MSGID_FROM_MTA_HEADER Message-Id was added by a relay 3.4 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE 0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid 0.0 MONEY_FROM_MISSP Lots of money and misspaced From 0.0 TO_NO_BRKTS_FROM_MSSP Multiple header formatting problems 0.0 FROM_MISSPACED From: missing whitespace 2.8 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook 0.0 LOTTO_DEPT Claims Department 0.0 ADVANCE_FEE_4_NEW_MONEY Advance Fee fraud and lots of money 0.0 MONEY_FRAUD_5 Lots of money and many fraud phrases 2016-12-10 08:55:19Dearest One http://scammed.by/scam.php?id=208179 Dearest One. You will be surprise to receive this mail from a total stranger like me,Anyway, i got your contact through internet and decided to approach you for assistance permit me to inform you about this proposal I am daughter of late Diamond dealers John in Abidjan Cote D'Ivoire in west Africa he was also one of the paramount chiefs in my town before He was murdered in cold blood early last year alongside with my mother by the Rebels of R.U.F when they invaded the town. Our late father John died and left us and our mother Gloria and my younger brother Frank John my name is Alice John. I am 21 years old why my younger brother Frank is 18 years old.My late father John owns many companies before he died which he left for my mother Mr's Gloria John. Within a year of my fathers death, my Mother Mr's. Gloria John was killed by Rebels of R.U.F, after my mother was killed my fathers lawyer called I and my younger brother and hand over my late fathers documents to us. after my fathers lawyer have handed over the documents to me, my uncle started demanding for the documents of my late fathers wealth.I now called my fathers lawyer, he came and told my uncle that my father made a will that all his properties belongs to his children. After my fathers lawyer have made that statement my uncle started fighting against us to an extend he went and arranged for hired killers to kill I and my younger brother. The first time they came to our home when I wasn't around, my younger brother Frank was shot and two of our security men was killed also before the police men came, they had escaped, that made us to park out of the compound we thought it will be over that way but it continue happening, that makes us to stop going to school and we moved out from our country to Burkina Faso. Because we are afraid let something not happen to us in school premises. hat is the reason why we contacted you as an honest person so that you can help us in transferring my late fathers money into your bank account. The said fund is $20.5 Million Dollars been deposited into one of the banks in Burkina Faso west Africa. I will offer 20% of the total amount to you for your help in transferring of this fund successfully to your account, and after transferring the money we can come over to your country and continue our education i will give you more details if you wish to assist us. Thanks Alice John. SpamAssassin Report (spam score: 9.6) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: old.my] 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [209.85.223.177 listed in list.dnswl.org] 0.5 RCVD_IN_SORBS_SPAM RBL: SORBS: sender is a spam source [209.85.223.177 listed in dnsbl.sorbs.net] 0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider (williamstracy058[at]gmail.com) 0.0 DKIM_ADSP_CUSTOM_MED No valid author signature, adsp_override is CUSTOM_MED -0.0 SPF_PASS SPF: sender matches SPF record 1.2 MISSING_HEADERS Missing To: header 3.6 RCVD_IN_SORBS_WEB RBL: SORBS: sender is an abusable web server [74.125.82.52 listed in dnsbl.sorbs.net] 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid 0.0 LOTS_OF_MONEY Huge... sums of money 1.9 REPLYTO_WITHOUT_TO_CC REPLYTO_WITHOUT_TO_CC 0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid 1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different freemails 1.2 NML_ADSP_CUSTOM_MED ADSP custom_med hit, and not from a mailing list 0.0 T_MONEY_PERCENT X% of a lot of money for you 0.0 MONEY_FRAUD_8 Lots of money and very many fraud phrases 0.0 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money 2016-12-10 07:33:32Dearest One http://scammed.by/scam.php?id=208180 Dearest One. You will be surprise to receive this mail from a total stranger like me,Anyway, i got your contact through internet and decided to approach you for assistance permit me to inform you about this proposal I am daughter of late Diamond dealers John in Abidjan Cote D'Ivoire in west Africa he was also one of the paramount chiefs in my town before He was murdered in cold blood early last year alongside with my mother by the Rebels of R.U.F when they invaded the town. Our late father John died and left us and our mother Gloria and my younger brother Frank John my name is Alice John. I am 21 years old why my younger brother Frank is 18 years old.My late father John owns many companies before he died which he left for my mother Mr's Gloria John. Within a year of my fathers death, my Mother Mr's. Gloria John was killed by Rebels of R.U.F, after my mother was killed my fathers lawyer called I and my younger brother and hand over my late fathers documents to us. after my fathers lawyer have handed over the documents to me, my uncle started demanding for the documents of my late fathers wealth.I now called my fathers lawyer, he came and told my uncle that my father made a will that all his properties belongs to his children. After my fathers lawyer have made that statement my uncle started fighting against us to an extend he went and arranged for hired killers to kill I and my younger brother. The first time they came to our home when I wasn't around, my younger brother Frank was shot and two of our security men was killed also before the police men came, they had escaped, that made us to park out of the compound we thought it will be over that way but it continue happening, that makes us to stop going to school and we moved out from our country to Burkina Faso. Because we are afraid let something not happen to us in school premises. hat is the reason why we contacted you as an honest person so that you can help us in transferring my late fathers money into your bank account. The said fund is $20.5 Million Dollars been deposited into one of the banks in Burkina Faso west Africa. I will offer 20% of the total amount to you for your help in transferring of this fund successfully to your account, and after transferring the money we can come over to your country and continue our education i will give you more details if you wish to assist us. Thanks Alice John. SpamAssassin Report (spam score: 9.1) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address 0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider (williamstracy058[at]gmail.com) -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [74.125.82.53 listed in list.dnswl.org] 0.0 DKIM_ADSP_CUSTOM_MED No valid author signature, adsp_override is CUSTOM_MED -0.0 SPF_PASS SPF: sender matches SPF record 1.2 MISSING_HEADERS Missing To: header 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: old.my] 3.6 RCVD_IN_SORBS_WEB RBL: SORBS: sender is an abusable web server [74.125.82.52 listed in dnsbl.sorbs.net] 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid 0.0 LOTS_OF_MONEY Huge... sums of money 1.9 REPLYTO_WITHOUT_TO_CC REPLYTO_WITHOUT_TO_CC 0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid 1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different freemails 1.2 NML_ADSP_CUSTOM_MED ADSP custom_med hit, and not from a mailing list 0.0 T_MONEY_PERCENT X% of a lot of money for you 0.0 MONEY_FRAUD_8 Lots of money and very many fraud phrases 0.0 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money 2016-12-10 07:33:32Walmart Order: 3918 for CustomerID mugu recycling inc Fri Confirm Now Pickup Todayhttp://scammed.by/scam.php?id=208178 You've_received_$1OO_WaImart_GlFT_Card_Set_To_Expire_On_.... cassata genuflected Reserve Bank of India (RBI) eulogistically has asked banks to keep all incremental deposits boyhood garnered between September 16 and November apposing 11 with the central bank as discerning it seeks to absorb the avalanche infralapsarian of liquidity in the banking sector since adaptation the government arvo Manohar Parrikar today claimed that flicker due to the Centre's demonetisation move, the rate of bulgy crime in Mumbai, including contract killings, murders, extortion actualized and drug trafficking, has come down drastically. Former affirms President Fidel Castro, who led a rebel irreconciliable army to improbable victory in Cuba, embraced Latinise Soviet-style communism and defied the aerogene power of ten US Presidents during his half century dichondra rule, has died at age 90. SpamAssassin Report (spam score: 4.3) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: cu.cc] 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [74.125.82.43 listed in list.dnswl.org] 2.6 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL [116.144.16.44 listed in zen.spamhaus.org] 0.5 RCVD_IN_SORBS_SPAM RBL: SORBS: sender is a spam source [209.85.223.173 listed in dnsbl.sorbs.net] -0.0 SPF_PASS SPF: sender matches SPF record 0.0 HTML_MESSAGE BODY: HTML included in message 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 0.0 AC_BR_BONANZA RAW: Too many newlines in a row... spammy template 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid 0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid 0.0 T_REMOTE_IMAGE Message contains an external image 2016-12-10 06:57:46Walmart Order: 3918 for CustomerID mugu recycling inc Fri Confirm Now Pickup Todayhttp://scammed.by/scam.php?id=208176 You've_received_$1OO_WaImart_GlFT_Card_Set_To_Expire_On_.... cassata genuflected Reserve Bank of India (RBI) eulogistically has asked banks to keep all incremental deposits boyhood garnered between September 16 and November apposing 11 with the central bank as discerning it seeks to absorb the avalanche infralapsarian of liquidity in the banking sector since adaptation the government arvo Manohar Parrikar today claimed that flicker due to the Centre's demonetisation move, the rate of bulgy crime in Mumbai, including contract killings, murders, extortion actualized and drug trafficking, has come down drastically. Former affirms President Fidel Castro, who led a rebel irreconciliable army to improbable victory in Cuba, embraced Latinise Soviet-style communism and defied the aerogene power of ten US Presidents during his half century dichondra rule, has died at age 90. SpamAssassin Report (spam score: 4.3) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: cu.cc] 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address 0.5 RCVD_IN_SORBS_SPAM RBL: SORBS: sender is a spam source [209.85.223.177 listed in dnsbl.sorbs.net] -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [209.85.223.177 listed in list.dnswl.org] 2.6 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL [116.144.16.44 listed in zen.spamhaus.org] -0.0 SPF_PASS SPF: sender matches SPF record 0.0 HTML_MESSAGE BODY: HTML included in message 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 0.0 AC_BR_BONANZA RAW: Too many newlines in a row... spammy template 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid 0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid 0.0 T_REMOTE_IMAGE Message contains an external image 2016-12-10 06:57:45Attn: Beneficiaryhttp://scammed.by/scam.php?id=208177 BANK OF AMERICAN. 100 NORTH TRYON ST CHARLOTTE, NORTH CAROLINA. FROM THE DESK OF: MR. BRIAN THOMAS MOYNIHAN PRESIDENT AND CEO BANK OF AMERICA CONTACT LINK: BANK OF AMERICA EMAIL: infobankamericapayment@gmail.com http://www.bankofamerica.com ATTENTION: FUND BENEFICIARY , We wish to inform you that the board of trustees and management of Bank of America has finalized and have been given an Immediate transfer order by the Us Department of the Treasury in conjunction with the United Nations and our current President Barrack Obama, to transfer your overdue fund to your bank account, the approved sum of USD$10,000.000.00 (Ten Million United States Dollars Only) by this following means of choice. The World Bank Group has mandated the Bank of America (BA) via my Office to release funds to beneficiaries through a means preferable by the beneficiary, Hence Your Name appears as one of The fund beneficiaries whom their fund was successfully cleared for payment. Your money will be released to you through a means preferable by you to avoid paying excess charges. Finally, you are advice to re-confirm these to us. Your Full Name....................... Contact address...................... Occupation............................. Telephone............................. And Fax Number for easy communication. Most importantly be aware that (Ten Million United States Dollars Only(US$10,000.000.00) was allocated to you as the approved amount due to you, there are two options to receive your funds (1) Bank to Bank wire transfer (2) Payments through Delivery of ATM CARD to your address then you have to choose on the two options above, Be also informed that all the documents regarding this approval and authorization has been issued in your name. Therefore be aware that your fund has obtained all her clearance to be released to you. Await your urgent attention today. Yours Sincerely, MR. BRIAN THOMAS MOYNIHAN PRESIDENT AND CEO BANK OF AMERICA EMAIL: infobankamericapayment@gmail.com SpamAssassin Report (spam score: 10.8) pts rule name description ---- ---------------------- -------------------------------------------------- -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [74.125.82.43 listed in list.dnswl.org] 0.0 DEAR_BENEFICIARY BODY: Dear Beneficiary: 0.0 MILLION_USD BODY: Talks about millions of dollars 0.4 INVALID_DATE Invalid Date: header (not RFC 2822) 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address 0.5 RCVD_IN_SORBS_SPAM RBL: SORBS: sender is a spam source [209.85.223.177 listed in dnsbl.sorbs.net] 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: bankofamerica.com] -0.0 SPF_PASS SPF: sender matches SPF record 0.0 HTML_MESSAGE BODY: HTML included in message 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 0.0 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars 0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag 0.0 LOTS_OF_MONEY Huge... sums of money 1.9 REPLYTO_WITHOUT_TO_CC REPLYTO_WITHOUT_TO_CC 1.8 MISSING_MIMEOLE Message has X-MSMail-Priority, but no X-MimeOLE 0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily 0.0 FILL_THIS_FORM Fill in a form with personal information 2.0 FILL_THIS_FORM_LONG Fill in a form with personal information 2.2 FILL_THIS_FORM_LOAN Answer loan question(s) 0.0 MONEY_FORM Lots of money if you fill out a form 0.0 MONEY_FRAUD_5 Lots of money and many fraud phrases 0.0 FORM_FRAUD_5 Fill a form and many fraud phrases 2016-12-10 06:55:00Attn: Beneficiaryhttp://scammed.by/scam.php?id=208175 BANK OF AMERICAN. 100 NORTH TRYON ST CHARLOTTE, NORTH CAROLINA. FROM THE DESK OF: MR. BRIAN THOMAS MOYNIHAN PRESIDENT AND CEO BANK OF AMERICA CONTACT LINK: BANK OF AMERICA EMAIL: infobankamericapayment@gmail.com http://www.bankofamerica.com ATTENTION: FUND BENEFICIARY , We wish to inform you that the board of trustees and management of Bank of America has finalized and have been given an Immediate transfer order by the Us Department of the Treasury in conjunction with the United Nations and our current President Barrack Obama, to transfer your overdue fund to your bank account, the approved sum of USD$10,000.000.00 (Ten Million United States Dollars Only) by this following means of choice. The World Bank Group has mandated the Bank of America (BA) via my Office to release funds to beneficiaries through a means preferable by the beneficiary, Hence Your Name appears as one of The fund beneficiaries whom their fund was successfully cleared for payment. Your money will be released to you through a means preferable by you to avoid paying excess charges. Finally, you are advice to re-confirm these to us. Your Full Name....................... Contact address...................... Occupation............................. Telephone............................. And Fax Number for easy communication. Most importantly be aware that (Ten Million United States Dollars Only(US$10,000.000.00) was allocated to you as the approved amount due to you, there are two options to receive your funds (1) Bank to Bank wire transfer (2) Payments through Delivery of ATM CARD to your address then you have to choose on the two options above, Be also informed that all the documents regarding this approval and authorization has been issued in your name. Therefore be aware that your fund has obtained all her clearance to be released to you. Await your urgent attention today. Yours Sincerely, MR. BRIAN THOMAS MOYNIHAN PRESIDENT AND CEO BANK OF AMERICA EMAIL: infobankamericapayment@gmail.com SpamAssassin Report (spam score: 10.8) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 DEAR_BENEFICIARY BODY: Dear Beneficiary: 0.0 MILLION_USD BODY: Talks about millions of dollars 0.4 INVALID_DATE Invalid Date: header (not RFC 2822) 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [209.85.223.171 listed in list.dnswl.org] 0.5 RCVD_IN_SORBS_SPAM RBL: SORBS: sender is a spam source [209.85.223.170 listed in dnsbl.sorbs.net] -0.0 SPF_PASS SPF: sender matches SPF record 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: bankofamerica.com] 0.0 HTML_MESSAGE BODY: HTML included in message 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 0.0 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars 0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag 0.0 LOTS_OF_MONEY Huge... sums of money 1.9 REPLYTO_WITHOUT_TO_CC REPLYTO_WITHOUT_TO_CC 1.8 MISSING_MIMEOLE Message has X-MSMail-Priority, but no X-MimeOLE 0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily 0.0 FILL_THIS_FORM Fill in a form with personal information 2.0 FILL_THIS_FORM_LONG Fill in a form with personal information 2.2 FILL_THIS_FORM_LOAN Answer loan question(s) 0.0 MONEY_FORM Lots of money if you fill out a form 0.0 MONEY_FRAUD_5 Lots of money and many fraud phrases 0.0 FORM_FRAUD_5 Fill a form and many fraud phrases 2016-12-10 06:54:58NO MORE CIGS WITH THIS TOOTHPICK? 4458http://scammed.by/scam.php?id=208174 NO MORE CIGS WITH THIS TOOTHPICK? Again the stubborn bull essayed to scramble to his feet. Again The Killer struck him a terrific blow. Again he put the question, kagoda--have you had enough? SpamAssassin Report (spam score: 4.3) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: sequish.xyz] 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address 0.5 RCVD_IN_SORBS_SPAM RBL: SORBS: sender is a spam source [209.85.223.173 listed in dnsbl.sorbs.net] -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [209.85.223.173 listed in list.dnswl.org] 1.6 SUBJ_ALL_CAPS Subject is all capitals -0.0 SPF_PASS SPF: sender matches SPF record 0.7 HTML_IMAGE_ONLY_20 BODY: HTML: images with 1600-2000 bytes of words 0.0 HTML_MESSAGE BODY: HTML included in message 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 0.0 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars 0.3 HTML_SHORT_LINK_IMG_3 HTML is very short with a linked image 0.0 T_HTML_TAG_BALANCE_CENTER Malformatted HTML 0.0 T_REMOTE_IMAGE Message contains an external image 2016-12-10 06:37:12INVESTMENT IN YOUR COUNTRYhttp://scammed.by/scam.php?id=208173 INVESTMENT IN YOUR COUNTRY FROM THE OFFICE OF MR. JAMES JEFFEREY DEAN. EMAIL;jamesjdean22017@gmail.com ADDRESS: 5TH FLOOR, 17 BELGRAVE ROAD, LONDON SW1V 1RB. Dear Friend, My name is James Dean, I would like to invest the sum of Seven Million USA Dollars (US$7,000,000.00) under your care and guidance in profitable business/es in your country. If you find my proposal interesting, please reply this mail as soon as possible so I could send you more details. If this business proposition offends your moral values, do accept my apology. All I need from you is your willingness, trust and confidentiality so that we can work together to achieve success. Should you be interested please send me the required information below.(1) Your Full Name.(2) E-mail : (3) Your Personal Mobile Number please reply for more details. And I will prefer you reach me on my private email address (jamesjdean22017@gmail.com) BEST REGARDS MR. JAMES J. DEAN. SpamAssassin Report (spam score: 4.0) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [209.85.210.172 listed in list.dnswl.org] 0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider (selvakumar561979[at]gmail.com) 0.0 DKIM_ADSP_CUSTOM_MED No valid author signature, adsp_override is CUSTOM_MED 1.6 SUBJ_ALL_CAPS Subject is all capitals -0.0 SPF_PASS SPF: sender matches SPF record 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid 0.0 LOTS_OF_MONEY Huge... sums of money 0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid 1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different freemails 1.2 NML_ADSP_CUSTOM_MED ADSP custom_med hit, and not from a mailing list 0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information 0.0 ADVANCE_FEE_3_NEW_MONEY Advance Fee fraud and lots of money 2016-12-10 06:17:56INVESTMENT IN YOUR COUNTRYhttp://scammed.by/scam.php?id=208171 INVESTMENT IN YOUR COUNTRY FROM THE OFFICE OF MR. JAMES JEFFEREY DEAN. EMAIL;jamesjdean22017@gmail.com ADDRESS: 5TH FLOOR, 17 BELGRAVE ROAD, LONDON SW1V 1RB. Dear Friend, My name is James Dean, I would like to invest the sum of Seven Million USA Dollars (US$7,000,000.00) under your care and guidance in profitable business/es in your country. If you find my proposal interesting, please reply this mail as soon as possible so I could send you more details. If this business proposition offends your moral values, do accept my apology. All I need from you is your willingness, trust and confidentiality so that we can work together to achieve success. Should you be interested please send me the required information below.(1) Your Full Name.(2) E-mail : (3) Your Personal Mobile Number please reply for more details. And I will prefer you reach me on my private email address (jamesjdean22017@gmail.com) BEST REGARDS MR. JAMES J. DEAN. SpamAssassin Report (spam score: 4.5) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address 0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider (selvakumar561979[at]gmail.com) -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [209.85.223.181 listed in list.dnswl.org] 0.0 DKIM_ADSP_CUSTOM_MED No valid author signature, adsp_override is CUSTOM_MED 1.6 SUBJ_ALL_CAPS Subject is all capitals -0.0 SPF_PASS SPF: sender matches SPF record 0.5 RCVD_IN_SORBS_SPAM RBL: SORBS: sender is a spam source [209.85.223.181 listed in dnsbl.sorbs.net] 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid 0.0 LOTS_OF_MONEY Huge... sums of money 0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid 1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different freemails 1.2 NML_ADSP_CUSTOM_MED ADSP custom_med hit, and not from a mailing list 0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information 0.0 ADVANCE_FEE_3_NEW_MONEY Advance Fee fraud and lots of money 2016-12-10 06:17:55That New Car Smell: Get In a New Car Today New Car Offers w Financing From Motivated Local Dealershipshttp://scammed.by/scam.php?id=208172 Wrote Face minutes Started wondered That New Car Smell: Get In a New Car Today, New Car Offers (w/ Financing) From Motivated Local Dealerships SpamAssassin Report (spam score: 4.4) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address 0.5 RCVD_IN_SORBS_SPAM RBL: SORBS: sender is a spam source [209.85.223.171 listed in dnsbl.sorbs.net] -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [74.125.82.43 listed in list.dnswl.org] -0.0 SPF_PASS SPF: sender matches SPF record 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: 185.111.75.115] 0.0 NORMAL_HTTP_TO_IP URI: URI host has a public dotted-decimal IPv4 address 0.8 HTML_IMAGE_RATIO_02 BODY: HTML has a low ratio of text to image area 0.0 HTML_MESSAGE BODY: HTML included in message 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 1.0 HTML_IMAGE_ONLY_16 BODY: HTML: images with 1200-1600 bytes of words 0.0 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars 0.6 URIBL_SBL Contains an URL's NS IP listed in the SBL blocklist [URIs: 185.111.75.115] 0.3 HTML_SHORT_LINK_IMG_2 HTML is very short with a linked image 0.0 T_REMOTE_IMAGE Message contains an external image 2016-12-10 06:14:46That New Car Smell: Get In a New Car Today New Car Offers w Financing From Motivated Local Dealershipshttp://scammed.by/scam.php?id=208170 Wrote Face minutes Started wondered That New Car Smell: Get In a New Car Today, New Car Offers (w/ Financing) From Motivated Local Dealerships SpamAssassin Report (spam score: 3.2) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address -0.7 RCVD_IN_DNSWL_LOW RBL: Sender listed at http://www.dnswl.org/, low trust [209.85.223.174 listed in list.dnswl.org] -0.0 SPF_PASS SPF: sender matches SPF record 0.6 URIBL_SBL Contains an URL's NS IP listed in the SBL blocklist [URIs: 185.111.75.115] 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: 185.111.75.115] 0.0 NORMAL_HTTP_TO_IP URI: URI host has a public dotted-decimal IPv4 address 0.8 HTML_IMAGE_RATIO_02 BODY: HTML has a low ratio of text to image area 0.0 HTML_MESSAGE BODY: HTML included in message 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 1.0 HTML_IMAGE_ONLY_16 BODY: HTML: images with 1200-1600 bytes of words 0.0 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars 0.3 HTML_SHORT_LINK_IMG_2 HTML is very short with a linked image 0.0 T_REMOTE_IMAGE Message contains an external image 2016-12-10 06:14:44½¨Ôa„“ÐÂÒªÇóͬ´æÒìhttp://scammed.by/scam.php?id=208169 yOe6zszhuN++V9KzxNrI3dl8wb8KCjEyxOqzzNDyv6qwbL6t0emjrM/r0qrX9r5X0rO1xC7C6Z+p u9iPzeBdvP4u SpamAssassin Report (spam score: 8.1) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address 0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider (wang60538[at]163.com) -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [74.125.82.52 listed in list.dnswl.org] 3.6 RCVD_IN_SORBS_WEB RBL: SORBS: sender is an abusable web server [74.125.82.52 listed in dnsbl.sorbs.net] -0.0 SPF_PASS SPF: sender matches SPF record 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid 0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid 1.9 MIME_NO_TEXT No (properly identified) text body parts 2.5 TVD_SPACE_RATIO_MINFP Space ratio 2016-12-10 06:10:15Experience Switzerland s Stunning Hamlets On a River Cruise You ll Be Amazed How Budget Friendly It Really Is http://scammed.by/scam.php?id=208168 Unpleasant pointed Performed Defective Last Experience Switzerland's Stunning Hamlets On a River Cruise -- You'll Be Amazed How Budget-Friendly It Really Is! SpamAssassin Report (spam score: 2.4) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [74.125.82.54 listed in list.dnswl.org] -0.0 SPF_PASS SPF: sender matches SPF record 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: 185.111.75.52] 0.0 NORMAL_HTTP_TO_IP URI: URI host has a public dotted-decimal IPv4 address 0.6 HTML_IMAGE_RATIO_04 BODY: HTML has a low ratio of text to image area 0.0 HTML_MESSAGE BODY: HTML included in message 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 0.0 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars 0.6 URIBL_SBL Contains an URL's NS IP listed in the SBL blocklist [URIs: 185.111.75.52] 0.0 T_REMOTE_IMAGE Message contains an external image 2016-12-10 06:07:59Experience Switzerland s Stunning Hamlets On a River Cruise You ll Be Amazed How Budget Friendly It Really Is http://scammed.by/scam.php?id=208167 Unpleasant pointed Performed Defective Last Experience Switzerland's Stunning Hamlets On a River Cruise -- You'll Be Amazed How Budget-Friendly It Really Is! SpamAssassin Report (spam score: 2.9) pts rule name description ---- ---------------------- -------------------------------------------------- 0.5 RCVD_IN_SORBS_SPAM RBL: SORBS: sender is a spam source [209.85.223.171 listed in dnsbl.sorbs.net] 0.6 URIBL_SBL Contains an URL's NS IP listed in the SBL blocklist [URIs: 185.111.75.52] 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [209.85.223.171 listed in list.dnswl.org] -0.0 SPF_PASS SPF: sender matches SPF record 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: 185.111.75.52] 0.0 NORMAL_HTTP_TO_IP URI: URI host has a public dotted-decimal IPv4 address 0.6 HTML_IMAGE_RATIO_04 BODY: HTML has a low ratio of text to image area 0.0 HTML_MESSAGE BODY: HTML included in message 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 0.0 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars 0.0 T_REMOTE_IMAGE Message contains an external image 2016-12-10 05:59:30NO MORE CIGS WITH THIS TOOTHPICK? 8523http://scammed.by/scam.php?id=208166 NO MORE CIGS WITH THIS TOOTHPICK? The lieutenant did the guiding. We had to present our passports, and I anticipated no more difficulty than in landing from the boat at Boulogne. But I wanted to get it over, for my hunger pinched me and it was fearsome cold. Still the guns went on, like hounds baying before a quarry. The city was out of range, but there were strange lights on the ridge to the east. SpamAssassin Report (spam score: 4.0) pts rule name description ---- ---------------------- -------------------------------------------------- -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [209.85.210.170 listed in list.dnswl.org] 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: theriall.xyz] 1.6 SUBJ_ALL_CAPS Subject is all capitals -0.0 SPF_PASS SPF: sender matches SPF record 1.3 HTML_IMAGE_ONLY_24 BODY: HTML: images with 2000-2400 bytes of words 0.0 HTML_MESSAGE BODY: HTML included in message 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 0.0 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars 0.0 T_HTML_TAG_BALANCE_CENTER Malformatted HTML 0.0 T_REMOTE_IMAGE Message contains an external image 2016-12-10 05:32:49NO MORE CIGS WITH THIS TOOTHPICK? 8523http://scammed.by/scam.php?id=208165 NO MORE CIGS WITH THIS TOOTHPICK? The lieutenant did the guiding. We had to present our passports, and I anticipated no more difficulty than in landing from the boat at Boulogne. But I wanted to get it over, for my hunger pinched me and it was fearsome cold. Still the guns went on, like hounds baying before a quarry. The city was out of range, but there were strange lights on the ridge to the east. SpamAssassin Report (spam score: ) pts rule name undefined2016-12-10 05:25:58Your compensation fund in the amount of 2 5 million dollars is ready http://scammed.by/scam.php?id=208163 Am Jane Walters. The new regional auditor general of Ecobank plc, during my latest audit which i conducted with my team,We came across your file and found out that you haven't receive your compensation fund of $2.5 million dollars.I have sent the file to the appropriate authorities for clarifications and they are done processing, and are ready to transfer the fund to you as the rightfully owner.kindly forward the bellow information to Email=ecobankofghana101@yahoo.com  Note: As soon as we receive all the information's, your Fund will get to your account within 72 hours. 1:Full Name:2:Age:3:Address:4:Occupation:5:Mobil Phone/Fax:6:Name of your Bank:7:Account Number:8:Any of your Identification Card: Waiting for your urgent response.Ecobank C354 / 7A Westlands Boulevard Stre Best Regards. Jane Walters.Auditor General. SpamAssassin Report (spam score: 5.7) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address 0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider (jane.waters77[at]yahoo.com) -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [209.85.210.174 listed in list.dnswl.org] 0.0 DKIM_ADSP_CUSTOM_MED No valid author signature, adsp_override is CUSTOM_MED -0.0 SPF_PASS SPF: sender matches SPF record 0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit ( ) 1.0 FORGED_YAHOO_RCVD 'From' yahoo.com does not match 'Received' headers 1.2 MISSING_HEADERS Missing To: header 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid 0.0 LOTS_OF_MONEY Huge... sums of money 1.9 REPLYTO_WITHOUT_TO_CC REPLYTO_WITHOUT_TO_CC 0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid 1.2 NML_ADSP_CUSTOM_MED ADSP custom_med hit, and not from a mailing list 2016-12-10 05:01:26Your compensation fund in the amount of 2 5 million dollars is ready http://scammed.by/scam.php?id=208161 Am Jane Walters. The new regional auditor general of Ecobank plc, during my latest audit which i conducted with my team,We came across your file and found out that you haven't receive your compensation fund of $2.5 million dollars.I have sent the file to the appropriate authorities for clarifications and they are done processing, and are ready to transfer the fund to you as the rightfully owner.kindly forward the bellow information to Email=ecobankofghana101@yahoo.com  Note: As soon as we receive all the information's, your Fund will get to your account within 72 hours. 1:Full Name:2:Age:3:Address:4:Occupation:5:Mobil Phone/Fax:6:Name of your Bank:7:Account Number:8:Any of your Identification Card: Waiting for your urgent response.Ecobank C354 / 7A Westlands Boulevard Stre Best Regards. Jane Walters.Auditor General. SpamAssassin Report (spam score: 5.7) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address 0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider (jane.waters77[at]yahoo.com) -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [209.85.223.178 listed in list.dnswl.org] 0.0 DKIM_ADSP_CUSTOM_MED No valid author signature, adsp_override is CUSTOM_MED -0.0 SPF_PASS SPF: sender matches SPF record 0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit ( ) 1.0 FORGED_YAHOO_RCVD 'From' yahoo.com does not match 'Received' headers 1.2 MISSING_HEADERS Missing To: header 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid 0.0 LOTS_OF_MONEY Huge... sums of money 1.9 REPLYTO_WITHOUT_TO_CC REPLYTO_WITHOUT_TO_CC 0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid 1.2 NML_ADSP_CUSTOM_MED ADSP custom_med hit, and not from a mailing list 2016-12-10 05:01:24The Adult Tinder is Finally Here Swipe for Free Todayhttp://scammed.by/scam.php?id=208164 PurpleDrink #Juice454454540 tr td { font-family: Arial, Helvetica, sans-serif; } SpamAssassin Report (spam score: 13.9) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [209.85.210.175 listed in list.dnswl.org] 2.6 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL [179.48.134.127 listed in zen.spamhaus.org] 3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS -0.0 SPF_PASS SPF: sender matches SPF record 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: reasoneecough.loan] 2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist [URIs: reasoneecough.loan] 0.7 HTML_TAG_BALANCE_BODY BODY: HTML has unbalanced "body" tags 1.6 HTML_IMAGE_ONLY_12 BODY: HTML: images with 800-1200 bytes of words 0.0 HTML_MESSAGE BODY: HTML included in message 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 0.0 AC_BR_BONANZA RAW: Too many newlines in a row... spammy template 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid 0.5 RCVD_IN_SORBS_SPAM RBL: SORBS: sender is a spam source [74.125.82.47 listed in dnsbl.sorbs.net] 0.3 HTML_SHORT_LINK_IMG_2 HTML is very short with a linked image 0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid 0.0 BODY_SINGLE_URI Message body is only a URI 1.0 BODY_SINGLE_WORD Message body is only one word (no spaces) 2016-12-10 04:59:19The Adult Tinder is Finally Here Swipe for Free Todayhttp://scammed.by/scam.php?id=208162 PurpleDrink #Juice454454540 tr td { font-family: Arial, Helvetica, sans-serif; } SpamAssassin Report (spam score: 13.9) pts rule name description ---- ---------------------- -------------------------------------------------- 0.5 RCVD_IN_SORBS_SPAM RBL: SORBS: sender is a spam source [74.125.82.47 listed in dnsbl.sorbs.net] 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [209.85.223.172 listed in list.dnswl.org] 2.6 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL [179.48.134.127 listed in zen.spamhaus.org] 3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: reasoneecough.loan] 2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist [URIs: reasoneecough.loan] -0.0 SPF_PASS SPF: sender matches SPF record 0.7 HTML_TAG_BALANCE_BODY BODY: HTML has unbalanced "body" tags 1.6 HTML_IMAGE_ONLY_12 BODY: HTML: images with 800-1200 bytes of words 0.0 HTML_MESSAGE BODY: HTML included in message 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 0.0 AC_BR_BONANZA RAW: Too many newlines in a row... spammy template 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid 0.3 HTML_SHORT_LINK_IMG_2 HTML is very short with a linked image 0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid 0.0 BODY_SINGLE_URI Message body is only a URI 1.0 BODY_SINGLE_WORD Message body is only one word (no spaces) 2016-12-10 04:59:18Wife Walked In AMAZING http://scammed.by/scam.php?id=208159 Wife Walked In - AMAZING! Well indeed might Mbonga scream for help, for Tarzan, young and fleet-footed, covered the distance between them in great leaps, at the speed of a charging lion. He was growling, too, not at all unlike Numa himself. Mbonga heard and his blood ran cold. He could feel the wool stiffen upon his pate and a prickly chill run up his spine, as though Death had come and run his cold finger along Mbonga's back. SpamAssassin Report (spam score: 6.0) pts rule name description ---- ---------------------- -------------------------------------------------- -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [74.125.82.45 listed in list.dnswl.org] 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address 3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS [168.139.134.243 listed in zen.spamhaus.org] -0.0 SPF_PASS SPF: sender matches SPF record 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: xojoonse.xyz] 1.3 HTML_IMAGE_ONLY_24 BODY: HTML: images with 2000-2400 bytes of words 0.0 HTML_MESSAGE BODY: HTML included in message 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 0.0 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars 0.0 T_HTML_TAG_BALANCE_CENTER Malformatted HTML 0.0 T_REMOTE_IMAGE Message contains an external image 2016-12-10 04:30:32Wife Walked In AMAZING http://scammed.by/scam.php?id=208160 Wife Walked In - AMAZING! Tambudza, leading Tarzan of the Apes toward the camp of the Russian, moved very slowly along the winding jungle path, for she was old and her legs stiff with rheumatism. SpamAssassin Report (spam score: 2.7) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [209.85.223.173 listed in list.dnswl.org] 0.5 RCVD_IN_SORBS_SPAM RBL: SORBS: sender is a spam source [209.85.223.173 listed in dnsbl.sorbs.net] -0.0 SPF_PASS SPF: sender matches SPF record 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: hyptsis.xyz] 0.7 HTML_IMAGE_ONLY_20 BODY: HTML: images with 1600-2000 bytes of words 0.0 HTML_MESSAGE BODY: HTML included in message 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 0.0 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars 0.3 HTML_SHORT_LINK_IMG_3 HTML is very short with a linked image 0.0 T_HTML_TAG_BALANCE_CENTER Malformatted HTML 0.0 T_REMOTE_IMAGE Message contains an external image 2016-12-10 04:25:49[ALERT] You Got a Smiley from Yuk from Hong Kong http://scammed.by/scam.php?id=208157 Joy property Towards Early Delicate [ALERT] You Got a Smiley from Yuk (from Hong-Kong) SpamAssassin Report (spam score: 13.9) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: obevo.top] 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address 2.6 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL [185.111.72.100 listed in zen.spamhaus.org] 3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [74.125.82.49 listed in list.dnswl.org] -0.0 SPF_PASS SPF: sender matches SPF record 1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist [URIs: obevo.top] 2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist [URIs: obevo.top] 0.8 HTML_IMAGE_RATIO_02 BODY: HTML has a low ratio of text to image area 1.3 HTML_IMAGE_ONLY_24 BODY: HTML: images with 2000-2400 bytes of words 0.0 HTML_MESSAGE BODY: HTML included in message 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 0.0 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid 0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid 0.0 T_REMOTE_IMAGE Message contains an external image 2016-12-10 04:18:20[ALERT] You Got a Smiley from Yuk from Hong Kong http://scammed.by/scam.php?id=208158 Joy property Towards Early Delicate [ALERT] You Got a Smiley from Yuk (from Hong-Kong) SpamAssassin Report (spam score: 14.4) pts rule name description ---- ---------------------- -------------------------------------------------- 1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist [URIs: obevo.top] 2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist [URIs: peunpu.top] 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address 3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS [185.111.72.100 listed in zen.spamhaus.org] 2.6 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [209.85.223.177 listed in list.dnswl.org] 0.5 RCVD_IN_SORBS_SPAM RBL: SORBS: sender is a spam source [209.85.223.177 listed in dnsbl.sorbs.net] -0.0 SPF_PASS SPF: sender matches SPF record 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: obevo.top] 0.8 HTML_IMAGE_RATIO_02 BODY: HTML has a low ratio of text to image area 1.3 HTML_IMAGE_ONLY_24 BODY: HTML: images with 2000-2400 bytes of words 0.0 HTML_MESSAGE BODY: HTML included in message 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 0.0 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid 0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid 0.0 T_REMOTE_IMAGE Message contains an external image 2016-12-10 04:18:20Dear Beloved http://scammed.by/scam.php?id=208156 Dear Beloved, I am Mrs Nicole Benoite Marois and i have been suffering from ovarian cancer disease and the doctor says that i have just few days to leave.I am from (Paris) France but based in Africa Burkina Faso since eight years ago as a business woman dealing with gold exportation. Now that i am about to end the race like this, without any family members and no child. I have $3 Million US DOLLARS in Africa Development Bank (ADB) Burkina Faso which i instructed the bank to give St Andrews Missionary Home in Burkina Faso.But my mind is not at rest because i am writing this letter now through the help of my computer beside my sick bed. I also have $4.5 Million US Dollars at Eco-Bank here in Burkina Faso and i instructed the bank to transfer the fund to you as foreigner that will apply to the bank after i have gone that they should release the fund to him/her,but you will assure me that you will take 50% of the fund and give 50% to the orphanages home in your country for my heart to rest. Respond to me immediately for further details since I have just few days to end my life due to the ovarian cancer disease, hoping you will understand my point Yours fairly friend, Mrs Nicole Benoite Marois. SpamAssassin Report (spam score: 1.4) pts rule name description ---- ---------------------- -------------------------------------------------- 1.2 TO_MALFORMED To: has a malformed address 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [98.137.12.181 listed in list.dnswl.org] 0.0 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid 0.0 LOTS_OF_MONEY Huge... sums of money 0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid 0.0 T_MONEY_PERCENT X% of a lot of money for you 2016-12-10 04:11:20Re: For Your Eyes Only http://scammed.by/scam.php?id=208155 Funds Investment And Management Proposal Let me use the liberty of this medium to inform you that my principal is interested in investing his funds as a silent investor in your company. He would like to invest in private sector projects with an established company in any project(s) which are already in the market and have market value or new company requiring the injection of huge funds, provided there are lots of opportunities available, taking into proper consideration the Return on Investment (ROI) based on a ten (10) years strategic plan. Kindly indicate your interest in my client?s proposition by furnishing me with your Bio data, business plan/personal contact details and any other information/details that may help in the actualization of the impending investment portfolio: Regards Vladimir Oleg SpamAssassin Report (spam score: 1.5) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address 0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider (vladimirole01[at]outlook.com) -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [74.125.82.50 listed in list.dnswl.org] -0.0 SPF_PASS SPF: sender matches SPF record 0.0 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars 0.5 RCVD_IN_SORBS_SPAM RBL: SORBS: sender is a spam source [209.85.223.170 listed in dnsbl.sorbs.net] 1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different freemails 2016-12-10 03:56:44Re: For Your Eyes Only http://scammed.by/scam.php?id=208154 Funds Investment And Management Proposal Let me use the liberty of this medium to inform you that my principal is interested in investing his funds as a silent investor in your company. He would like to invest in private sector projects with an established company in any project(s) which are already in the market and have market value or new company requiring the injection of huge funds, provided there are lots of opportunities available, taking into proper consideration the Return on Investment (ROI) based on a ten (10) years strategic plan. Kindly indicate your interest in my client?s proposition by furnishing me with your Bio data, business plan/personal contact details and any other information/details that may help in the actualization of the impending investment portfolio: Regards Vladimir Oleg SpamAssassin Report (spam score: 1.5) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address 0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider (vladimirole01[at]outlook.com) -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [209.85.223.170 listed in list.dnswl.org] 0.5 RCVD_IN_SORBS_SPAM RBL: SORBS: sender is a spam source [209.85.223.181 listed in dnsbl.sorbs.net] -0.0 SPF_PASS SPF: sender matches SPF record 0.0 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars 1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different freemails 2016-12-10 03:56:43Get Full Relief from Over Sensitive Teethhttp://scammed.by/scam.php?id=208153 valley endeavor Family Inquiry Peculiar Get Full Relief from Over-Sensitive Teeth SpamAssassin Report (spam score: 3.1) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [209.85.210.169 listed in list.dnswl.org] -0.0 SPF_PASS SPF: sender matches SPF record 0.6 URIBL_SBL Contains an URL's NS IP listed in the SBL blocklist [URIs: 185.111.75.111] 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: 185.111.75.111] 0.0 NORMAL_HTTP_TO_IP URI: URI host has a public dotted-decimal IPv4 address 0.8 HTML_IMAGE_RATIO_02 BODY: HTML has a low ratio of text to image area 0.0 HTML_MESSAGE BODY: HTML included in message 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 0.0 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars 0.5 RCVD_IN_SORBS_SPAM RBL: SORBS: sender is a spam source [209.85.223.177 listed in dnsbl.sorbs.net] 0.0 T_REMOTE_IMAGE Message contains an external image 2016-12-10 03:14:29Get Full Relief from Over Sensitive Teethhttp://scammed.by/scam.php?id=208152 valley endeavor Family Inquiry Peculiar Get Full Relief from Over-Sensitive Teeth SpamAssassin Report (spam score: 3.1) pts rule name description ---- ---------------------- -------------------------------------------------- -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [209.85.223.179 listed in list.dnswl.org] 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: 185.111.75.111] 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address -0.0 SPF_PASS SPF: sender matches SPF record 0.6 URIBL_SBL Contains an URL's NS IP listed in the SBL blocklist [URIs: 185.111.75.111] 0.0 NORMAL_HTTP_TO_IP URI: URI host has a public dotted-decimal IPv4 address 0.8 HTML_IMAGE_RATIO_02 BODY: HTML has a low ratio of text to image area 0.0 HTML_MESSAGE BODY: HTML included in message 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 0.0 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars 0.5 RCVD_IN_SORBS_SPAM RBL: SORBS: sender is a spam source [209.85.223.179 listed in dnsbl.sorbs.net] 0.0 T_REMOTE_IMAGE Message contains an external image 2016-12-10 03:14:28Re: project fundhttp://scammed.by/scam.php?id=208151 Hello, My name is ms. Reem Al-Hashimi, the minister of state, UAE. I have a business proposal that wart $27m usd for you. I want you to receive and invest this money on behalf of my only son. I will give you more detail about this fund and myself, as soon as I receive a positive response from you. Regards, Ms. Reem Al-Hashimy SpamAssassin Report (spam score: 12.2) pts rule name description ---- ---------------------- -------------------------------------------------- -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [209.85.210.178 listed in list.dnswl.org] 0.3 HK_SCAM_S7 BODY: HK_SCAM_S7 0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address 0.0 NSL_RCVD_HELO_USER Received from HELO User 2.6 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL [46.29.254.239 listed in zen.spamhaus.org] -0.0 SPF_PASS SPF: sender matches SPF record 1.2 MISSING_HEADERS Missing To: header 0.0 LOTS_OF_MONEY Huge... sums of money 0.0 FROM_MISSP_XPRIO Misspaced FROM + X-Priority 1.9 REPLYTO_WITHOUT_TO_CC REPLYTO_WITHOUT_TO_CC 0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool 0.0 FSL_NEW_HELO_USER Spam's using Helo and User 0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait 0.0 MSGID_FROM_MTA_HEADER Message-Id was added by a relay 3.4 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE 0.0 FAKE_REPLY_C FAKE_REPLY_C 0.0 MONEY_FROM_MISSP Lots of money and misspaced From 0.0 TO_NO_BRKTS_FROM_MSSP Multiple header formatting problems 0.0 FROM_MISSPACED From: missing whitespace 2.8 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook 0.0 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money 2016-12-10 02:53:00Prove the doubters wrong mugu recycling inchttp://scammed.by/scam.php?id=208150 Hi, We were notified that you may be eligible for the new Career Advancement grant. If you haven't taken advantage of the program yet, the deadline is approaching soon. "At this stage, the park is closed and ermined_83909 Dreamworld is working closely with police immortalized_41462 and emergency services to establish the Gatha_39991 facts around the incident. We are glanced_20164 deeply shocked and saddened by aeromechanics_94084 this and our hearts and our thoughts countryish_69086go to the families involved and to Adirondack_85530 their loved ones," Davidson said. Billed as a kewaskum_88415 family ride, the Thunder River Rapids Ride classes_07375has had problems in the past, according to epizoon_74503 a report cariole_83019 by CNN affiliate Seven News. US Olympian Matthew Camembert_38554 Centrowitz tweeted that he had just stepped cantors_94023 off the ride when he learned interprete_38823 that there were injuries. "generalizable_72303 Dude! Just got off a arcing_90425 ride 15 mins ago that excursionists_70386 has 1 person seriously injured and kebab_17169 2 others trapped. #Dreamworld," the getaway_73424 track star's tweet read. The death toll adenovirus_45216 was updated after Centrowitz' tweet customisers_65605 posted. SpamAssassin Report (spam score: 12.8) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address 1.0 HK_RANDOM_FROM From username looks random -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [209.85.210.182 listed in list.dnswl.org] 2.6 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL [116.130.180.88 listed in zen.spamhaus.org] 3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS -0.0 SPF_PASS SPF: sender matches SPF record 2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist [URIs: rfsisepguo.top] 1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist [URIs: rfsisepguo.top] 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: rfsisepguo.top] 0.0 HTML_MESSAGE BODY: HTML included in message 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid 0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid 2016-12-10 02:49:20Prove the doubters wrong mugu recycling inchttp://scammed.by/scam.php?id=208149 Hi, We were notified that you may be eligible for the new Career Advancement grant. If you haven't taken advantage of the program yet, the deadline is approaching soon. "At this stage, the park is closed and ermined_83909 Dreamworld is working closely with police immortalized_41462 and emergency services to establish the Gatha_39991 facts around the incident. We are glanced_20164 deeply shocked and saddened by aeromechanics_94084 this and our hearts and our thoughts countryish_69086go to the families involved and to Adirondack_85530 their loved ones," Davidson said. Billed as a kewaskum_88415 family ride, the Thunder River Rapids Ride classes_07375has had problems in the past, according to epizoon_74503 a report cariole_83019 by CNN affiliate Seven News. US Olympian Matthew Camembert_38554 Centrowitz tweeted that he had just stepped cantors_94023 off the ride when he learned interprete_38823 that there were injuries. "generalizable_72303 Dude! Just got off a arcing_90425 ride 15 mins ago that excursionists_70386 has 1 person seriously injured and kebab_17169 2 others trapped. #Dreamworld," the getaway_73424 track star's tweet read. The death toll adenovirus_45216 was updated after Centrowitz' tweet customisers_65605 posted. SpamAssassin Report (spam score: 12.8) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: rfsisepguo.top] 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address 1.0 HK_RANDOM_FROM From username looks random -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [209.85.223.182 listed in list.dnswl.org] 3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS [116.130.180.88 listed in zen.spamhaus.org] 2.6 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL -0.0 SPF_PASS SPF: sender matches SPF record 2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist [URIs: rfsisepguo.top] 1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist [URIs: rfsisepguo.top] 0.0 HTML_MESSAGE BODY: HTML included in message 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid 0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid 2016-12-10 02:49:18Attn: Your CVS 50 Christmas Gift Card Expires Sunday 12 12 Gift 3547http://scammed.by/scam.php?id=208148 HolidaySpirit #Christmas454804 tr td { font-family: Arial, Helvetica, sans-serif; } SpamAssassin Report (spam score: 13.4) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address 2.6 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL [196.63.13.7 listed in zen.spamhaus.org] 3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [209.85.210.171 listed in list.dnswl.org] -0.0 SPF_PASS SPF: sender matches SPF record 2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist [URIs: absorbingeehealthy.loan] 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: absorbingeehealthy.loan] 0.7 HTML_TAG_BALANCE_BODY BODY: HTML has unbalanced "body" tags 1.6 HTML_IMAGE_ONLY_12 BODY: HTML: images with 800-1200 bytes of words 0.0 HTML_MESSAGE BODY: HTML included in message 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid 0.3 HTML_SHORT_LINK_IMG_2 HTML is very short with a linked image 0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid 1.0 BODY_SINGLE_WORD Message body is only one word (no spaces) 2016-12-10 02:28:16Attn: Your CVS 50 Christmas Gift Card Expires Sunday 12 12 Gift 3547http://scammed.by/scam.php?id=208146 HolidaySpirit #Christmas454804 tr td { font-family: Arial, Helvetica, sans-serif; } SpamAssassin Report (spam score: 13.9) pts rule name description ---- ---------------------- -------------------------------------------------- 0.5 RCVD_IN_SORBS_SPAM RBL: SORBS: sender is a spam source [209.85.223.173 listed in dnsbl.sorbs.net] 3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS [196.63.13.7 listed in zen.spamhaus.org] 2.6 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [209.85.223.170 listed in list.dnswl.org] -0.0 SPF_PASS SPF: sender matches SPF record 2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist [URIs: absorbingeehealthy.loan] 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: absorbingeehealthy.loan] 0.7 HTML_TAG_BALANCE_BODY BODY: HTML has unbalanced "body" tags 1.6 HTML_IMAGE_ONLY_12 BODY: HTML: images with 800-1200 bytes of words 0.0 HTML_MESSAGE BODY: HTML included in message 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid 0.3 HTML_SHORT_LINK_IMG_2 HTML is very short with a linked image 0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid 1.0 BODY_SINGLE_WORD Message body is only one word (no spaces) 2016-12-10 02:28:15Interest Bearing Checkinghttp://scammed.by/scam.php?id=208143 prevailed To Looked suspicion Saved Interest Bearing Checking SpamAssassin Report (spam score: 3.1) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [209.85.210.180 listed in list.dnswl.org] -0.0 SPF_PASS SPF: sender matches SPF record 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: 185.111.75.119] 0.6 URIBL_SBL Contains an URL's NS IP listed in the SBL blocklist [URIs: 185.111.75.119] 0.0 NORMAL_HTTP_TO_IP URI: URI host has a public dotted-decimal IPv4 address 0.8 HTML_IMAGE_RATIO_02 BODY: HTML has a low ratio of text to image area 0.0 HTML_MESSAGE BODY: HTML included in message 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 0.0 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars 0.5 RCVD_IN_SORBS_SPAM RBL: SORBS: sender is a spam source [209.85.223.177 listed in dnsbl.sorbs.net] 0.0 T_REMOTE_IMAGE Message contains an external image 2016-12-10 02:17:30Interest Bearing Checkinghttp://scammed.by/scam.php?id=208147 prevailed To Looked suspicion Saved Interest Bearing Checking SpamAssassin Report (spam score: 2.4) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: 185.111.75.119] 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address -0.7 RCVD_IN_DNSWL_LOW RBL: Sender listed at http://www.dnswl.org/, low trust [209.85.223.169 listed in list.dnswl.org] -0.0 SPF_PASS SPF: sender matches SPF record 0.6 URIBL_SBL Contains an URL's NS IP listed in the SBL blocklist [URIs: 185.111.75.119] 0.0 NORMAL_HTTP_TO_IP URI: URI host has a public dotted-decimal IPv4 address 0.8 HTML_IMAGE_RATIO_02 BODY: HTML has a low ratio of text to image area 0.0 HTML_MESSAGE BODY: HTML included in message 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 0.0 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars 0.5 RCVD_IN_SORBS_SPAM RBL: SORBS: sender is a spam source [209.85.223.171 listed in dnsbl.sorbs.net] 0.0 T_REMOTE_IMAGE Message contains an external image 2016-12-10 02:17:28Drug Abuse Detox and Alcoholism Is Now Treated in Rehabhttp://scammed.by/scam.php?id=208142 five better unable Given Nothing Drug Abuse, Detox and Alcoholism Is Now Treated in Rehab SpamAssassin Report (spam score: 2.6) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [209.85.210.181 listed in list.dnswl.org] -0.0 SPF_PASS SPF: sender matches SPF record 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: 185.111.75.119] 0.6 URIBL_SBL Contains an URL's NS IP listed in the SBL blocklist [URIs: 185.111.75.119] 0.0 NORMAL_HTTP_TO_IP URI: URI host has a public dotted-decimal IPv4 address 0.8 HTML_IMAGE_RATIO_02 BODY: HTML has a low ratio of text to image area 0.0 HTML_MESSAGE BODY: HTML included in message 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 0.0 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars 0.0 T_REMOTE_IMAGE Message contains an external image 2016-12-10 02:14:14Drug Abuse Detox and Alcoholism Is Now Treated in Rehabhttp://scammed.by/scam.php?id=208145 five better unable Given Nothing Drug Abuse, Detox and Alcoholism Is Now Treated in Rehab SpamAssassin Report (spam score: 2.4) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address -0.7 RCVD_IN_DNSWL_LOW RBL: Sender listed at http://www.dnswl.org/, low trust [209.85.223.174 listed in list.dnswl.org] 0.5 RCVD_IN_SORBS_SPAM RBL: SORBS: sender is a spam source [209.85.223.171 listed in dnsbl.sorbs.net] -0.0 SPF_PASS SPF: sender matches SPF record 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: 185.111.75.119] 0.0 NORMAL_HTTP_TO_IP URI: URI host has a public dotted-decimal IPv4 address 0.8 HTML_IMAGE_RATIO_02 BODY: HTML has a low ratio of text to image area 0.0 HTML_MESSAGE BODY: HTML included in message 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 0.0 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars 0.6 URIBL_SBL Contains an URL's NS IP listed in the SBL blocklist [URIs: 185.111.75.119] 0.0 T_REMOTE_IMAGE Message contains an external image 2016-12-10 02:14:13Latin Women who are Ready to Datehttp://scammed.by/scam.php?id=208139 thought attention day Trifling Widow Latin Women who are Ready to Date SpamAssassin Report (spam score: 3.1) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: 185.111.75.48] 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [209.85.210.174 listed in list.dnswl.org] 0.5 RCVD_IN_SORBS_SPAM RBL: SORBS: sender is a spam source [209.85.223.181 listed in dnsbl.sorbs.net] -0.0 SPF_PASS SPF: sender matches SPF record 0.6 URIBL_SBL Contains an URL's NS IP listed in the SBL blocklist [URIs: 185.111.75.48] 0.0 NORMAL_HTTP_TO_IP URI: URI host has a public dotted-decimal IPv4 address 0.8 HTML_IMAGE_RATIO_02 BODY: HTML has a low ratio of text to image area 0.0 HTML_MESSAGE BODY: HTML included in message 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 0.0 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars 0.0 T_REMOTE_IMAGE Message contains an external image 2016-12-10 02:06:17Latin Women who are Ready to Datehttp://scammed.by/scam.php?id=208141 thought attention day Trifling Widow Latin Women who are Ready to Date SpamAssassin Report (spam score: 3.1) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [209.85.223.179 listed in list.dnswl.org] -0.0 SPF_PASS SPF: sender matches SPF record 0.6 URIBL_SBL Contains an URL's NS IP listed in the SBL blocklist [URIs: 185.111.75.48] 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: 185.111.75.48] 0.0 NORMAL_HTTP_TO_IP URI: URI host has a public dotted-decimal IPv4 address 0.8 HTML_IMAGE_RATIO_02 BODY: HTML has a low ratio of text to image area 0.0 HTML_MESSAGE BODY: HTML included in message 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 0.0 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars 0.5 RCVD_IN_SORBS_SPAM RBL: SORBS: sender is a spam source [209.85.223.179 listed in dnsbl.sorbs.net] 0.0 T_REMOTE_IMAGE Message contains an external image 2016-12-10 02:06:15Local women are sharing naked pictures on our site now View here http://scammed.by/scam.php?id=208144 GreenGrass #Earth054544545 tr td { font-family: Arial, Helvetica, sans-serif; } SpamAssassin Report (spam score: 12.9) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [209.85.210.172 listed in list.dnswl.org] 3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS [46.3.228.82 listed in zen.spamhaus.org] 2.6 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL -0.0 SPF_PASS SPF: sender matches SPF record 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: parchedeewander.loan] 2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist [URIs: parchedeewander.loan] 0.7 HTML_TAG_BALANCE_BODY BODY: HTML has unbalanced "body" tags 0.0 HTML_MESSAGE BODY: HTML included in message 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 1.0 HTML_IMAGE_ONLY_16 BODY: HTML: images with 1200-1600 bytes of words 0.0 AC_BR_BONANZA RAW: Too many newlines in a row... spammy template 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid 0.3 HTML_SHORT_LINK_IMG_2 HTML is very short with a linked image 0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid 1.0 BODY_SINGLE_WORD Message body is only one word (no spaces) 2016-12-10 02:02:57Local women are sharing naked pictures on our site now View here http://scammed.by/scam.php?id=208137 GreenGrass #Earth054544545 tr td { font-family: Arial, Helvetica, sans-serif; } SpamAssassin Report (spam score: 13.4) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: parchedeewander.loan] 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [209.85.223.179 listed in list.dnswl.org] 3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS [46.3.228.82 listed in zen.spamhaus.org] 2.6 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL -0.0 SPF_PASS SPF: sender matches SPF record 2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist [URIs: parchedeewander.loan] 0.7 HTML_TAG_BALANCE_BODY BODY: HTML has unbalanced "body" tags 0.0 HTML_MESSAGE BODY: HTML included in message 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 1.0 HTML_IMAGE_ONLY_16 BODY: HTML: images with 1200-1600 bytes of words 0.0 AC_BR_BONANZA RAW: Too many newlines in a row... spammy template 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid 0.5 RCVD_IN_SORBS_SPAM RBL: SORBS: sender is a spam source [209.85.223.179 listed in dnsbl.sorbs.net] 0.3 HTML_SHORT_LINK_IMG_2 HTML is very short with a linked image 0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid 0.0 BODY_SINGLE_URI Message body is only a URI 1.0 BODY_SINGLE_WORD Message body is only one word (no spaces) 2016-12-10 02:02:56Compare Prices for Security Cameras Wireless http://scammed.by/scam.php?id=208140 Family paid of played House Compare Prices for Security Cameras (Wireless) SpamAssassin Report (spam score: 13.9) pts rule name description ---- ---------------------- -------------------------------------------------- 1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist [URIs: abifu.top] 2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist [URIs: dumowe.top] 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [209.85.210.178 listed in list.dnswl.org] 3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS [185.111.75.153 listed in zen.spamhaus.org] 2.6 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL -0.0 SPF_PASS SPF: sender matches SPF record 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: dumowe.top] 0.8 HTML_IMAGE_RATIO_02 BODY: HTML has a low ratio of text to image area 0.0 HTML_MESSAGE BODY: HTML included in message 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 1.0 HTML_IMAGE_ONLY_16 BODY: HTML: images with 1200-1600 bytes of words 0.0 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid 0.3 HTML_SHORT_LINK_IMG_2 HTML is very short with a linked image 0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid 0.0 T_REMOTE_IMAGE Message contains an external image 2016-12-10 01:58:31Compare Prices for Security Cameras Wireless http://scammed.by/scam.php?id=208136 Family paid of played House Compare Prices for Security Cameras (Wireless) SpamAssassin Report (spam score: 14.4) pts rule name description ---- ---------------------- -------------------------------------------------- 1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist [URIs: dumowe.top] 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address 2.6 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL [185.111.75.153 listed in zen.spamhaus.org] 3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [209.85.223.177 listed in list.dnswl.org] 0.5 RCVD_IN_SORBS_SPAM RBL: SORBS: sender is a spam source [209.85.223.177 listed in dnsbl.sorbs.net] -0.0 SPF_PASS SPF: sender matches SPF record 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: dumowe.top] 2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist [URIs: dumowe.top] 0.8 HTML_IMAGE_RATIO_02 BODY: HTML has a low ratio of text to image area 0.0 HTML_MESSAGE BODY: HTML included in message 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 1.0 HTML_IMAGE_ONLY_16 BODY: HTML: images with 1200-1600 bytes of words 0.0 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid 0.3 HTML_SHORT_LINK_IMG_2 HTML is very short with a linked image 0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid 0.0 T_REMOTE_IMAGE Message contains an external image 2016-12-10 01:58:29[ALERT] You Got a Glance from Yukiko from Sapporo http://scammed.by/scam.php?id=208133 Attachment Sending Always Wrote lovers [ALERT] You Got a Glance from Yukiko (from Sapporo) SpamAssassin Report (spam score: ) pts rule name undefined2016-12-10 01:48:09[ALERT] You Got a Glance from Yukiko from Sapporo http://scammed.by/scam.php?id=208138 Attachment Sending Always Wrote lovers [ALERT] You Got a Glance from Yukiko (from Sapporo) SpamAssassin Report (spam score: 8.0) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address 0.5 RCVD_IN_SORBS_SPAM RBL: SORBS: sender is a spam source [209.85.223.171 listed in dnsbl.sorbs.net] -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [209.85.223.179 listed in list.dnswl.org] -0.0 SPF_PASS SPF: sender matches SPF record 0.6 URIBL_SBL Contains an URL's NS IP listed in the SBL blocklist [URIs: 185.111.75.206] 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: 185.111.75.206] 0.0 NORMAL_HTTP_TO_IP URI: URI host has a public dotted-decimal IPv4 address 0.8 HTML_IMAGE_RATIO_02 BODY: HTML has a low ratio of text to image area 1.3 HTML_IMAGE_ONLY_24 BODY: HTML: images with 2000-2400 bytes of words 0.0 HTML_MESSAGE BODY: HTML included in message 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 0.0 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars 3.6 RCVD_IN_SORBS_WEB RBL: SORBS: sender is an abusable web server [74.125.82.52 listed in dnsbl.sorbs.net] 0.0 T_REMOTE_IMAGE Message contains an external image 2016-12-10 01:48:07HOT ENOUGH FOR YA?? This is an Email From Your HVAC Contractor of Recordhttp://scammed.by/scam.php?id=208132 address Article cold trees nor HOT ENOUGH FOR YA?? This is an Email From Your HVAC Contractor of Record SpamAssassin Report (spam score: 4.4) pts rule name description ---- ---------------------- -------------------------------------------------- -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [209.85.210.177 listed in list.dnswl.org] 0.6 URIBL_SBL Contains an URL's NS IP listed in the SBL blocklist [URIs: 185.111.75.206] 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: 185.111.75.206] 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address -0.0 SPF_PASS SPF: sender matches SPF record 0.0 NORMAL_HTTP_TO_IP URI: URI host has a public dotted-decimal IPv4 address 0.8 HTML_IMAGE_RATIO_02 BODY: HTML has a low ratio of text to image area 1.3 HTML_IMAGE_ONLY_24 BODY: HTML: images with 2000-2400 bytes of words 0.0 HTML_MESSAGE BODY: HTML included in message 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 0.0 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars 0.5 RCVD_IN_SORBS_SPAM RBL: SORBS: sender is a spam source [209.85.223.171 listed in dnsbl.sorbs.net] 0.0 T_REMOTE_IMAGE Message contains an external image 2016-12-10 01:46:04HOT ENOUGH FOR YA?? This is an Email From Your HVAC Contractor of Recordhttp://scammed.by/scam.php?id=208135 address Article cold trees nor HOT ENOUGH FOR YA?? This is an Email From Your HVAC Contractor of Record SpamAssassin Report (spam score: 3.7) pts rule name description ---- ---------------------- -------------------------------------------------- -0.7 RCVD_IN_DNSWL_LOW RBL: Sender listed at http://www.dnswl.org/, low trust [209.85.223.169 listed in list.dnswl.org] 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address -0.0 SPF_PASS SPF: sender matches SPF record 0.6 URIBL_SBL Contains an URL's NS IP listed in the SBL blocklist [URIs: 185.111.75.206] 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: 185.111.75.206] 0.0 NORMAL_HTTP_TO_IP URI: URI host has a public dotted-decimal IPv4 address 0.8 HTML_IMAGE_RATIO_02 BODY: HTML has a low ratio of text to image area 1.3 HTML_IMAGE_ONLY_24 BODY: HTML: images with 2000-2400 bytes of words 0.0 HTML_MESSAGE BODY: HTML included in message 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 0.0 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars 0.5 RCVD_IN_SORBS_SPAM RBL: SORBS: sender is a spam source [209.85.223.176 listed in dnsbl.sorbs.net] 0.0 T_REMOTE_IMAGE Message contains an external image 2016-12-10 01:46:03Sexy Singles Meet On This Sitehttp://scammed.by/scam.php?id=208129 you invitation Enough Recurred principles Sexy Singles Meet On This Site SpamAssassin Report (spam score: 3.1) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address 0.5 RCVD_IN_SORBS_SPAM RBL: SORBS: sender is a spam source [74.125.82.42 listed in dnsbl.sorbs.net] -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [74.125.82.42 listed in list.dnswl.org] -0.0 SPF_PASS SPF: sender matches SPF record 0.6 URIBL_SBL Contains an URL's NS IP listed in the SBL blocklist [URIs: 185.111.75.173] 0.0 NORMAL_HTTP_TO_IP URI: URI host has a public dotted-decimal IPv4 address 0.0 HTML_IMAGE_ONLY_32 BODY: HTML: images with 2800-3200 bytes of words 0.8 HTML_IMAGE_RATIO_02 BODY: HTML has a low ratio of text to image area 0.0 HTML_MESSAGE BODY: HTML included in message 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 0.0 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: 185.111.75.173] 0.0 T_REMOTE_IMAGE Message contains an external image 2016-12-10 01:36:40Sexy Singles Meet On This Sitehttp://scammed.by/scam.php?id=208134 you invitation Enough Recurred principles Sexy Singles Meet On This Site SpamAssassin Report (spam score: 2.6) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [209.85.223.180 listed in list.dnswl.org] -0.0 SPF_PASS SPF: sender matches SPF record 0.6 URIBL_SBL Contains an URL's NS IP listed in the SBL blocklist [URIs: 185.111.75.173] 0.0 NORMAL_HTTP_TO_IP URI: URI host has a public dotted-decimal IPv4 address 0.0 HTML_IMAGE_ONLY_32 BODY: HTML: images with 2800-3200 bytes of words 0.8 HTML_IMAGE_RATIO_02 BODY: HTML has a low ratio of text to image area 0.0 HTML_MESSAGE BODY: HTML included in message 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 0.0 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: 185.111.75.173] 0.0 T_REMOTE_IMAGE Message contains an external image 2016-12-10 01:36:38Local Ukrainian Beauties Looking for Dateshttp://scammed.by/scam.php?id=208127 WinterCoat #Little450840480 tr td { font-family: Arial, Helvetica, sans-serif; } SpamAssassin Report (spam score: 13.4) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address 3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS [46.3.228.68 listed in zen.spamhaus.org] 2.6 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [209.85.210.182 listed in list.dnswl.org] -0.0 SPF_PASS SPF: sender matches SPF record 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: parchedeewander.loan] 2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist [URIs: parchedeewander.loan] 0.7 HTML_TAG_BALANCE_BODY BODY: HTML has unbalanced "body" tags 1.6 HTML_IMAGE_ONLY_12 BODY: HTML: images with 800-1200 bytes of words 0.0 HTML_MESSAGE BODY: HTML included in message 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 0.0 AC_BR_BONANZA RAW: Too many newlines in a row... spammy template 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid 0.3 HTML_SHORT_LINK_IMG_2 HTML is very short with a linked image 0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid 1.0 BODY_SINGLE_WORD Message body is only one word (no spaces) 2016-12-10 01:31:53Local Ukrainian Beauties Looking for Dateshttp://scammed.by/scam.php?id=208130 WinterCoat #Little450840480 tr td { font-family: Arial, Helvetica, sans-serif; } SpamAssassin Report (spam score: 13.4) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [209.85.223.175 listed in list.dnswl.org] 2.6 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL [46.3.228.68 listed in zen.spamhaus.org] 3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS -0.0 SPF_PASS SPF: sender matches SPF record 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: parchedeewander.loan] 2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist [URIs: parchedeewander.loan] 0.7 HTML_TAG_BALANCE_BODY BODY: HTML has unbalanced "body" tags 1.6 HTML_IMAGE_ONLY_12 BODY: HTML: images with 800-1200 bytes of words 0.0 HTML_MESSAGE BODY: HTML included in message 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 0.0 AC_BR_BONANZA RAW: Too many newlines in a row... spammy template 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid 0.3 HTML_SHORT_LINK_IMG_2 HTML is very short with a linked image 0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid 1.0 BODY_SINGLE_WORD Message body is only one word (no spaces) 2016-12-10 01:31:52Knee Braces That Provide Full Stabilityhttp://scammed.by/scam.php?id=208131 unsatiable Wrong strictly fruit so Knee Braces That Provide Full Stability SpamAssassin Report (spam score: 2.6) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [209.85.210.177 listed in list.dnswl.org] -0.0 SPF_PASS SPF: sender matches SPF record 0.6 URIBL_SBL Contains an URL's NS IP listed in the SBL blocklist [URIs: 185.111.75.236] 0.0 NORMAL_HTTP_TO_IP URI: URI host has a public dotted-decimal IPv4 address 0.8 HTML_IMAGE_RATIO_02 BODY: HTML has a low ratio of text to image area 0.0 HTML_MESSAGE BODY: HTML included in message 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 0.0 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: 185.111.75.236] 0.0 T_REMOTE_IMAGE Message contains an external image 2016-12-10 01:30:45Knee Braces That Provide Full Stabilityhttp://scammed.by/scam.php?id=208125 unsatiable Wrong strictly fruit so Knee Braces That Provide Full Stability SpamAssassin Report (spam score: 3.1) pts rule name description ---- ---------------------- -------------------------------------------------- 0.6 URIBL_SBL Contains an URL's NS IP listed in the SBL blocklist [URIs: 185.111.75.236] 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [209.85.223.176 listed in list.dnswl.org] -0.0 SPF_PASS SPF: sender matches SPF record 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: 185.111.75.236] 0.0 NORMAL_HTTP_TO_IP URI: URI host has a public dotted-decimal IPv4 address 0.8 HTML_IMAGE_RATIO_02 BODY: HTML has a low ratio of text to image area 0.0 HTML_MESSAGE BODY: HTML included in message 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 0.0 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars 0.5 RCVD_IN_SORBS_SPAM RBL: SORBS: sender is a spam source [209.85.223.176 listed in dnsbl.sorbs.net] 0.0 T_REMOTE_IMAGE Message contains an external image 2016-12-10 01:30:43Improve Joint Functionhttp://scammed.by/scam.php?id=208128 will Excuse Admitting brandon Led Improve Joint Function SpamAssassin Report (spam score: 3.1) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: 185.111.75.73] 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [74.125.82.41 listed in list.dnswl.org] -0.0 SPF_PASS SPF: sender matches SPF record 0.6 URIBL_SBL Contains an URL's NS IP listed in the SBL blocklist [URIs: 185.111.75.73] 0.0 NORMAL_HTTP_TO_IP URI: URI host has a public dotted-decimal IPv4 address 0.8 HTML_IMAGE_RATIO_02 BODY: HTML has a low ratio of text to image area 0.0 HTML_MESSAGE BODY: HTML included in message 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 0.0 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars 0.5 RCVD_IN_SORBS_SPAM RBL: SORBS: sender is a spam source [209.85.223.173 listed in dnsbl.sorbs.net] 0.0 T_REMOTE_IMAGE Message contains an external image 2016-12-10 01:23:21Improve Joint Functionhttp://scammed.by/scam.php?id=208124 will Excuse Admitting brandon Led Improve Joint Function SpamAssassin Report (spam score: 3.1) pts rule name description ---- ---------------------- -------------------------------------------------- -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [209.85.223.177 listed in list.dnswl.org] 0.6 URIBL_SBL Contains an URL's NS IP listed in the SBL blocklist [URIs: 185.111.75.73] 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address -0.0 SPF_PASS SPF: sender matches SPF record 0.0 NORMAL_HTTP_TO_IP URI: URI host has a public dotted-decimal IPv4 address 0.8 HTML_IMAGE_RATIO_02 BODY: HTML has a low ratio of text to image area 0.0 HTML_MESSAGE BODY: HTML included in message 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 0.0 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: 185.111.75.73] 0.5 RCVD_IN_SORBS_SPAM RBL: SORBS: sender is a spam source [209.85.223.177 listed in dnsbl.sorbs.net] 0.0 T_REMOTE_IMAGE Message contains an external image 2016-12-10 01:23:17RE Your entitlementhttp://scammed.by/scam.php?id=208126 This message is the last notification about U USD14.5 million bearing our Name as Beneficiary, all effort to reach you have not be successful, Please if you Receive this message kindly respond back stating your Desire to make the claim, Reconfirm your full name and age Mr. Mr.Campbell Neiman SpamAssassin Report (spam score: 4.7) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address 0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider (campbellneiman[at]att.net) -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [209.85.210.169 listed in list.dnswl.org] -0.0 SPF_PASS SPF: sender matches SPF record 1.2 MISSING_HEADERS Missing To: header 0.5 RCVD_IN_SORBS_SPAM RBL: SORBS: sender is a spam source [209.85.223.171 listed in dnsbl.sorbs.net] 0.0 LOTS_OF_MONEY Huge... sums of money 1.9 REPLYTO_WITHOUT_TO_CC REPLYTO_WITHOUT_TO_CC 1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different freemails 2016-12-10 01:22:02RE Your entitlementhttp://scammed.by/scam.php?id=208123 This message is the last notification about U USD14.5 million bearing our Name as Beneficiary, all effort to reach you have not be successful, Please if you Receive this message kindly respond back stating your Desire to make the claim, Reconfirm your full name and age Mr. Mr.Campbell Neiman SpamAssassin Report (spam score: 4.7) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address 0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider (campbellneiman[at]att.net) -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [209.85.223.171 listed in list.dnswl.org] -0.0 SPF_PASS SPF: sender matches SPF record 1.2 MISSING_HEADERS Missing To: header 0.5 RCVD_IN_SORBS_SPAM RBL: SORBS: sender is a spam source [209.85.223.171 listed in dnsbl.sorbs.net] 0.0 LOTS_OF_MONEY Huge... sums of money 1.9 REPLYTO_WITHOUT_TO_CC REPLYTO_WITHOUT_TO_CC 1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different freemails 2016-12-10 01:21:58Get Your Supplies Herehttp://scammed.by/scam.php?id=208122 Parlors Collecting deny delightful easy Get Your Supplies Here SpamAssassin Report (spam score: 3.1) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [74.125.82.46 listed in list.dnswl.org] -0.0 SPF_PASS SPF: sender matches SPF record 0.6 URIBL_SBL Contains an URL's NS IP listed in the SBL blocklist [URIs: 185.111.75.122] 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: 185.111.75.122] 0.0 NORMAL_HTTP_TO_IP URI: URI host has a public dotted-decimal IPv4 address 0.8 HTML_IMAGE_RATIO_02 BODY: HTML has a low ratio of text to image area 0.0 HTML_MESSAGE BODY: HTML included in message 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 0.0 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars 0.5 RCVD_IN_SORBS_SPAM RBL: SORBS: sender is a spam source [209.85.223.176 listed in dnsbl.sorbs.net] 0.0 T_REMOTE_IMAGE Message contains an external image 2016-12-10 00:45:11Get Your Supplies Herehttp://scammed.by/scam.php?id=208120 Parlors Collecting deny delightful easy Get Your Supplies Here SpamAssassin Report (spam score: 3.1) pts rule name description ---- ---------------------- -------------------------------------------------- -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [209.85.223.179 listed in list.dnswl.org] 0.6 URIBL_SBL Contains an URL's NS IP listed in the SBL blocklist [URIs: 185.111.75.122] 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address -0.0 SPF_PASS SPF: sender matches SPF record 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: 185.111.75.122] 0.0 NORMAL_HTTP_TO_IP URI: URI host has a public dotted-decimal IPv4 address 0.8 HTML_IMAGE_RATIO_02 BODY: HTML has a low ratio of text to image area 0.0 HTML_MESSAGE BODY: HTML included in message 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 0.0 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars 0.5 RCVD_IN_SORBS_SPAM RBL: SORBS: sender is a spam source [209.85.223.179 listed in dnsbl.sorbs.net] 0.0 T_REMOTE_IMAGE Message contains an external image 2016-12-10 00:45:09Alert from Your Roofing Professional: Your December Quote is About to Expirehttp://scammed.by/scam.php?id=208119 absolute john fertile Avoid instantly Alert from Your Roofing Professional: Your December Quote is About to Expire SpamAssassin Report (spam score: 12.6) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: ofewi.top] 1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist [URIs: vvidoa.top] 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [74.125.82.44 listed in list.dnswl.org] 2.6 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL [93.76.134.186 listed in zen.spamhaus.org] 3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS -0.0 SPF_PASS SPF: sender matches SPF record 2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist [URIs: ofewi.top] 0.0 HTML_IMAGE_ONLY_32 BODY: HTML: images with 2800-3200 bytes of words 0.8 HTML_IMAGE_RATIO_02 BODY: HTML has a low ratio of text to image area 0.0 HTML_MESSAGE BODY: HTML included in message 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 0.0 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid 0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid 0.0 T_REMOTE_IMAGE Message contains an external image 2016-12-10 00:36:33Alert from Your Roofing Professional: Your December Quote is About to Expirehttp://scammed.by/scam.php?id=208121 absolute john fertile Avoid instantly Alert from Your Roofing Professional: Your December Quote is About to Expire SpamAssassin Report (spam score: 12.6) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [209.85.218.45 listed in list.dnswl.org] 3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS [93.76.134.186 listed in zen.spamhaus.org] 2.6 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL -0.0 SPF_PASS SPF: sender matches SPF record 2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist [URIs: ofewi.top] 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: ofewi.top] 1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist [URIs: ofewi.top] 0.0 HTML_IMAGE_ONLY_32 BODY: HTML: images with 2800-3200 bytes of words 0.8 HTML_IMAGE_RATIO_02 BODY: HTML has a low ratio of text to image area 0.0 HTML_MESSAGE BODY: HTML included in message 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 0.0 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid 0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid 0.0 T_REMOTE_IMAGE Message contains an external image 2016-12-10 00:36:33Wife Walked In AMAZING http://scammed.by/scam.php?id=208117 Wife Walked In - AMAZING! "Take them both!" he shouted. "The warriors of Pal-ul-don will choose their own king after the assassin of Ko-tan has paid the penalty of his treachery." SpamAssassin Report (spam score: 2.2) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [74.125.82.43 listed in list.dnswl.org] -0.0 SPF_PASS SPF: sender matches SPF record 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: antiver.xyz] 0.7 HTML_IMAGE_ONLY_20 BODY: HTML: images with 1600-2000 bytes of words 0.0 HTML_MESSAGE BODY: HTML included in message 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 0.0 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars 0.3 HTML_SHORT_LINK_IMG_3 HTML is very short with a linked image 0.0 T_HTML_TAG_BALANCE_CENTER Malformatted HTML 0.0 T_REMOTE_IMAGE Message contains an external image 2016-12-10 00:18:36Wife Walked In AMAZING http://scammed.by/scam.php?id=208115 Wife Walked In - AMAZING! "Take them both!" he shouted. "The warriors of Pal-ul-don will choose their own king after the assassin of Ko-tan has paid the penalty of his treachery." SpamAssassin Report (spam score: 2.7) pts rule name description ---- ---------------------- -------------------------------------------------- 0.5 RCVD_IN_SORBS_SPAM RBL: SORBS: sender is a spam source [209.85.223.177 listed in dnsbl.sorbs.net] 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address -0.0 SPF_PASS SPF: sender matches SPF record 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: antiver.xyz] 0.7 HTML_IMAGE_ONLY_20 BODY: HTML: images with 1600-2000 bytes of words 0.0 HTML_MESSAGE BODY: HTML included in message 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts2016-12-10 00:18:35For You: Your FREE psychic reading is available Verify online Valid today only http://scammed.by/scam.php?id=208118 LittleChild #Future04545405 tr td { font-family: Arial, Helvetica, sans-serif; } SpamAssassin Report (spam score: 12.6) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [209.85.210.176 listed in list.dnswl.org] 2.6 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL [46.3.251.82 listed in zen.spamhaus.org] 3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS -0.0 SPF_PASS SPF: sender matches SPF record 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: greaseeesoft.loan] 2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist [URIs: greaseeesoft.loan] 0.7 HTML_TAG_BALANCE_BODY BODY: HTML has unbalanced "body" tags 0.7 HTML_IMAGE_ONLY_20 BODY: HTML: images with 1600-2000 bytes of words 0.0 HTML_MESSAGE BODY: HTML included in message 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 0.0 AC_BR_BONANZA RAW: Too many newlines in a row... spammy template 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid 0.3 HTML_SHORT_LINK_IMG_3 HTML is very short with a linked image 0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid 1.0 BODY_SINGLE_WORD Message body is only one word (no spaces) 2016-12-10 00:18:01For You: Your FREE psychic reading is available Verify online Valid today only http://scammed.by/scam.php?id=208114 LittleChild #Future04545405 tr td { font-family: Arial, Helvetica, sans-serif; } SpamAssassin Report (spam score: 12.6) pts rule name description ---- ---------------------- -------------------------------------------------- 2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist [URIs: greaseeesoft.loan] 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [209.85.218.53 listed in list.dnswl.org] 2.6 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL [46.3.251.82 listed in zen.spamhaus.org] 3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: greaseeesoft.loan] -0.0 SPF_PASS SPF: sender matches SPF record 0.7 HTML_TAG_BALANCE_BODY BODY: HTML has unbalanced "body" tags 0.7 HTML_IMAGE_ONLY_20 BODY: HTML: images with 1600-2000 bytes of words 0.0 HTML_MESSAGE BODY: HTML included in message 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 0.0 AC_BR_BONANZA RAW: Too many newlines in a row... spammy template 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid 0.3 HTML_SHORT_LINK_IMG_3 HTML is very short with a linked image 0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid 0.0 BODY_SINGLE_URI Message body is only a URI 1.0 BODY_SINGLE_WORD Message body is only one word (no spaces) 2016-12-10 00:18:00Brianna Has Sent You a Snap Sexthttp://scammed.by/scam.php?id=208116 DoorLock #Intruder04504540540 tr td { font-family: Arial, Helvetica, sans-serif; } SpamAssassin Report (spam score: 17.0) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [74.125.82.52 listed in list.dnswl.org] 3.6 RCVD_IN_SORBS_WEB RBL: SORBS: sender is an abusable web server [74.125.82.52 listed in dnsbl.sorbs.net] -0.0 SPF_PASS SPF: sender matches SPF record 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: culturedeenecessary.loan] 2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist [URIs: culturedeenecessary.loan] 0.7 HTML_TAG_BALANCE_BODY BODY: HTML has unbalanced "body" tags 1.6 HTML_IMAGE_ONLY_12 BODY: HTML: images with 800-1200 bytes of words 0.0 HTML_MESSAGE BODY: HTML included in message 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 0.0 AC_BR_BONANZA RAW: Too many newlines in a row... spammy template 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid 3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS [181.177.67.165 listed in zen.spamhaus.org] 2.6 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL 0.3 HTML_SHORT_LINK_IMG_2 HTML is very short with a linked image 0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid 1.0 BODY_SINGLE_WORD Message body is only one word (no spaces) 2016-12-10 00:13:00Brianna Has Sent You a Snap Sexthttp://scammed.by/scam.php?id=208112 DoorLock #Intruder04504540540 tr td { font-family: Arial, Helvetica, sans-serif; } SpamAssassin Report (spam score: 12.7) pts rule name description ---- ---------------------- -------------------------------------------------- 2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist [URIs: culturedeenecessary.loan] 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address 3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS [181.177.67.165 listed in zen.spamhaus.org] 2.6 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL -0.7 RCVD_IN_DNSWL_LOW RBL: Sender listed at http://www.dnswl.org/, low trust [209.85.218.46 listed in list.dnswl.org] -0.0 SPF_PASS SPF: sender matches SPF record 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: culturedeenecessary.loan] 0.7 HTML_TAG_BALANCE_BODY BODY: HTML has unbalanced "body" tags 1.6 HTML_IMAGE_ONLY_12 BODY: HTML: images with 800-1200 bytes of words 0.0 HTML_MESSAGE BODY: HTML included in message 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 0.0 AC_BR_BONANZA RAW: Too many newlines in a row... spammy template 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid 0.3 HTML_SHORT_LINK_IMG_2 HTML is very short with a linked image 0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid 1.0 BODY_SINGLE_WORD Message body is only one word (no spaces) 2016-12-10 00:12:59You May Qualify: Complimentary Test Drive With a Used SUV In Your Town Choose Two of Three Local Offers http://scammed.by/scam.php?id=208113 Supposing never raptures Misery Talent You May Qualify: Complimentary Test Drive With a Used SUV In Your Town (Choose Two of Three Local Offers) SpamAssassin Report (spam score: 4.4) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [74.125.82.45 listed in list.dnswl.org] -0.0 SPF_PASS SPF: sender matches SPF record 0.5 RCVD_IN_SORBS_SPAM RBL: SORBS: sender is a spam source [209.85.223.171 listed in dnsbl.sorbs.net] 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: 185.111.75.40] 0.6 URIBL_SBL Contains an URL's NS IP listed in the SBL blocklist [URIs: 185.111.75.40] 0.0 NORMAL_HTTP_TO_IP URI: URI host has a public dotted-decimal IPv4 address 0.8 HTML_IMAGE_RATIO_02 BODY: HTML has a low ratio of text to image area 0.0 HTML_MESSAGE BODY: HTML included in message 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 1.0 HTML_IMAGE_ONLY_16 BODY: HTML: images with 1200-1600 bytes of words 0.0 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars 0.3 HTML_SHORT_LINK_IMG_2 HTML is very short with a linked image 0.0 T_REMOTE_IMAGE Message contains an external image 2016-12-10 00:07:55You May Qualify: Complimentary Test Drive With a Used SUV In Your Town Choose Two of Three Local Offers http://scammed.by/scam.php?id=208110 Supposing never raptures Misery Talent You May Qualify: Complimentary Test Drive With a Used SUV In Your Town (Choose Two of Three Local Offers) SpamAssassin Report (spam score: 3.9) pts rule name description ---- ---------------------- -------------------------------------------------- -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [209.85.218.42 listed in list.dnswl.org] 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: 185.111.75.40] 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address -0.0 SPF_PASS SPF: sender matches SPF record 0.6 URIBL_SBL Contains an URL's NS IP listed in the SBL blocklist [URIs: 185.111.75.40] 0.0 NORMAL_HTTP_TO_IP URI: URI host has a public dotted-decimal IPv4 address 0.8 HTML_IMAGE_RATIO_02 BODY: HTML has a low ratio of text to image area 0.0 HTML_MESSAGE BODY: HTML included in message 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 1.0 HTML_IMAGE_ONLY_16 BODY: HTML: images with 1200-1600 bytes of words 0.0 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars 0.3 HTML_SHORT_LINK_IMG_2 HTML is very short with a linked image 0.0 T_REMOTE_IMAGE Message contains an external image 2016-12-10 00:07:53Sexy single Brazilian women want to date you View pics http://scammed.by/scam.php?id=208109 PoolWarm #Temperature045484504 tr td { font-family: Arial, Helvetica, sans-serif; } SpamAssassin Report (spam score: 12.9) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 2016-12-09 23:56:13Sexy single Brazilian women want to date you View pics http://scammed.by/scam.php?id=208111 PoolWarm #Temperature045484504 tr td { font-family: Arial, Helvetica, sans-serif; } SpamAssassin Report (spam score: 13.4) pts rule name description ---- ---------------------- -------------------------------------------------- 0.5 RCVD_IN_SORBS_SPAM RBL: SORBS: sender is a spam source [209.85.223.177 listed in dnsbl.sorbs.net] 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [209.85.223.177 listed in list.dnswl.org] 2.6 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL [46.3.228.68 listed in zen.spamhaus.org] 3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS -0.0 SPF_PASS SPF: sender matches SPF record 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: parchedeewander.loan] 2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist [URIs: parchedeewander.loan] 0.7 HTML_TAG_BALANCE_BODY BODY: HTML has unbalanced "body" tags 0.0 HTML_MESSAGE BODY: HTML included in message 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 1.0 HTML_IMAGE_ONLY_16 BODY: HTML: images with 1200-1600 bytes of words 0.0 AC_BR_BONANZA RAW: Too many newlines in a row... spammy template 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid 0.3 HTML_SHORT_LINK_IMG_2 HTML is very short with a linked image 0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid 0.0 BODY_SINGLE_URI Message body is only a URI 1.0 BODY_SINGLE_WORD Message body is only one word (no spaces) 2016-12-09 23:56:12Good dayhttp://scammed.by/scam.php?id=208108 Attn: We have deposited the check of your fund ($2.70000000 USD) through Western Union department after our finally meeting regarding your fund, All you will dais to contact Western Union director DR. Ben Johnson, via E-mail (wu995813@gmail.com). He will give you direction on how you will be receiving the funds daily.Remember to send him your Full information to avoid wrong transfer such as, Receiver's Name_______________ Address: ________________ Country: _____________ Phone Number: _____________ He has sent $5000 in your name today so contact DR. Ben Johnson or you call him on(+22968552138) as soon as you receive this email and tell him to give you the MTCN, sender name and question/answer to pick the $5000 Please let us know as soon as you received all your fund, Best Regards. MRS Greace williams SpamAssassin Report (spam score: 4.2) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address 0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider (jenny.ferrari[at]alice.it) 1.2 MISSING_HEADERS Missing To: header 0.0 LOTS_OF_MONEY Huge... sums of money 1.9 REPLYTO_WITHOUT_TO_CC REPLYTO_WITHOUT_TO_CC 1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different freemails 0.0 MONEY_FROM_41 Lots of money from Africa 0.0 SPOOFED_FREEM_REPTO Forged freemail sender with freemail reply-to 2016-12-09 23:50:56É Mágica? Só precisa de alguns segundos e http://scammed.by/scam.php?id=208107 Transforme frutas em sobremesas deliciosas. http://www.rp2comercio.com.br/landing/yofruit/?utm_medium=emailandutm_source=dm_loja_yofruit_dez SpamAssassin Report (spam score: 1.9) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [74.125.82.49 listed in list.dnswl.org] -0.0 SPF_PASS SPF: sender matches SPF record 1.9 MIME_NO_TEXT No (properly identified) text body parts 2016-12-09 23:42:46Meet 50 Singles Near You Todayhttp://scammed.by/scam.php?id=208106 PillBox #Medicine054548455 tr td { font-family: Arial, Helvetica, sans-serif; } SpamAssassin Report (spam score: 13.4) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: foodeeadventurous.loan] 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address 2.6 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL [200.3.141.127 listed in zen.spamhaus.org] 3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [209.85.210.172 listed in list.dnswl.org] -0.0 SPF_PASS SPF: sender matches SPF record 2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist [URIs: foodeeadventurous.loan] 0.7 HTML_TAG_BALANCE_BODY BODY: HTML has unbalanced "body" tags 1.6 HTML_IMAGE_ONLY_12 BODY: HTML: images with 800-1200 bytes of words 0.0 HTML_MESSAGE BODY: HTML included in message 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid 0.3 HTML_SHORT_LINK_IMG_2 HTML is very short with a linked image 0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid 0.0 BODY_SINGLE_URI Message body is only a URI 1.0 BODY_SINGLE_WORD Message body is only one word (no spaces) 2016-12-09 23:32:03Meet 50 Singles Near You Todayhttp://scammed.by/scam.php?id=208105 PillBox #Medicine054548455 tr td { font-family: Arial, Helvetica, sans-serif; } SpamAssassin Report (spam score: 13.9) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address 0.5 RCVD_IN_SORBS_SPAM RBL: SORBS: sender is a spam source [209.85.223.176 listed in dnsbl.sorbs.net] -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [209.85.223.176 listed in list.dnswl.org] 2.6 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL [200.3.141.127 listed in zen.spamhaus.org] 3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS -0.0 SPF_PASS SPF: sender matches SPF record 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: foodeeadventurous.loan] 2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist [URIs: foodeeadventurous.loan] 0.7 HTML_TAG_BALANCE_BODY BODY: HTML has unbalanced "body" tags 1.6 HTML_IMAGE_ONLY_12 BODY: HTML: images with 800-1200 bytes of words 0.0 HTML_MESSAGE BODY: HTML included in message 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid 0.3 HTML_SHORT_LINK_IMG_2 HTML is very short with a linked image 0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid 1.0 BODY_SINGLE_WORD Message body is only one word (no spaces) 2016-12-09 23:32:02Meet your Asian beautyhttp://scammed.by/scam.php?id=208099 allow forbade astonished Estimating Tended Meet your Asian beauty SpamAssassin Report (spam score: 6.2) pts rule name description ---- ---------------------- -------------------------------------------------- 3.6 RCVD_IN_SORBS_WEB RBL: SORBS: sender is an abusable web server [74.125.82.52 listed in dnsbl.sorbs.net] -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [74.125.82.46 listed in list.dnswl.org] 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address -0.0 SPF_PASS SPF: sender matches SPF record 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: 185.111.75.229] 0.6 URIBL_SBL Contains an URL's NS IP listed in the SBL blocklist [URIs: 185.111.75.229] 0.0 NORMAL_HTTP_TO_IP URI: URI host has a public dotted-decimal IPv4 address 0.8 HTML_IMAGE_RATIO_02 BODY: HTML has a low ratio of text to image area 0.0 HTML_MESSAGE BODY: HTML included in message 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 0.0 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars 0.0 T_REMOTE_IMAGE Message contains an external image 2016-12-09 23:00:38Meet your Asian beautyhttp://scammed.by/scam.php?id=208102 allow forbade astonished Estimating Tended Meet your Asian beauty SpamAssassin Report (spam score: 6.7) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address 3.6 RCVD_IN_SORBS_WEB RBL: SORBS: sender is an abusable web server [74.125.82.52 listed in dnsbl.sorbs.net] -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [209.85.223.181 listed in list.dnswl.org] -0.0 SPF_PASS SPF: sender matches SPF record 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: 185.111.75.229] 0.0 NORMAL_HTTP_TO_IP URI: URI host has a public dotted-decimal IPv4 address 0.8 HTML_IMAGE_RATIO_02 BODY: HTML has a low ratio of text to image area 0.0 HTML_MESSAGE BODY: HTML included in message 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 0.0 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars 0.6 URIBL_SBL Contains an URL's NS IP listed in the SBL blocklist [URIs: 185.111.75.229] 0.5 RCVD_IN_SORBS_SPAM RBL: SORBS: sender is a spam source [209.85.223.181 listed in dnsbl.sorbs.net] 0.0 T_REMOTE_IMAGE Message contains an external image 2016-12-09 23:00:38Get DISH and FREE HD for Lifehttp://scammed.by/scam.php?id=208104 SausageBreak #Breakfast54054048 tr td { font-family: Arial, Helvetica, sans-serif; } SpamAssassin Report (spam score: 13.4) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [74.125.82.50 listed in list.dnswl.org] 2.6 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL [196.63.241.203 listed in zen.spamhaus.org] 3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS -0.0 SPF_PASS SPF: sender matches SPF record 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: womeneegoofy.loan] 2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist [URIs: womeneegoofy.loan] 0.7 HTML_TAG_BALANCE_BODY BODY: HTML has unbalanced "body" tags 1.6 HTML_IMAGE_ONLY_12 BODY: HTML: images with 800-1200 bytes of words 0.0 HTML_MESSAGE BODY: HTML included in message 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 0.0 AC_BR_BONANZA RAW: Too many newlines in a row... spammy template 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid 0.3 HTML_SHORT_LINK_IMG_2 HTML is very short with a linked image 0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid 0.0 BODY_SINGLE_URI Message body is only a URI 1.0 BODY_SINGLE_WORD Message body is only one word (no spaces) 2016-12-09 22:53:04Get DISH and FREE HD for Lifehttp://scammed.by/scam.php?id=208101 SausageBreak #Breakfast54054048 tr td { font-family: Arial, Helvetica, sans-serif; } SpamAssassin Report (spam score: 13.4) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [209.85.223.172 listed in list.dnswl.org] 2.6 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL [196.63.241.203 listed in zen.spamhaus.org] 3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS -0.0 SPF_PASS SPF: sender matches SPF record 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: womeneegoofy.loan] 2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist [URIs: womeneegoofy.loan] 0.7 HTML_TAG_BALANCE_BODY BODY: HTML has unbalanced "body" tags 1.6 HTML_IMAGE_ONLY_12 BODY: HTML: images with 800-1200 bytes of words 0.0 HTML_MESSAGE BODY: HTML included in message 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 0.0 AC_BR_BONANZA RAW: Too many newlines in a row... spammy template 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid 0.3 HTML_SHORT_LINK_IMG_2 HTML is very short with a linked image 0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid 0.0 BODY_SINGLE_URI Message body is only a URI 1.0 BODY_SINGLE_WORD Message body is only one word (no spaces) 2016-12-09 22:53:02Local women are uploading their naked pics on our website right now View them today http://scammed.by/scam.php?id=208098 GreenGrass #Earth054544545 tr td { font-family: Arial, Helvetica, sans-serif; } SpamAssassin Report (spam score: 13.4) pts rule name description ---- ---------------------- -------------------------------------------------- 2.6 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL [46.3.248.179 listed in zen.spamhaus.org] 3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS 2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist [URIs: heateespring.loan] 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: heateespring.loan] -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [74.125.82.42 listed in list.dnswl.org] 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address 0.5 RCVD_IN_SORBS_SPAM RBL: SORBS: sender is a spam source [74.125.82.42 listed in dnsbl.sorbs.net] -0.0 SPF_PASS SPF: sender matches SPF record 0.7 HTML_TAG_BALANCE_BODY BODY: HTML has unbalanced "body" tags 0.0 HTML_MESSAGE BODY: HTML included in message 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 1.0 HTML_IMAGE_ONLY_16 BODY: HTML: images with 1200-1600 bytes of words 0.0 AC_BR_BONANZA RAW: Too many newlines in a row... spammy template 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid 0.3 HTML_SHORT_LINK_IMG_2 HTML is very short with a linked image 0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid 0.0 BODY_SINGLE_URI Message body is only a URI 1.0 BODY_SINGLE_WORD Message body is only one word (no spaces) 2016-12-09 22:52:55Local women are uploading their naked pics on our website right now View them today http://scammed.by/scam.php?id=208103 GreenGrass #Earth054544545 tr td { font-family: Arial, Helvetica, sans-serif; } SpamAssassin Report (spam score: 13.4) pts rule name description ---- ---------------------- -------------------------------------------------- -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [209.85.223.173 listed in list.dnswl.org] 3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS [46.3.248.179 listed in zen.spamhaus.org] 2.6 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL 0.5 RCVD_IN_SORBS_SPAM RBL: SORBS: sender is a spam source [209.85.223.173 listed in dnsbl.sorbs.net] 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: heateespring.loan] 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address -0.0 SPF_PASS SPF: sender matches SPF record 2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist [URIs: heateespring.loan] 0.7 HTML_TAG_BALANCE_BODY BODY: HTML has unbalanced "body" tags 0.0 HTML_MESSAGE BODY: HTML included in message 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 1.0 HTML_IMAGE_ONLY_16 BODY: HTML: images with 1200-1600 bytes of words 0.0 AC_BR_BONANZA RAW: Too many newlines in a row... spammy template 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid 0.3 HTML_SHORT_LINK_IMG_2 HTML is very short with a linked image 0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid 1.0 BODY_SINGLE_WORD Message body is only one word (no spaces) 2016-12-09 22:52:53Obama Has Done it Again: On Dec 31 2016 Solar Rebates Get the Axe http://scammed.by/scam.php?id=208097 Furnished Continued Have Am Convinced fine Obama Has Done it Again: On Dec 31, 2016 Solar Rebates Get the Axe! SpamAssassin Report (spam score: 13.9) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [74.125.82.47 listed in list.dnswl.org] 3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS [93.76.132.190 listed in zen.spamhaus.org] 2.6 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL 0.5 RCVD_IN_SORBS_SPAM RBL: SORBS: sender is a spam source [74.125.82.47 listed in dnsbl.sorbs.net] -0.0 SPF_PASS SPF: sender matches SPF record 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: ubmvia.top] 1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist [URIs: oworu.top] 2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist [URIs: oworu.top] 0.8 HTML_IMAGE_RATIO_02 BODY: HTML has a low ratio of text to image area 0.7 HTML_IMAGE_ONLY_28 BODY: HTML: images with 2400-2800 bytes of words 0.0 HTML_MESSAGE BODY: HTML included in message 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 0.0 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid 0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid 0.0 T_REMOTE_IMAGE Message contains an external image 2016-12-09 22:52:02Obama Has Done it Again: On Dec 31 2016 Solar Rebates Get the Axe http://scammed.by/scam.php?id=208100 Furnished Continued Have Am Convinced fine Obama Has Done it Again: On Dec 31, 2016 Solar Rebates Get the Axe! SpamAssassin Report (spam score: 13.9) pts rule name description ---- ---------------------- -------------------------------------------------- 0.5 RCVD_IN_SORBS_SPAM RBL: SORBS: sender is a spam source [209.85.223.176 listed in dnsbl.sorbs.net] 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [209.85.223.181 listed in list.dnswl.org] 2.6 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL [93.76.132.190 listed in zen.spamhaus.org] 3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS -0.0 SPF_PASS SPF: sender matches SPF record 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: ubmvia.top] 1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist [URIs: oworu.top] 2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist [URIs: oworu.top] 0.8 HTML_IMAGE_RATIO_02 BODY: HTML has a low ratio of text to image area 0.7 HTML_IMAGE_ONLY_28 BODY: HTML: images with 2400-2800 bytes of words 0.0 HTML_MESSAGE BODY: HTML included in message 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 0.0 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid 0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid 0.0 T_REMOTE_IMAGE Message contains an external image 2016-12-09 22:52:02Your name came up for a Courtesy 50 Walgreens® gift cardhttp://scammed.by/scam.php?id=208095 affronting Words Case Friendship They Say Your name came up for a Courtesy $50 Walgreens® gift card SpamAssassin Report (spam score: 14.2) pts rule name description ---- ---------------------- -------------------------------------------------- 3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS [185.111.74.69 listed in zen.spamhaus.org] 2.6 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: ufelu.top] 2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist [URIs: ufelu.top] 1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist [URIs: ufelu.top] 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [209.85.210.176 listed in list.dnswl.org] 0.5 RCVD_IN_SORBS_SPAM RBL: SORBS: sender is a spam source [209.85.223.177 listed in dnsbl.sorbs.net] -0.0 SPF_PASS SPF: sender matches SPF record 0.7 HTML_IMAGE_ONLY_20 BODY: HTML: images with 1600-2000 bytes of words 0.8 HTML_IMAGE_RATIO_02 BODY: HTML has a low ratio of text to image area 0.0 HTML_MESSAGE BODY: HTML included in message 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 0.0 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid 0.3 HTML_SHORT_LINK_IMG_3 HTML is very short with a linked image 0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid 0.0 T_REMOTE_IMAGE Message contains an external image 2016-12-09 22:41:32Your name came up for a Courtesy 50 Walgreens® gift cardhttp://scammed.by/scam.php?id=208096 affronting Words Case Friendship They Say Your name came up for a Courtesy $50 Walgreens® gift card SpamAssassin Report (spam score: 13.7) pts rule name description ---- ---------------------- -------------------------------------------------- -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [209.85.223.180 listed in list.dnswl.org] 2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist [URIs: yenoza.top] 1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist [URIs: yenoza.top] 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address 3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS [185.111.74.69 listed in zen.spamhaus.org] 2.6 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: ufelu.top] -0.0 SPF_PASS SPF: sender matches SPF record 0.7 HTML_IMAGE_ONLY_20 BODY: HTML: images with 1600-2000 bytes of words 0.8 HTML_IMAGE_RATIO_02 BODY: HTML has a low ratio of text to image area 0.0 HTML_MESSAGE BODY: HTML included in message 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 0.0 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid 0.3 HTML_SHORT_LINK_IMG_3 HTML is very short with a linked image 0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid 0.0 T_REMOTE_IMAGE Message contains an external image 2016-12-09 22:41:30URGENT: Your Dec 2016 Car Insurance Premium Policy Payment Billing Notice 9874 A1http://scammed.by/scam.php?id=208094 StepDown #Dinner054848455 tr td { font-family: Arial, Helvetica, sans-serif; } SpamAssassin Report (spam score: 12.6) pts rule name description ---- ---------------------- -------------------------------------------------- -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [74.125.82.49 listed in list.dnswl.org] 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: likeeecaption.loan] 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address 2.6 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL [200.3.128.142 listed in zen.spamhaus.org] 3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS -0.0 SPF_PASS SPF: sender matches SPF record 2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist [URIs: likeeecaption.loan] 0.7 HTML_TAG_BALANCE_BODY BODY: HTML has unbalanced "body" tags 0.7 HTML_IMAGE_ONLY_20 BODY: HTML: images with 1600-2000 bytes of words 0.0 HTML_MESSAGE BODY: HTML included in message 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 0.0 AC_BR_BONANZA RAW: Too many newlines in a row... spammy template 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid 0.3 HTML_SHORT_LINK_IMG_3 HTML is very short with a linked image 0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid 1.0 BODY_SINGLE_WORD Message body is only one word (no spaces) 2016-12-09 22:26:00URGENT: Your Dec 2016 Car Insurance Premium Policy Payment Billing Notice 9874 A1http://scammed.by/scam.php?id=208093 StepDown #Dinner054848455 tr td { font-family: Arial, Helvetica, sans-serif; } SpamAssassin Report (spam score: 12.6) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [209.85.223.175 listed in list.dnswl.org] 2.6 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL [200.3.128.142 listed in zen.spamhaus.org] 3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS -0.0 SPF_PASS SPF: sender matches SPF record 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: likeeecaption.loan] 2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist [URIs: likeeecaption.loan] 0.7 HTML_TAG_BALANCE_BODY BODY: HTML has unbalanced "body" tags 0.7 HTML_IMAGE_ONLY_20 BODY: HTML: images with 1600-2000 bytes of words 0.0 HTML_MESSAGE BODY: HTML included in message 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 0.0 AC_BR_BONANZA RAW: Too many newlines in a row... spammy template 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid 0.3 HTML_SHORT_LINK_IMG_3 HTML is very short with a linked image 0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid 1.0 BODY_SINGLE_WORD Message body is only one word (no spaces) 2016-12-09 22:25:59The Internets Best Kept Secret Do not miss it http://scammed.by/scam.php?id=208091 PhysicalMove #Packing06545450 tr td { font-family: Arial, Helvetica, sans-serif; } SpamAssassin Report (spam score: 12.9) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address 3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS [179.48.131.62 listed in zen.spamhaus.org] 2.6 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [209.85.210.181 listed in list.dnswl.org] -0.0 SPF_PASS SPF: sender matches SPF record 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: suneecurved.loan] 2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist [URIs: suneecurved.loan] 0.7 HTML_TAG_BALANCE_BODY BODY: HTML has unbalanced "body" tags 0.0 HTML_MESSAGE BODY: HTML included in message 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 1.0 HTML_IMAGE_ONLY_16 BODY: HTML: images with 1200-1600 bytes of words 0.0 AC_BR_BONANZA RAW: Too many newlines in a row... spammy template 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid 0.3 HTML_SHORT_LINK_IMG_2 HTML is very short with a linked image 0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid 1.0 BODY_SINGLE_WORD Message body is only one word (no spaces) 2016-12-09 22:06:30The Internets Best Kept Secret Do not miss it http://scammed.by/scam.php?id=208092 PhysicalMove #Packing06545450 tr td { font-family: Arial, Helvetica, sans-serif; } SpamAssassin Report (spam score: 13.4) pts rule name description ---- ---------------------- -------------------------------------------------- 0.5 RCVD_IN_SORBS_SPAM RBL: SORBS: sender is a spam source [209.85.223.177 listed in dnsbl.sorbs.net] 2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist [URIs: suneecurved.loan] 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [209.85.223.177 listed in list.dnswl.org] 3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS [179.48.131.62 listed in zen.spamhaus.org] 2.6 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL -0.0 SPF_PASS SPF: sender matches SPF record 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: suneecurved.loan] 0.7 HTML_TAG_BALANCE_BODY BODY: HTML has unbalanced "body" tags 0.0 HTML_MESSAGE BODY: HTML included in message 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 1.0 HTML_IMAGE_ONLY_16 BODY: HTML: images with 1200-1600 bytes of words 0.0 AC_BR_BONANZA RAW: Too many newlines in a row... spammy template 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid 0.3 HTML_SHORT_LINK_IMG_2 HTML is very short with a linked image 0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid 0.0 BODY_SINGLE_URI Message body is only a URI 1.0 BODY_SINGLE_WORD Message body is only one word (no spaces) 2016-12-09 22:06:29Are You On line Now? Browse Local Singles Nowhttp://scammed.by/scam.php?id=208089 CoffeeMilk #Sugar054484544 tr td { font-family: Arial, Helvetica, sans-serif; } SpamAssassin Report (spam score: 13.9) pts rule name description ---- ---------------------- -------------------------------------------------- 0.5 RCVD_IN_SORBS_SPAM RBL: SORBS: sender is a spam source [209.85.223.181 listed in dnsbl.sorbs.net] 2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist [URIs: culturedeenecessary.loan] 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [209.85.210.176 listed in list.dnswl.org] 2.6 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL [181.177.67.165 listed in zen.spamhaus.org] 3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: culturedeenecessary.loan] -0.0 SPF_PASS SPF: sender matches SPF record 0.7 HTML_TAG_BALANCE_BODY BODY: HTML has unbalanced "body" tags 1.6 HTML_IMAGE_ONLY_12 BODY: HTML: images with 800-1200 bytes of words 0.0 HTML_MESSAGE BODY: HTML included in message 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid 0.3 HTML_SHORT_LINK_IMG_2 HTML is very short with a linked image 0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid 1.0 BODY_SINGLE_WORD Message body is only one word (no spaces) 2016-12-09 22:01:53Are You On line Now? Browse Local Singles Nowhttp://scammed.by/scam.php?id=208090 CoffeeMilk #Sugar054484544 tr td { font-family: Arial, Helvetica, sans-serif; } SpamAssassin Report (spam score: 13.9) pts rule name description ---- ---------------------- -------------------------------------------------- 0.5 RCVD_IN_SORBS_SPAM RBL: SORBS: sender is a spam source [209.85.223.176 listed in dnsbl.sorbs.net] 2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist [URIs: culturedeenecessary.loan] 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [209.85.223.176 listed in list.dnswl.org] 2.6 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL [181.177.67.165 listed in zen.spamhaus.org] 3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS -0.0 SPF_PASS SPF: sender matches SPF record 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: culturedeenecessary.loan] 0.7 HTML_TAG_BALANCE_BODY BODY: HTML has unbalanced "body" tags 1.6 HTML_IMAGE_ONLY_12 BODY: HTML: images with 800-1200 bytes of words 0.0 HTML_MESSAGE BODY: HTML included in message 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid 0.3 HTML_SHORT_LINK_IMG_2 HTML is very short with a linked image 0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid 1.0 BODY_SINGLE_WORD Message body is only one word (no spaces) 2016-12-09 22:01:52You Can Get approved up to 5k today 🎁 8486http://scammed.by/scam.php?id=208088 You Can Get approved up to $5k today! 'That's about right,' he said. 'I was wrong in comparing her to Messalina. She's something a dashed sight more complicated. She runs the prophet just because she shares his belief. Only what in him is sane and fine, in her is mad and horrible. You see, Germany also wants to simplify life.' SpamAssassin Report (spam score: 7.0) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address 1.0 HK_RANDOM_FROM From username looks random -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [74.125.82.41 listed in list.dnswl.org] 3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS [168.139.144.166 listed in zen.spamhaus.org] -0.0 SPF_PASS SPF: sender matches SPF record 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: wimads.xyz] 1.3 HTML_IMAGE_ONLY_24 BODY: HTML: images with 2000-2400 bytes of words 0.0 HTML_MESSAGE BODY: HTML included in message 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 0.0 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars 0.0 T_HTML_TAG_BALANCE_CENTER Malformatted HTML 0.0 T_REMOTE_IMAGE Message contains an external image 2016-12-09 21:57:13