Advertisement
wavellan

20180912_PHISHING_SCAM_2

Sep 12th, 2018
219
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 5.35 KB | None | 0 0
  1. Received: from MBX05C-ORD1.mex08.mlsrvr.com (172.29.9.23) by
  2. MBX05C-ORD1.mex08.mlsrvr.com (172.29.9.23) with Microsoft SMTP Server (TLS)
  3. id 15.0.1367.3 via Mailbox Transport; Wed, 12 Sep 2018 06:34:04 -0500
  4. Received: from MBX10D-ORD1.mex08.mlsrvr.com (172.29.9.40) by
  5. MBX05C-ORD1.mex08.mlsrvr.com (172.29.9.23) with Microsoft SMTP Server (TLS)
  6. id 15.0.1367.3; Wed, 12 Sep 2018 06:34:03 -0500
  7. Received: from gate.forward.smtp.ord1d.emailsrvr.com (161.47.34.7) by
  8. MBX10D-ORD1.mex08.mlsrvr.com (172.29.9.40) with Microsoft SMTP Server (TLS)
  9. id 15.0.1367.3 via Frontend Transport; Wed, 12 Sep 2018 06:34:03 -0500
  10. Return-Path: <pauld86@credisur.com.ar>
  11. X-Spam-Threshold: 95
  12. X-Spam-Score: 100
  13. Precedence: junk
  14. X-Spam-Flag: YES
  15. X-Virus-Scanned: OK
  16. X-Orig-To: REMOVED
  17. X-Originating-Ip: [185.140.232.72]
  18. Authentication-Results: smtp25.gate.ord1d.rsapps.net; iprev=pass policy.iprev="185.140.232.72"; spf=softfail smtp.mailfrom="pauld86@credisur.com.ar" smtp.helo="credisur.com.ar"; dkim=fail (key not found in DNS) header.d=credisur.com.ar; dmarc=none (p=nil; dis=none) header.from=credisur.com.ar
  19. X-Suspicious-Flag: YES
  20. X-Classification-ID: bc35a4a8-b67f-11e8-9be0-52540081550e-1-1
  21. Received: from [185.140.232.72] ([185.140.232.72:50146] helo=credisur.com.ar)
  22. by smtp25.gate.ord1d.rsapps.net (envelope-from <pauld86@credisur.com.ar>)
  23. (ecelerity 4.2.38.62370 r(:)) with ESMTP
  24. id 0E/E5-10957-5A9F89B5; Wed, 12 Sep 2018 07:34:02 -0400
  25. DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=credisur.com.ar
  26. ; s=dkim; h=Content-Type:MIME-Version:Date:Message-ID:Subject:From:To:Sender:
  27. Reply-To:Cc:Content-Transfer-Encoding:Content-ID:Content-Description:
  28. Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:
  29. In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:List-Subscribe:
  30. List-Post:List-Owner:List-Archive;
  31. bh=YuM0CMXgrQSxK3QsmLhkAM2kG1AILzjdupQfwZlE+rE=; b=coXJOC49mexEhRD0K3dba8RDpS
  32. agQ7s4DhnH2K0LYVl3nnpuWbDqDGamL5tqnzIxWXFBrV97XJ5QTahGhIhYX6ZoeBf45YUqcZ0YQvt
  33. N9WH/McUvHtcLsxrtkL45IxghF66GvCjF/lpcyOlkf5xtKxlZ/gl9LFq95ggHzj29acc=;
  34. To: REMOVED
  35. From: "pauld86@credisur.com.ar" <pauld86@credisur.com.ar>
  36. Subject: Your personal discount
  37. Message-ID: <f2d64502-41ab-5f55-5649-98590d796c7a@credisur.com.ar>
  38. Date: Wed, 12 Sep 2018 03:33:59 -0700
  39. User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:52.0) Gecko/20100101
  40. Thunderbird/52.6.0
  41. MIME-Version: 1.0
  42. Content-Language: en
  43. X-MS-Exchange-Organization-Network-Message-Id: 284dc44b-c682-4655-d073-08d618a3a474
  44. X-MS-Exchange-Organization-AVStamp-Mailbox: SMEXzs^g;1449900;0;This mail has
  45. been scanned by Trend Micro ScanMail for Microsoft Exchange;
  46. X-MS-Exchange-Organization-SCL: 5
  47. X-MS-Exchange-Organization-AuthSource: MBX10D-ORD1.mex08.mlsrvr.com
  48. X-MS-Exchange-Organization-AuthAs: Anonymous
  49. Content-type: multipart/mixed;
  50. boundary="B_3619587473_1559368546"
  51.  
  52. > This message is in MIME format. Since your mail reader does not understand
  53. this format, some or all of this message may not be legible.
  54.  
  55. --B_3619587473_1559368546
  56. Content-type: multipart/alternative;
  57. boundary="B_3619587473_1250398118"
  58.  
  59.  
  60. --B_3619587473_1250398118
  61. Content-type: text/plain;
  62. charset="UTF-8"
  63. Content-transfer-encoding: 7bit
  64.  
  65.  
  66.  
  67. Learning is a gift. Even when pain is your teacher.
  68.  
  69. You are never too old to set another goal or dream a new dream.
  70.  
  71. Email these to your friends and family and don't forget to print these out to hang on your bedroom or cubicle wall. You will notice a difference in your day, and your future when you live your life with incredible positivity and energy.
  72.  
  73. All things are difficult before they are easy.
  74.  
  75.  
  76.  
  77. Best Regards
  78.  
  79.  
  80.  
  81.  
  82. --B_3619587473_1250398118
  83. Content-type: text/html;
  84. charset="UTF-8"
  85. Content-transfer-encoding: quoted-printable
  86.  
  87. <html>
  88. <head>
  89. <meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dutf-8">
  90. </head>
  91. <body text=3D"#000000" bgcolor=3D"#FFFFFF">
  92. <p><a href=3D"http://betterwayworkshops.com/w/tyt2.php"><img src=3D"cid:part1.6=
  93. 3C10573.D78D4DC5@credisur.com.ar" alt=3D"" moz-do-not-send=3D"false" height=3D"391=
  94. " width=3D"308" border=3D"0"></a></p>
  95. <p><br>
  96. </p>
  97. <p>Learning is a gift. Even when pain is your teacher. </p>
  98. <p>You are never too old to set another goal or dream a new dream. </p>
  99. <p>Email these to your friends and family and don't forget to print these o=
  100. ut to hang on your bedroom or cubicle wall. You will notice a difference in =
  101. your day, and your future when you live your life with incredible positivity=
  102. and energy.
  103. </p>
  104. <p>All things are difficult before they are easy. </p>
  105. <p><br>
  106. </p>
  107. <p><img src=3D"cid:part3.5484547C.8684B44F@credisur.com.ar" alt=3D""></p>
  108. <p>Best Regards</p>
  109. <p><br>
  110. </p>
  111. </body>
  112. </html>
  113.  
  114.  
  115. --B_3619587473_1250398118--
  116.  
  117.  
  118. --B_3619587473_1559368546
  119. Content-type: image/gif; name="ibnmr.gif";
  120. x-mac-creator="4F50494D";
  121. x-mac-type="47494666"
  122. Content-ID: <part1.63C10573.D78D4DC5@credisur.com.ar>
  123. Content-disposition: inline;
  124. filename="ibnmr.gif"
  125. Content-transfer-encoding: base64
  126.  
  127. --B_3619587473_1559368546
  128. Content-type: image/gif; name="tqnvk.gif";
  129. x-mac-creator="4F50494D";
  130. x-mac-type="47494666"
  131. Content-ID: <part3.5484547C.8684B44F@credisur.com.ar>
  132. Content-disposition: inline;
  133. filename="tqnvk.gif"
  134. Content-transfer-encoding: base64
  135.  
  136.  
  137. R0lGODlhZAAEAIAAAABmzGb/mSH5BAAAAAAALAAAAABkAAQAAAIajI+py+0Po5y02uuA3rz7
  138. D4biSJbmiabqKhYAOw==
  139. --B_3619587473_1559368546--
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement