The first clue to phishing is the syntax: You have got an $50 Amazon
Gift Card!

Received: from BY2NAM01HT124.eop-nam01.prod.protection.outlook.com
  (2a01:111:e400:5226::44) by BY1PR14MB0248.namprd14.prod.outlook.com
with HTTPS
  via BY1PR18CA0034.NAMPRD18.PROD.OUTLOOK.COM; Thu, 31 Aug 2017 21:09:53
+0000
Received: from BY2NAM01FT056.eop-nam01.prod.protection.outlook.com
(10.152.68.57) by
  BY2NAM01HT124.eop-nam01.prod.protection.outlook.com (10.152.69.134)
with
  Microsoft SMTP Server (version=TLS1_2,
  cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.1341.15;
Thu, 31
  Aug 2017 21:09:53 +0000
Received: from COL004-MC2F40.hotmail.com (10.152.68.57) by
  BY2NAM01FT056.mail.protection.outlook.com (10.152.68.157) with
Microsoft SMTP
  Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id
  15.1.1385.11 via Frontend Transport; Thu, 31 Aug 2017 21:09:53 +0000
Received: from csmail1.qoo10.com ([178.171.38.137]) by
COL004-MC2F40.hotmail.com with
  Microsoft SMTPSVC(7.5.7601.23143); Thu, 31 Aug 2017 14:09:52 -0700
Authentication-Results: spf=pass (sender IP is 178.171.38.137)
smtp.mailfrom=tv.justinweb.club;
  outlook.com; dkim=none (message not signed) header.d=none;outlook.com;
  dmarc=none action=none header.from=coffeebasin.com;
Received-SPF: Pass (protection.outlook.com: domain of tv.justinweb.club
designates
  178.171.38.137 as permitted sender) receiver=protection.outlook.com;
  client-ip=178.171.38.137; helo= csmail1.qoo10.com;
X-IncomingTopHeaderMarker:
OriginalChecksum:3FB22E4C0166209830A139A21673153C19541A48AA3120DA32628AA5FADEFEB9;UpperCasedChecksum:5238698BF41C7F46B09C9C715554F079A3A0F6B1C5CD560917F2D86163839B4C;SizeAsReceived:726;Count:11
Sender: <noreply@e.fiverr.com>, from
<Account-Security-Noreply@microsoftemails.com>
From: Amazon <admin@coffeebasin.com>
From: Amazon <admin@coffeebasin.com>
List-Unsubscribe: <info@coffeebasin.com>
Subject: Congrats! Shop Big with a $50 [amazon] Gift Card
Subject: Congrats! Shop Big with a $50 [amazon] Gift Card
Return-Path: return@tv.justinweb.club
Message-ID: <COL004-MC2F40NkjgJK0010b385@COL004-MC2F40.hotmail.com>
Message-ID: <COL004-MC2F40NkjgJK0010b385@col004-mc2f40.hotmail.com>
X-OriginalArrivalTime: 31 Aug 2017 21:09:52.0789 (UTC)
FILETIME=[7D193450:01D3229D]
Date: Thu, 31 Aug 2017 14:09:52 -0700
Date: Thu, 31 Aug 2017 21:09:52 +0000
X-IncomingHeaderCount: 11
X-MS-Exchange-Organization-Network-Message-Id:
e8ec3c32-d60e-43ee-4cb2-08d4f0b49fe4
X-EOPAttributedMessage: 0
X-EOPTenantAttributedMessage: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa:0
X-MS-Exchange-Organization-MessageDirectionality: Incoming
CMM-sending-ip: 178.171.38.137
CMM-Authentication-Results: hotmail.com; spf=pass (sender IP is
178.171.38.137)
  smtp.mailfrom=return@tv.justinweb.club; dkim=none
header.d=coffeebasin.com;
  x-hmca=none header.id=noreply@e.fiverr.com
CMM-X-SID-PRA: noreply@e.fiverr.com
CMM-X-AUTH-Result: NONE
CMM-X-SID-Result: NONE
CMM-X-Message-Delivery: Vj0xLjE7RD0yO0dEPTI7U0NMPTQ=
CMM-X-Message-Info:
3c21WZ1hAlvD6z4W+Uwvl9ImsHEUa/TV22P+NgFf/vRX9nK3L2uwOHntIsd8XhO4MbD/28XyRlWZDmlxuMyPCtQTwrLIO6nkJIotWgedcGOBnkl2KJ9ZfYPm2077Wu4+jCKOsEeKEMXsZZNT0imSpXolOjJeBsDhVTZ+l5Mix73Si2ry36F02g==
X-MS-UserLastLogonTime: 8/31/2017 8:59:42 PM
X-Microsoft-Exchange-Diagnostics:
1;BY2NAM01FT056;1:9CtM5k1Hd8y0ukTipzdfcNaapCe4UBfd+Zs82P2WI4nsGsznGMGyz2zSoGiMvaFMQEq66+qPT5BoE0cr4/w632gxtRRZmuJ75VXgxfXqSo7xnh7iLG9vMpLr97IMlbU7
X-Microsoft-Exchange-Diagnostics:

1;BY2NAM01HT124;3:uwTdsAEem4ub16yfjKed6RZTZMXGD2y3CyBc9mbLuIGwKBMwS7ZEAoJZgk//y7ZuKSGEsSKxZncORX5gzfF+RXhW2vy/GU5UEEDfROZjxMuZgGuHzQj4BUrB1XBfEJ0/MNQw44/OGOq/hkOXFsL80Scf7lyndIEofzLVvxy05zxHQ2gtbZGLeDB2vwfrAA/N4fwOTCY4bDdre0zcNhQycOpyjxZldcF/9k5Xrq1p/FoJh19x02Lh/cZLlq25j0wDhK+eXDxX4EpbKkLhLqYw8J/5yLkwSSXvRT7lFVFRuwahBCk3iUhDK7b5fROPPkOh;25:JI3fnvqgu2AANVW3U06/QmBUV4r7+OE1GxEv0Xcwm5VXWnfzzUlXU9EUB+9ERe10AncMXLqfHGOX/V7n3kYx34v1lyqDbMIoDQpvTwiVkiuomhuKprcvZ1GyoASrppMfPHDnlfiA/GFPd3rjhB5M9DEPBRUWT56DrCC3lV8Ym6ZV154gzJihb1yaFRX8sUwq1VFM7K2S9tFCJFB7RiuP4kg+MgdtGC7xQzxDnEv3wY/7hEYF1sBaBrX09l/H8mjLXFog94y4A7mCTz+szZ+vA6qRfhQwo4FGeP6+q+DW0PX6ysuxkZ1q1DM+GLAXb0EW5Av5W45Ae2KuGRw3RCYpeg==;31:A2NoONFy64lHpNFApInUnyKuEvoEqCZdX+Z6js1jlI8vgQq5+aybTgNbbdVpKDUaLvrBbWfrInSkcRikFVcpEjedscqYgtCVBF4MeaGMnNiK6gpcatOgE0eKgBZi6kl9jkLg6jBbX2oXCrUmm9xtkCEdgUQqSXr5XzwsZFxt8EnNaNmIrY2SDTYbWcndtGnhv5fBF1/CUcdnWMp0aX+HZyaLGHP3zV6VfM6NFkl1cO0=
X-Microsoft-Exchange-Diagnostics:
1;BY2NAM01HT124;4:PrpJ6xk6uBDm+W5q2agm560RP2n7equOlrO0dJIXLskiaCC9+1JT/eSJ1AujTm9sq0b5OflPnmV2m/Zo/0UZYtwB7JKTZASNX7EZv9FnUrDliLTNer2NEEjOr1OpyKzUis6VoEWNbRpY8YSAuUk45nAALE1/IWUpY7gUq5f8fnViu5IbR0Pv4mikzmcfmO8HMpM4jZe7WS8XVxR8jGlx/oF4v64qFhZ5j+BOMQHXBpbFsxKU1vXJ24zZ4yXG1If8;23:kwpdtA77ROImHhTPILMBvDYRWuqHhP58+P02MrrP/Iq/ebsR1NwhAgC/Ay/stAlaGPDRgZageg61AxPoRZgUao9GU5HgGZErsSUfqM3B2xwTFhB10yybFM2qggs+4Yy/6+ywGYWJWCygx8oRei4YMARJR5Wpafe3++qpwrIyZ0fg6NNvoJKWbYyYQEfotQMKUbW3+74IHcIpPdG+m3yfEg==;6:L5bt9siGhW13SkfXYSCrKzye1NkthBa+Wcl8uKhfGOkSVzZ3kNzcUHlOsEaVYaiwokJnHD3Ye/FRxE+aVJ3SXhxPodEnnlEp3VcxYzT0BNhvsay9suC+mTYKvBwOTsaTj4N2v/rBgdITf3BsEZ3V5gYOKSLwFKPSH2NX3fV5uahDzIIJaR2lQBGv96sjZ5PguoRC1L+PTSKz+rImmT4WeHd5qyX3vS4rhTwF5LLyXY0jPUcCpwNF6mGas8AQg78S8Jqt6QFEamjb7wKeHUHgRdXtfH8BpOoAgF5Seo8DmRFOox9qS+perZMoFT/doYzes9KFehoK8Y2+uH1H4/+FNg==
X-Microsoft-Exchange-Diagnostics:
1;BY2NAM01HT124;5:x8ySXg6VhtXvipIXRlb8U0AaIhnL8MtSgOcMkItSPXn74p1wwlPUqFlXlnh/pQS3QCK9SjYaotOt8RLojlfI6lix5GDfG+3FFPD9nbh74jfL5vQxfpL27h7zm+HBS6/CW05e9S1/lPkdAgXS44YnkQ==;24:n9Ki3vGmHEWB9c8ZtjJ1nMLMfytZSaIFck0MG2PGvVMwdzR1SFZBwugmuwZY9Nypdvo7C7MRvYN7p2UwzvkMtKRmxlBnJuLhJ9/ivJ+j+Y4=;7:Qot5iryrxtGbbpQI/AC+LvxGQWPSG85FKdmavavjlRsOKEpco2ttKcit+s52yd2PqVniyIxvhHmJbqoXJHR/ugPCNFdsKSX9thj4Rg4iUNZ6iMs4uWki/VEfPhEAgNDS7AH76wi3oQe6Hw/BF6jjjfUsQBoapy5OR0HK2yVEK+OjxgJC5gMc/8qYrtTDUiUeBBHIrcN3o5aM7/1AeLD1nMWBm+VdA+R0ZPTQuYouH5w=
X-Microsoft-Exchange-Diagnostics:
=?us-ascii?Q?1;BY1PR14MB0248;9:PjTGpYhwgw7sC4lMMZZ9Th+sbrH55umZIaROfJYDV3?=

=?us-ascii?Q?YK53yPOGqhW8Be9HId5VrFVJNjcx5ZTxYrusDRDbotsXMrCc4nIiC4I1o46X?=

=?us-ascii?Q?JyTBdICIOPGnwhsSQoLUpv3OTz2/ROvDaEJLyZP8+ZJ4CC8edS+scLSkX2cs?=

=?us-ascii?Q?beSuhhq8FF0RNf5DoKasZQBOFpMl4WvJXfKmLSJwnjWi4/I8LsYS2nubRPIJ?=

=?us-ascii?Q?FgKgIvzj61r6P/7dOAi5GjY6+MExHp2yRCOf4IgpJYLbSAfdRHGWDbimfn9r?=

=?us-ascii?Q?MbUcJ8huEWxkFUm1zPbQZwAScWbiAUcJfZgys8ERxca/ppAwN15ugEMezWoy?=

=?us-ascii?Q?2K8DW2BHXK3BJxdjFAapl9A9a6299b31FeHuWxx+d5ewXUcEqz3KoTVRe2uT?=

=?us-ascii?Q?G/J1gN+ZcioveCuXk7mzpVfQ8bSgDuzcaTgPP44btUxGrIaN5Zz6Z9BmSFPb?=

=?us-ascii?Q?WJu/1n3cP2dxYgs7zveOH1TFkWDGBlffFsMyuOOOOlmk57RsOKqfwjyQtAsD?=

=?us-ascii?Q?HkbjN2hZfUpVMstmSjIsdyfCDCeozAjVaaB8a3rlVNnPnIl1rhqCj3YUeq8M?=

=?us-ascii?Q?wrlUg9FjbdjHNbHwIjU/95gLz0BVNAEtUtsnr8T90Ek6zM8ST6sb2nLJs/d4?=

=?us-ascii?Q?0wV9Z6zmt/rXVGe1qxo4cEXpGIYWLVupqa6shXTauWSFmE9857lq1iXhjO6K?=

=?us-ascii?Q?L+Qwb1rYM7AvzbfCSkVZlGJW0wzp8wb2eBQbbt9FcfNrBXDWseP9qA3UunLh?=

=?us-ascii?Q?Q7vB4eObIjhw48lLzeZ/P4zw7nBYEbsRidZaZ6Hf4m9Srwxyv5Qyiq3Aqg44?=

=?us-ascii?Q?k2Z/yDX8Rvpi4nJildIAQJs0Cde674YFwj+TLSRdW/WAjSgm1sYRr4qCUCnH?=

=?us-ascii?Q?iG8UBsZ72EWxZgl0dsRYnY34k204dNepdV+5BTToG8Uj2cISGjVKlwNjjKtL?=

=?us-ascii?Q?Kx/2jQGTYn8YjsiN9N4C4m+8jIS7G1dsj/M9CMzjGiaa5ZT8L+t5R31Z52Pp?=

=?us-ascii?Q?O7smdl66r/CnI8Uq5ZuKUiAkw73noltQj28hChy6xbqfaSw16Y8GTzumLfMK?=

=?us-ascii?Q?onhVk262wI3yf5lmj7jv5Hx6TWUhRjgfwUGddSlJ05j6/RQsiRKFV51ZN5Vi?=

=?us-ascii?Q?pB8976ui+0rl9yCMUJ007v5mNUiK4bizB3LrP2wfu1Okr5J5y+cn9IHzRarF?=

=?us-ascii?Q?6vZRnTyNrEBijNe3a/tSqiCGWtLOsHoAAaD1T+auMAgo9B3xDPjOL6sw=3D?=
  =?us-ascii?Q?=3D?=

X-Microsoft-Exchange-Diagnostics:
1;BY1PR14MB0248;27:8jZ6/TUi178aIsUtTMc/tlllovzjOXVzPvV0KiHV5zZqZcMLXxJ1h8nPCOpEg11eNu2ML+rdwGG5D58FLcxUkBU8d98ZZjiST495W0S9kqvFpyox+IU9O+rrGDJlYSY6
X-MS-Exchange-Organization-AuthSource:
BY2NAM01FT056.eop-nam01.prod.protection.outlook.com
X-MS-Exchange-Organization-AuthAs: Anonymous
X-MS-PublicTrafficType: Email
X-MS-Office365-Filtering-Correlation-Id:
e8ec3c32-d60e-43ee-4cb2-08d4f0b49fe4
X-Microsoft-Antispam:
BCL:0;PCL:0;RULEID:(300000500095)(300135000095)(300000501095)(300135300095)(22001)(300000502095)(300135100095)(23075)(8291501071);SRVR:BY2NAM01HT124;
X-MS-TrafficTypeDiagnostic: BY2NAM01HT124:
X-Exchange-Antispam-Report-Test: UriScan:;
X-Exchange-Antispam-Report-CFA-Test:
BCL:0;PCL:0;RULEID:(100000700101)(100105000095)(100000701101)(100105300095)(100000702101)(100105100095)(444000031);SRVR:BY2NAM01HT124;BCL:0;PCL:0;RULEID:(100000800101)(100110000095)(100000801101)(100110300095)(100000802101)(100110100095)(100000803101)(100110400095)(100000804101)(100110200095)(100000805101)(100110500095);SRVR:BY2NAM01HT124;
X-Forefront-Antispam-Report:
SFV:NSPM;SFS:(98900018);DIR:INB;SFP:;SCL:1;SRVR:BY2NAM01HT124;H:COL004-MC2F40.hotmail.com;FPR:;SPF:None;LANG:en;
SpamDiagnosticOutput: 1:99
SpamDiagnosticMetadata: NSPM
X-OriginatorOrg: outlook.com
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 31 Aug 2017 21:09:53.0901
(UTC)
X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa
X-MS-Exchange-CrossTenant-FromEntityHeader: Internet
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BY2NAM01HT124
X-MS-Exchange-Transport-EndToEndLatency: 00:00:00.5535852
X-MS-Exchange-Processed-By-BccFoldering: 15.01.1385.000
X-Microsoft-Antispam-Mailbox-Delivery:
abwl:0;wl:0;pcwl:0;kl:0;iwl:0;dwl:0;dkl:0;rwl:0;ex:0;psp:0;auth:0;dest:J;WIMS-SPF:tv%2ejustinweb%2eclub;WIMS-DKIM:coffeebasin%2ecom;WIMS-822:admin%40coffeebasin%2ecom;WIMS-PRA:noreply%40e%2efiverr%2ecom;WIMS-AUTH:NONE;ENG:(400001000128)(400125000095)(5062000261)(5061607266)(5061608174)(4900095)(4921089)(3120004)(4950112)(4990090)(9140004);RF:JunkEmail;OFR:SpamFilterAuthJ;
X-MS-Exchange-Organization-SCL: 6
X-Microsoft-Antispam-Message-Info:
Oc2TACPUlo3hfsJy81pSTfCnglwatKTrUV0hgBish9zDA27SP6SFch7alcQnol2IB91Y/zgtD0NCcjCW1j/w7VwruHRdDyI+79/N0LrtnCzwxvuxlF/lq1p8t6EnBPe9W8vY43rHT/ID16pRo5AbTSFCeXAgSQ16dAZV+dLjH2qDc5J8QDs5+Iy+NC+VlWBKqKfKUTiPFYxommdZl64bQufO8vW+LDlTPYXvg8Xeca+0wqpu3okfFkiMfdb+AsuzdBz1E6A/jp6MTCcwDXNwgQ==
To: undisclosed-recipients:;
Reply-To: Amazon <admin@coffeebasin.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline



—---- Forwarded Message —----
From: "Amazon" <admin@coffeebasin.com>
To:
Sent: 8/31/2017 2:09:52 PM
Subject: Congrats! Shop Big with a $50 [amazon] Gift Card

Dear Costumer,

Congratulations !
You have got an $50 Amazon Gift Card!
Go shopping with a $50 Amazon Gift Card

Get your card by clicking on this link :

» https://is.gd/TfQZPx


Best Regards

Amazon Service Team



подсети, [1 сент. 2017 г., 8:04]:
... To Unsubscribe : https://is.gd/h3bFEe


——————Beginning of complete ADDRESS information of the SPAM/Phishing message (in text format)—————

Amazon
Congrats! Shop Big with a $50 [amazon] Gift Card
X-Exchange-Antispam-Report-Cfa-Test: BCL:0;PCL:0;RULEID:(100000700101)(100105000095)(100000701101)(100105300095)(100000702101)(100105100095)(444000031);SRVR:BY2NAM03HT072;BCL:0;PCL:0;RULEID:(100000800101)(100110000095)(100000801101)(100110300095)(100000802101)(100110100095)(100000803101)(100110400095)(100000804101)(100110200095)(100000805101)(100110500095);SRVR:BY2NAM03HT072;
X-Eoptenantattributedmessage: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa:0
X-Incomingheadercount: 11
Sender: <noreply@e.fiverr.com>, from <Account-Security-Noreply@microsoftemails.com>
X-Ms-Exchange-Crosstenant-Originalarrivaltime: 31 Aug 2017 21:05:55.9645 (UTC)
X-Originatororg: outlook.com
X-Ms-Exchange-Transport-Crosstenantheadersstamped: BY2NAM03HT072
X-Ms-Exchange-Organization-Authas: Anonymous
X-Forefront-Antispam-Report: SFV:NSPM;SFS:(98900018);DIR:INB;SFP:;SCL:1;SRVR:BY2NAM03HT072;H:COL004-MC3F9.hotmail.com;FPR:;SPF:None;LANG:;
X-Exchange-Antispam-Report-Test: UriScan:;
Authentication-Results: spf=pass (sender IP is 178.171.38.139) smtp.mailfrom=welcome.justinweb.club; hotmail.com; dkim=none (message not signed) header.d=none;hotmail.com; dmarc=none action=none header.from=coffeebasin.com;
Return-Path: return@welcome.justinweb.club
Cmm-X-Message-Info: 3c21WZ1hAlvD6z4W+Uwvl9ImsHEUa/TV22P+NgFf/vRX9nK3L2uwOHntIsd8XhO4MbD/28XyRlWZDmlxuMyPCtQTwrLIO6nkJIotWgedcGOBnkl2KJ9ZfYPm2077Wu4+jCKOsEeKEMXsZZNT0imSpXolOjJeBsDhVTZ+l5Mix73Si2ry36F02g==
Cmm-X-Auth-Result: NONE
X-Ms-Exchange-Crosstenant-Fromentityheader: Internet
Cmm-Authentication-Results: hotmail.com; spf=pass (sender IP is 178.171.38.139) smtp.mailfrom=return@welcome.justinweb.club; dkim=none header.d=coffeebasin.com; x-hmca=none header.id=noreply@e.fiverr.com
Cmm-X-Sid-Result: NONE
Spamdiagnosticoutput: 1:99
X-Ms-Exchange-Crosstenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa
X-Ms-Exchange-Organization-Network-Message-Id: f6fcef37-ecbe-457c-bc20-08d4f0b41299
Spamdiagnosticmetadata: NSPM
X-Ms-Publictraffictype: Email
X-Microsoft-Antispam: BCL:0;PCL:0;RULEID:(300000500095)(300135000095)(300000501095)(300135300095)(22001)(300000502095)(300135100095)(23075)(8291501071);SRVR:BY2NAM03HT072;
Message-Id: <COL004-MC3F9beUzmRf00b3029e@COL004-MC3F9.hotmail.com>
X-Microsoft-Antispam-Message-Info: y5sxjwWJTqiLP98RXncrJJE/S3OWxLNrjhXgTHcAqIK+nLD8ElmFaW+6tD5dnar/o44XtKc+J37UQkeHVij0ix+/q61QiRtOEq3H097kFOUTuH8s7RmB9leEgFHi36eYRfGnp6Ogi4RfwkQVR7zr1Sa6pfrjZQNnuFj55dCALrbH/OUwwgNYWHlXUbaOWFKqUkE/f/svbvHLGgxmVb7gKBFZ+vWiobHb7Qw5I+Z69sm0e1+KA7Ln7yP/tUkbLZHarTXzN6SXzaqFNAgXG9A43w==
Mime-Version: 1.0
X-Originalarrivaltime: 31 Aug 2017 21:05:56.0163 (UTC) FILETIME=[F00EF130:01D3229C]
Cmm-X-Sid-Pra: noreply@e.fiverr.com

X-Ms-Exchange-Organization-Authsource: BY2NAM03FT010.eop-NAM03.prod.protection.outlook.com
Cmm-Sending-Ip: 178.171.38.139
Received: from BY2NAM03HT072.eop-NAM03.prod.protection.outlook.com (10.174.245.145) by DM5PR12MB1467.namprd12.prod.outlook.com with HTTPS via DM5PR15CA0031.NAMPRD15.PROD.OUTLOOK.COM; Thu, 31 Aug 2017 21:05:56 +0000
Received: from BY2NAM03FT010.eop-NAM03.prod.protection.outlook.com (10.152.84.51) by BY2NAM03HT072.eop-NAM03.prod.protection.outlook.com (10.152.85.228) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.20.13.11; Thu, 31 Aug 2017 21:05:56 +0000
Received: from COL004-MC3F9.hotmail.com (10.152.84.56) by BY2NAM03FT010.mail.protection.outlook.com (10.152.84.122) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.20.13.11 via Frontend Transport; Thu, 31 Aug 2017 21:05:55 +0000
Received: from csmail1.qoo10.com ([178.171.38.139]) by COL004-MC3F9.hotmail.com with Microsoft SMTPSVC(7.5.7601.23143); Thu, 31 Aug 2017 14:05:56 -0700
X-Eopattributedmessage: 0
X-Ms-Office365-Filtering-Correlation-Id: f6fcef37-ecbe-457c-bc20-08d4f0b41299
Cmm-X-Message-Delivery: Vj0xLjE7RD0yO0dEPTI7U0NMPTQ=
Content-Type: text/plain
X-Ms-Exchange-Processed-By-Bccfoldering: 15.20.0013.000
X-Microsoft-Antispam-Mailbox-Delivery: abwl:0;wl:0;pcwl:0;kl:0;iwl:0;dwl:0;dkl:0;rwl:0;ex:0;psp:0;auth:0;dest:J;WIMS-SPF:welcome%2ejustinweb%2eclub;WIMS-DKIM:coffeebasin%2ecom;WIMS-822:admin%40coffeebasin%2ecom;WIMS-PRA:noreply%40e%2efiverr%2ecom;WIMS-AUTH:NONE;ENG:(400001000128)(400125000095)(5062000261)(5061607266)(5061608174)(4900095)(4921089)(3120004)(4950112)(4990090)(9140004);RF:JunkEmail;OFR:SpamFilterAuthJ;
X-Ms-Traffictypediagnostic: BY2NAM03HT072:
X-Ms-Exchange-Organization-Scl: 1
Received-Spf: Pass (protection.outlook.com: domain of welcome.justinweb.club designates 178.171.38.139 as permitted sender) receiver=protection.outlook.com; client-ip=178.171.38.139; helo= csmail1.qoo10.com;
List-Unsubscribe: <info@coffeebasin.com>
X-Incomingtopheadermarker: OriginalChecksum:8B7DE8BDED312FE721927BEA1122EE7CE0928302355EEA8670FEE549FD1E2BF3;UpperCasedChecksum:8CB8ADA71681303BACED9E3B2DFBD6EA0EF05FD646725A3B2A0FC4981C0C97DF;SizeAsReceived:729;Count:11
X-Microsoft-Exchange-Diagnostics: 1;BY2NAM03FT010;1:AXJ20Lgo/27FwXWvk/hDFLKDvxffhCPvVgaIEcTi10ukkg2aa/Wk5qfLg6XD4xTdjOXXxtqXX1LaYaWWeWRXejvfbSkpnvJcsPljQn7FAIkkM00PmblXTEQA0gfEsE7O
X-Microsoft-Exchange-Diagnostics: 1;BY2NAM03HT072;3:Wn4/OCVh66m8I+/Ekr+aq5v/bwKH6swKiN3+IaTSV93uZNSUuzR+jdg+eYKGq6FVwwh1f2P1vjmFhIsNsRO6kmRmdfz4cNwBqupqAH8vBBX1eLgqae+I5ozVDEbhBwok7RHONzgFKxGLTLkEsVQbX6kp78AjvUz9eBp6+e+7ZA2261Y1phYqtrTMLiyrIKAfa/v/G5FXFp4/okw9TKzrzVNkZv2yKk0SYOv5h6FC2AtmhFxjFPRnpOCgk1afve6sWaOwGCjSGXmzMprcEU3d1GflCvLI+r8CoXKGdClU1C3VbPkGcwGk0fr0tG630BeT;25:0HUF3d4wKEI/mRBi0xm5+E2ZrC2yEAtleY3PYFpWV8TlQKFJqw7T4A6csCKQhOJeTLAhBPhxnR8UU0w8zZLdSzMie/rvVi8MSd4MUF/YNguZZ6Npqdbn2e6L0FXILDdc+gSZvsMOTa1SV6OnZfAtGw7rvN060e8PPNuke+H+mNsTdvJqQqOXKpUZLgm0KzrB9sz1380esffvwioeDVpuCvrO3uYwZJ2WZ9ANqMmplYt3N6UCdu2fkEd/p90gHLPcrphgxLmc6dZPBr6FpVbrbtJbJSeNC2Nl8YXuYQ7b3iaYqVE+BHnwcTRQO+E9kWJFrXYTLZ2ttvnmnhlfsudxlQ==;31:mg1R/EiA//oj798CvCRXmbjkNYtzp3TFFJx9Ve/iFD+tD7TjWmasDANzuJmnkzOqxY/aUYkgv3Mq4JlsOW+rTIdt/ee77/k7vILAMx/AZpHB5t1y7J7kv3uJxs22dpxNMAArGifSvcgn94AIatq3yn7gZx+pTC8QDWXIkZfLfTxouRhWHip05n7PADFU3YcaRBoetKbuf2QomDnJqaQcvgkMioZZcrwhG4KvsBvyWQ4=

X-Microsoft-Exchange-Diagnostics: 1;BY2NAM03HT072;4:iDr7GNHiJ/ZEv1Cei8J4wbbgGPXcwLWlifVYjQDsPOfEliwDmEHnH1zcK5kGV+YASHpwwkoJUxbt+oS+JSPgM5EIXJOS18ngx78j64birkf3gpjc/sQdQn7tOwOYpEFoMlD4gEcOirXv5Cp603cXGVJhw7gV0QLgCdXWs3Rcb0ex8LUACkYXRMblOcrsCZZP9LMCBIMfQ9go0V7MAZHOOEWvm1b7EDUgYPRkkQiTC6LC9XIC9QI/WBum58brQG8G;23:HaBFbeS9HF/UZFa8rZgiwpP34G5dhYcYGIp9zhH+y95k+nCFngkBbFGiF/BQEGNrPpsA1NeLOTiTzBhsKAcQc+yOUz05Z9xZMAL/S95qUochVA3J/qPVh+et5qZn6qsz0o2/7u+KBSYNxpcaiXZF9KmQ9reuthexAcDYFfz6a3XekPw2lTd3gHC5BPqLepqWQZ48X7I8cCmQZBbIcUnP9A==;6:TBrBdeDSjmILY6Wcaf7lbUzhq10CrYM3O2GbMbOAAAX4N3DwSbKFuOPfQS4DoyLFuVSSeaXy5O5h1QQZccp14LAMWsaFlSoRf0vjFMTRducRMuP642VyV3eBFG+bNtsZTTWSs7u/uTGhJ+AZYV0F3ZCI0ePNMzW3c6MmBJnwKUpLfodPx4WbyAkZ221Ylt5k8GxpimS1qYcnkUvomj/OSBIDVTrZPXlLmfUNOOv6zkynEITUhsXlbD9P1N1SGfz9rijzv2mqQfU8gC4Frz8ATFoq4JyckyUYCabm2OlZMKdknqB7wsrrkw/8Uj61VrL6Tt9BsKMX8a6KVU9Ej/tPSw==
X-Microsoft-Exchange-Diagnostics: 1;BY2NAM03HT072;5:trhfi6SLAoHVaVRzHLuU+52ECLSogf4dk+YqnxksweXyDyIqvXlFACPX7NDzdx3plQiw846tBRnxlSKBJLthB9IgQ6YZ/pjChwjB16mYAgcdHhpMT978ALHgA35y9V+rhHsawIWS2qTPV7UFQ6VCpQ==;24:bgD150X5gS1mdaqOUsPlzCsIYiQEtvqTFTYtcBBLO8/sbI00ReveJ3zRYNcUT/1uZD+ZdzARv8hlrbrTs4aKc0vTehLVW4efzBToxog7CS8=;7:0mctkiWaVMFicAF5kC46n/BMvNglagH9TtQGC/RtxZXmQy1l9WCPfmLgm6S5bGZSFmB8ZWPidF5FcFbsrxgjM7dzWmRG8zaHXAbTBkYHMAvzFhaZRv5AgW+NwP0SSKTe8K0c+JmoqFqsjDVRNhoh7UIPLanqGpKhnGmARp7tR/5nmNHmY5JqgwdX/grOGDmRl13wQ5hkU4H4bkcI55IFyj5S74kaGT+yFOpGqEweEzk=
X-Microsoft-Exchange-Diagnostics: 1;DM5PR12MB1467;27:WGHs+mFbtWHsLZ/lKJNEUU/N1Pt08YgBE9iCmyuwnBb2A7IvlJiacxponhmaZQKtxTpXTTHCzWqHbSRfRvRVlx/zT2KqEDOxbfNO3W4LDg18rTMmvO/dZqTSKSthCka4
X-Ms-Exchange-Organization-Messagedirectionality: Incoming
X-Ms-Exchange-Transport-Endtoendlatency: 00:00:00.8262661


Тема:	PLEASE STOP THE SPAM !
Дата:	Fri, 1 Sep 2017 19:34:23 +0000
От:	Karine TODESCHINI <karitod@hotmail.com>


178.171.38.10








Here is the log :



Received: from DB5EUR01HT009.eop-EUR01.prod.protection.outlook.com
 (2603:10a6:205:1::40) by AM4PR10MB0161.EURPRD10.PROD.OUTLOOK.COM with HTTPS
 via AM4PR07CA0027.EURPRD07.PROD.OUTLOOK.COM; Fri, 1 Sep 2017 14:22:46 +0000
Received: from DB5EUR01FT064.eop-EUR01.prod.protection.outlook.com
 (10.152.4.52) by DB5EUR01HT009.eop-EUR01.prod.protection.outlook.com
 (10.152.4.118) with Microsoft SMTP Server (version=TLS1_2,
 cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.1385.11; Fri, 1
 Sep 2017 14:22:45 +0000
Authentication-Results: spf=pass (sender IP is 178.171.38.10)
 smtp.mailfrom=mail3.willstrang17.com; hotmail.com; dkim=none (message not
 signed) header.d=none;hotmail.com; dmarc=none action=none
 header.from=coffeebasin.com;
Received-SPF: Pass (protection.outlook.com: domain of mail3.willstrang17.com
 designates 178.171.38.10 as permitted sender)
 receiver=protection.outlook.com; client-ip=178.171.38.10; helo=
 csmail1.qoo10.com;
Received: from BAY004-MC5F9.hotmail.com (10.152.4.51) by
 DB5EUR01FT064.mail.protection.outlook.com (10.152.5.83) with Microsoft SMTP
 Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id
 15.1.1385.11 via Frontend Transport; Fri, 1 Sep 2017 14:22:45 +0000
X-IncomingTopHeaderMarker: OriginalChecksum:A2B4DF506D6839DB20308CE88EB5381DFC122AB1C54C13C80653CFE2A022A57B;UpperCasedChecksum:0F0CCE04078CCD1ACCCF8A4E8D0FF3B9C86179A1D32991CFAF71B370FD39F034;SizeAsReceived:712;Count:11
Received: from csmail1.qoo10.com ([178.171.38.10]) by BAY004-MC5F9.hotmail.com with Microsoft SMTPSVC(7.5.7601.23143);
Fri, 1 Sep 2017 07:22:43 -0700
Sender: <noreply@e.fiverr.com>, from
<Account-Security-Noreply@microsoftemails.com>
From: CVS <admin@coffeebasin.com>
List-Unsubscribe: <info@coffeebasin.com>
Subject: Congrats! Take your $50 CVS Gift Card
Content-Type: text/plain
BCC:
Return-Path: return@mail3.willstrang17.com
Message-ID: <BAY004-MC5F9TrBoe2U017f88fc@BAY004-MC5F9.hotmail.com>
X-OriginalArrivalTime: 01 Sep 2017 14:22:43.0944 (UTC) FILETIME=[C6C90680:01D3232D]
Date: Fri, 1 Sep 2017 07:22:43 -0700
X-IncomingHeaderCount: 11
X-MS-Exchange-Organization-Network-Message-Id: 2c3e200c-e6ae-4bcb-f81a-08d4f144ea84
X-EOPAttributedMessage: 0
X-EOPTenantAttributedMessage: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa:0
X-MS-Exchange-Organization-MessageDirectionality: Incoming
CMM-sending-ip: 178.171.38.10
CMM-Authentication-Results: hotmail.com; spf=pass (sender IP is
 178.171.38.10) smtp.mailfrom=return@mail3.willstrang17.com; dkim=none
 header.d=coffeebasin.com; x-hmca=none header.id=noreply@e.fiverr.com
CMM-X-SID-PRA: noreply@e.fiverr.com
CMM-X-AUTH-Result: NONE
CMM-X-SID-Result: NONE
CMM-X-Message-Delivery: Vj0xLjE7RD0yO0dEPTI7U0NMPTQ=
CMM-X-Message-Info: 3c21WZ1hAlvD6z4W+Uwvl9ImsHEUa/TV22P+NgFf/vRX9nK3L2uwOCijM1Uhbl2HdF7OfAf1T0gBJ59e7dhH/PQhXQ6gKyFKGNtFkmdKZ5G/V3bPIKQFtO7bKGxEJSeXob7tnyHO8Ui/LY2b3X8L36QKd//EDyg/2VoW1lvfmmUszrZOVGFA+NASWMt+LYRz
X-MS-UserLastLogonTime: 9/1/2017 1:17:53 PM
X-Microsoft-Exchange-Diagnostics: 1;DB5EUR01FT064;1:fIUh3RK/ogk6kmNfUgLst1kuCWKS4uduyfEIi7rKXQCj8h0UrT83e+Z2x6+TtYjc+/faDC8WEow3RQyCXpmlSuVmFL96bDXVBTitvDN4MzMInLj+xGBK2vpxHSPV3NVc
X-MS-Exchange-Organization-AuthSource: DB5EUR01FT064.eop-EUR01.prod.protection.outlook.com
X-MS-Exchange-Organization-AuthAs: Anonymous
X-MS-PublicTrafficType: Email
X-MS-Office365-Filtering-Correlation-Id: 2c3e200c-e6ae-4bcb-f81a-08d4f144ea84
X-Microsoft-Antispam: BCL:0;PCL:0;RULEID:(300000500095)(300135000095)(300000501095)(300135300095)(22001)(23075)(300000502095)(300135100095)(8291501071);SRVR:DB5EUR01HT009;
X-Microsoft-Exchange-Diagnostics: 1;DB5EUR01HT009;3:AzfodDwYRHRJ7xnZ+Dng73PmZPAJd+vXiQ+MxuqyGlftTBMTt5xgaJVCdnLjJGf7K4l4w17hdt0rLWBTOvLeqXjmI9PBkWPNUXjvqoXwVmNd5d41TFgQgx45FiP12R7SNzjyeOfHDzUM7bHn2tI5L6y+OFoPIGF7yckwyU6O3J3QBzqhC7MOkMh9lHJSF/tceHN5KEVEr3uLANFvSD/+C+hshucIsLKg+10jgzyqLBZv6jOc1Ht31ZK91Y3elsEiC0unOmTQvWFmTX4+8qAyCvN0+3W54gUw2XLvAxH3FqJItYvl3vUR5+sXcHPpTB/Q;25:SsbZDGxAYGGT008GQFHdARhdGsQoQgExnsWllzK2LIHnQOOY05JcaEMbXmqUtJqbEi/0uZzzK3KWLVfOTba74bYIrFKJiPxlH4lH/nzwFA7t3H515FLiM8QwMYsaFd811325QV4HVSpPB77kvenaJmdgyB1/oEgw2i5GcJQgqxzDyL4c22u85q+5FMzP3IHiA0f2nrKbh4QcKjtL4vy4eJO8/6mXRfqsKB1+A9SZzYHzdJgf8BUtW6Gvkdjvi+/zSVWvmJVA4AVgqPg76bUKxBh5lwyjXtxIgWlNflx9KezDOMRh9KMXTUujPpAZsH4wg1duU9Pewgqzi0Zn4L1DHQ==;31:5Vli8Wk7onNkMe7bxKa2737Lb6VH7ttF6TVT8n3pq3aRZOb3D5i9KEZtL4RtGswfLWAohe8jGP9lCfpRUQDelOqQFtJz46D7dQLMXqdTZsuBtvAhREU9+E1s/cFG7r18NDAoAUqoX83lq22ZhZ701xLNi1vDvCFMwYGKHa+XjMZzV15OopNvAJQDxj0yaPa3+DVWHKgFTIAVJ0uElrqiq5XA7sujc+TOPqgpvLLqRBw=
X-MS-TrafficTypeDiagnostic: DB5EUR01HT009:
X-Exchange-Antispam-Report-Test: UriScan:;
X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(100000700101)(100105000095)(100000701101)(100105300095)(100000702101)(100105100095)(444000031);SRVR:DB5EUR01HT009;BCL:0;PCL:0;RULEID:(100000800101)(100110000095)(100000801101)(100110300095)(100000802101)(100110100095)(100000803101)(100110400095)(100000804101)(100110200095)(100000805101)(100110500095);SRVR:DB5EUR01HT009;
X-Microsoft-Exchange-Diagnostics: 1;DB5EUR01HT009;4:2kOAPZ77F2EX0hGlG2vbTDyNFXF2p+2YgBsS/IFnDndXgcQ6SQa2ZewFzFOOjWyXZUkQTqaKWeadT7pPCdKb6Utf03HCBllmy7YANnur+fciTXd1Wvva4wYXlWvVkqr10wm33GhLnUTLePvqKdUwLV3RP3ov2KauJDX1YnxOZAcfq1pfr9W0ZxvG/rB2u5i56199Ocv4WQlhHPGg9ZYKZnvCLQn61VfkOGByMDRBqBLmXcQ++Rn5jyV4kx0DVEM6;23:+tof+9wOTz7uat942N3E5BCmhsDPKg3xq8qS8urJRgh4a2I1TzyYkMROWp69EbA6Hp8WTb+5fSUyCtDG5yLtI3/qdKiLgkJARhLtu7oGqdyfeYqWyk89bFFelxDZG7Y4evpMRmQEsYcXv53L8qkjWG0ez4CFtyuamVMtmIcbDjvEL/kHWf0bY6NLoRx9lVAAUhoyrMNoFbZrQxe1643f8w==;6:eGk1mOEiSjzcZo5024XgQulhzkuFWfURMQP36n5LXKAEsBFstLgw4KBuEa7kx2kmTqXBgF1vhxI4f7sEhysVBaAc186I1T3smp7wJv31myR0xB6ytaPKGry+IKf6gFjD7fQjqg1RA6C1sYrq/kG0d8dSojTLmiEFmXiJvCj+eKEExX9gXjs/+UKrMcU9Lt5Sfbw5lKH3A5Qrbjue314C30BI4eunulAiPVgGze1p3/6YphI19EVr4UN+IkXkg9KD3IHbgAufNYPPvAhzOLtISsHvbLVbabMBAdBQFYsDUNlt5iBVQBzmS5YgZu2ad4643R2+LNU02bAneho1UNmYIg==
X-Forefront-Antispam-Report: SFV:NSPM;SFS:(98900018);DIR:INB;SFP:;SCL:1;SRVR:DB5EUR01HT009;H:BAY004-MC5F9.hotmail.com;FPR:;SPF:None;LANG:;
X-MS-Exchange-Organization-SCL: 1
X-Microsoft-Exchange-Diagnostics: 1;DB5EUR01HT009;5:NZ3SShQdap8N2mfXKDg88rgD/rJECpRkeIOfB72ZUOZlGuk81/FTh+sZxLs5wzC0yIIBUkyppGAZhmv+joyyxZ92Rq/HrTI+Z24YYbUyznWPPNxfYXaXtftfGD9Gt6FKxf9Eeht+nOPjpRNCGuL7iw==;24:4/NiVSC0NDegBkFH97Ng4KMoE3ypwnrl8AIxBB4x5JVpGA1CeoJXayscV2KQzFkkQ6mIrvjk6aY2tU+2FdOHgDIkg/M+q3qrlvjLEjrwSDU=;7:202/LrM/vNl/8ctIPyTXbU3dAebOS+A95BMsDO6ww1XpMJHwulAqVZEyNJboZeM+CEzWIYfdGpUSjGTTo5Fa4GnF2pAm9b6SvgoNI7MgEU1rTI2kOIY/XEtEH1DSF/uJJULmWyLUCF4HJiOeq/hpulxUB0Iz08EZO3XeBRlROJfDJ3e1Z7LJHw7BSwAjDNVVzIkReLqBcb+gdmVy30N91AWtesqrBu2nopx5EWETa3I=
SpamDiagnosticOutput: 1:99
SpamDiagnosticMetadata: NSPM
X-OriginatorOrg: outlook.com
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Sep 2017 14:22:45.3391
 (UTC)
X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa
X-MS-Exchange-CrossTenant-FromEntityHeader: Internet
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB5EUR01HT009
X-MS-Exchange-Transport-EndToEndLatency: 00:00:01.1118661
X-MS-Exchange-Processed-By-BccFoldering: 15.20.0013.014
X-Microsoft-Exchange-Diagnostics:
1;AM4PR10MB0161;27:QqTrbupXiHkMzvhoGXDRFAtDvbdSJgbrJESC/mcDO7eJ3F+K0EDyO3mD3p37mvFZoHSNUiAT/ttgfuV2JPDQ24fe97amWLHyC0TuKOahqrWV/3y8GVQa5ZKUBTvDlDC/
X-Microsoft-Antispam-Mailbox-Delivery:
abwl:0;wl:0;pcwl:0;kl:0;iwl:0;dwl:0;dkl:0;rwl:0;ex:1;psp:0;auth:0;dest:J;WIMS-SPF:mail3%2ewillstrang17%2ecom;WIMS-DKIM:coffeebasin%2ecom;WIMS-822:admin%40coffeebasin%2ecom;WIMS-PRA:noreply%40e%2efiverr%2ecom;WIMS-AUTH:NONE;ENG:(400001000128)(400125000095)(5062000261)(5061607266)(5061608174)(4900095)(4921089)(3120004)(4950112)(4990090)(9140004);RF:JunkEmail;OFR:SpamFilterAuthJ;
X-Microsoft-Antispam-Message-Info:
Srwp6ZcmifnnO1uoII2h5Q20xJHqcumYdmFyAb9NMTl1xLnuxP7RDO2nIk/FDEtJlSs68icahXTVscLBTG/vvF3BXtmLxuqvo4ZkdCLvIj/55ekZ2OoGsM3GA+eArk6iJ4ilohmtlaA1EagTn9YF0JotZ0Kjq4K922lWx1bOYO/l6h7i+aUDTRaNTaKFS75A1M2LZvXX5HU9ApK16YcPYrpGTr/QvQfjrCtcAbfeiIKe8O0OD7hdcdPyTdb0w5aB3OyninQr297dcyYqk/bodQ==
MIME-Version: 1.0

Dear Costumer,

Congratulations !
You have got an $50 CVS Gift Card!
Get your card by clicking on this link :

>> https://is.gd/vOb9hn


Best Regards,

CVS Service Team




To Unsubscribe : https://is.gd/M0Jn3X


-------- Конец пересылаемого сообщения --------

-------- Пересылаемое сообщение--------
04.09.2017, 05:09, "glavcons" <glavcons@eltc.ru>:

-------- Перенаправленное сообщение --------
Тема:	Fwd: Congrats! Get your $50 Amazon Gift Card!
Дата:	Sun, 3 Sep 2017 16:45:25 +0000
От:	Hans Gugger <hjgugger@hotmail.com>
 	Abuse - Amazon <email-abuse@amazon.com>
Копия:	abuse@amazonaws.com <abuse@amazonaws.com>

Dear Sir, dear Madam,

Based on the “hidden” address information of the message I just received, I believe this is a SPAM/Phishing message which originated from one of your clients. If this is correct I would appreciate it if you took the appropriate, strong action against the responsible person. If I am wrong, I apologize.

Please note that if it did NOT originate from within your network, then it could mean that someone actually hacked into your network.

I am attaching the complete address information of the message below.

With kind regards,

….Hans J Gugger

———————————————————Begin of SPAM/Phishing message———————————————————

Begin forwarded message: From: Amazon <admin@coffeebasin.com> Subject: Congrats! Get your $50 Amazon Gift Card!
Показать цитату целикомПоказать всю переписку


——————Beginning of complete ADDRESS information of the SPAM/Phishing message (in text format)—————

Amazon
Congrats! Get your $50 Amazon Gift Card!
X-Exchange-Antispam-Report-Cfa-Test: BCL:0;PCL:0;RULEID:(100000700101)(100105000095)(100000701101)(100105300095)(100000702101)(100105100095)(444000031);SRVR:CO1NAM03HT199;BCL:0;PCL:0;RULEID:(100000800101)(100110000095)(100000801101)(100110300095)(100000802101)(100110100095)(100000803101)(100110400095)(100000804101)(100110200095)(100000805101)(100110500095);SRVR:CO1NAM03HT199;
X-Eoptenantattributedmessage: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa:0
X-Incomingheadercount: 11
Sender: <noreply@e.fiverr.com>, from <Account-Security-Noreply@microsoftemails.com>
X-Ms-Exchange-Crosstenant-Originalarrivaltime: 03 Sep 2017 16:22:57.5404 (UTC)
X-Originatororg: outlook.com
X-Ms-Exchange-Transport-Crosstenantheadersstamped: CO1NAM03HT199
X-Ms-Exchange-Organization-Authas: Anonymous
X-Forefront-Antispam-Report: SFV:NSPM;SFS:(98900018);DIR:INB;SFP:;SCL:1;SRVR:CO1NAM03HT199;H:COL004-MC4F37.hotmail.com;FPR:;SPF:None;LANG:;
X-Exchange-Antispam-Report-Test: UriScan:;
Authentication-Results: spf=pass (sender IP is 178.171.38.67) smtp.mailfrom=newsletter.matarata.club; hotmail.com; dkim=none (message not signed) header.d=none;hotmail.com; dmarc=none action=none header.from=coffeebasin.com;
Return-Path: return@newsletter.matarata.club
Cmm-X-Message-Info: 3c21WZ1hAlvD6z4W+Uwvl9ImsHEUa/TV22P+NgFf/vRX9nK3L2uwOHntIsd8XhO4MbD/28XyRlWZDmlxuMyPCtQTwrLIO6nkJIotWgedcGOBnkl2KJ9ZfYPm2077Wu4+jCKOsEeKEMXsZZNT0imSpXolOjJeBsDhVTZ+l5Mix73Si2ry36F02g==
Cmm-X-Auth-Result: NONE
X-Ms-Exchange-Crosstenant-Fromentityheader: Internet
Cmm-Authentication-Results: hotmail.com; spf=pass (sender IP is 178.171.38.67) smtp.mailfrom=return@newsletter.matarata.club; dkim=none header.d=coffeebasin.com; x-hmca=none header.id=noreply@e.fiverr.com
Cmm-X-Sid-Result: NONE
Spamdiagnosticoutput: 1:99
X-Ms-Exchange-Crosstenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa
X-Ms-Exchange-Organization-Network-Message-Id: 60c24ef2-1ca5-4e40-d643-08d4f2e809ce
Spamdiagnosticmetadata: NSPM
X-Ms-Publictraffictype: Email
X-Microsoft-Antispam: BCL:0;PCL:0;RULEID:(300000500095)(300135000095)(300000501095)(300135300095)(23075)(22001)(300000502095)(300135100095)(8291501071);SRVR:CO1NAM03HT199;
Message-Id: <COL004-MC4F379KAy4M010a74cc@COL004-MC4F37.hotmail.com>
X-Microsoft-Antispam-Message-Info: +Pw573e9LlUpr1iG7WE+GcZE31MDdlYkhr9GSpuyCRPbfdWSsZpYwOi3QpVv8kcHBr+wfkkkZUmrfpcpJ/+A5WeQNrP2q77KeyPk6rFdFIthC4nL8Khxq5oTvfdomuUEx1gbyAZqc+LqjXxEIhobYh4oOQniW277iaIgf2i2nmL/Ysv6yNAjcui3GcV3YwFAEYv0lvAKZc6p0SAdvMLh90Qn0Hua4qkrBdoxCEAVThCEeQYZoBisREWUdj4H3fhLAHZ7fxW+RqyVJr2f6Iv4jA==
Mime-Version: 1.0
X-Originalarrivaltime: 03 Sep 2017 16:22:57.0536 (UTC) FILETIME=[E73F5000:01D324D0]
Cmm-X-Sid-Pra: noreply@e.fiverr.com
X-Ms-Exchange-Organization-Authsource: CO1NAM03FT027.eop-NAM03.prod.protection.outlook.com
Cmm-Sending-Ip: 178.171.38.67
Received: from CO1NAM03HT199.eop-NAM03.prod.protection.outlook.com (10.174.245.146) by DM5PR12MB1467.namprd12.prod.outlook.com with HTTPS via DM5PR15CA0032.NAMPRD15.PROD.OUTLOOK.COM; Sun, 3 Sep 2017 16:22:58 +0000
Received: from CO1NAM03FT027.eop-NAM03.prod.protection.outlook.com (10.152.80.52) by CO1NAM03HT199.eop-NAM03.prod.protection.outlook.com (10.152.81.21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.1385.11; Sun, 3 Sep 2017 16:22:57 +0000
Received: from COL004-MC4F37.hotmail.com (10.152.80.57) by CO1NAM03FT027.mail.protection.outlook.com (10.152.80.161) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.20.13.11 via Frontend Transport; Sun, 3 Sep 2017 16:22:57 +0000
Received: from csmail1.qoo10.com ([178.171.38.67]) by COL004-MC4F37.hotmail.com with Microsoft SMTPSVC(7.5.7601.23143); Sun, 3 Sep 2017 09:22:57 -0700
X-Eopattributedmessage: 0
X-Ms-Office365-Filtering-Correlation-Id: 60c24ef2-1ca5-4e40-d643-08d4f2e809ce
Cmm-X-Message-Delivery: Vj0xLjE7RD0yO0dEPTI7U0NMPTQ=
Content-Type: text/plain
X-Ms-Exchange-Processed-By-Bccfoldering: 15.20.0013.014
X-Microsoft-Antispam-Mailbox-Delivery: abwl:0;wl:0;pcwl:0;kl:0;iwl:0;dwl:0;dkl:0;rwl:0;ex:0;psp:0;auth:0;dest:J;WIMS-SPF:newsletter%2ematarata%2eclub;WIMS-DKIM:coffeebasin%2ecom;WIMS-822:admin%40coffeebasin%2ecom;WIMS-PRA:noreply%40e%2efiverr%2ecom;WIMS-AUTH:NONE;ENG:(400001000128)(400125000095)(5062000261)(5061607266)(5061608174)(4900095)(4921089)(3120004)(4950112)(4990090)(9140004);RF:JunkEmail;OFR:SpamFilterAuthJ;
X-Ms-Traffictypediagnostic: CO1NAM03HT199:
X-Ms-Exchange-Organization-Scl: 1
Received-Spf: Pass (protection.outlook.com: domain of newsletter.matarata.club designates 178.171.38.67 as permitted sender) receiver=protection.outlook.com; client-ip=178.171.38.67; helo= csmail1.qoo10.com;
List-Unsubscribe: <info@coffeebasin.com>
X-Incomingtopheadermarker: OriginalChecksum:FBA3727A8476614FC4727D949F0A956A139EBA6F7F2704841CC110D8EA952332;UpperCasedChecksum:29F52E09483450B3025217237E465833DE69FE9421D4D69425C125E366EABE0C;SizeAsReceived:722;Count:11
X-Microsoft-Exchange-Diagnostics: 1;CO1NAM03FT027;1:ceZMIysaADhCiPsWIr4D/cN3CPjP+IZ3eEpUHJRe7HSFwRgDkYYty6wenSwHAIUIoP8dzLLhvxxppkfh7ZQQ67NRr0DNjRC1mQX7HkdcsDwpTQY7Um9ajuwEpSkzNQLO
X-Microsoft-Exchange-Diagnostics: 1;CO1NAM03HT199;3:YTj3tjgcLaanSRD1wDtSNb90EgtfLBs+a4AZ0v11GDyvE6ucrmUd5NKlgzepWtZ1oBUuFV+2C8MOiijvEVXkwCWvjJkzRGpBMTe+WuiQ8/RieiFaRu+0z4IgmrkBkU3PLZ32fM3a2fDJShXhwTQvDT6o+CABhgeFfmbh5D+VQVEeRSyPy+aE2+p/cwqN5D3p7hf3RiQ8EZy9V/jtdoS32NR+US1+j6JIs5+vVAqAW8QrVBqexAonGyQ4PKsk0YFvRAZqeCdUqY1eB8oW3CoCZf8D2P725tUB/ImKO5Vk1mT6To2gKWtGqq1dM+FWoI9+;25:i5cpCNyZENNUQlzaJW77WkkoGiiKvDyxxQ6586naC3nUnSc+d2jYrGOr6kfL6+6WZXuxNGPkEsy+v0T2wjjWBC61Qdz2Eka+Hj2YcYzLErRU9zQ3GSbPMy3E6BvE3JC3k/Ne12sRxc+90SqQ+TrpIPzxafb8ctH6RhYrqegjthBjIjg6ReQOdTwijqZEkQRuXoRc9UpoSB/7ax3M3CPif1OR6SoSHV7N0l0vKggSSXxCaUw+lN9MF8T4HFHxtLTM7pb3YuALe0y7a1v5iHdLxqlCo7GAeGftgBO+Ko+cwsSKrrbmEws7sr8u3d3wYylW11l3hsfJAIOUiNIy2Ug0xA==;31:oFml0EJvcbzUrM0l3Nwlp0knoTHQJ28KbffLj+SDR1x8Ka6ADThAvkOOPbgTm2nGWNNV81m1kRV2AJn/t6eNCpBhDJPx0twHA0nJt5M14WnOBvsc8w2OzG0aCToeL79pKxdhwbw6rHwLDbtxHqoPsr719MSZj3log9eVDSiuneVLnm5uuxWT9QvoS/4pEhGI8NBL7QHyU/jT/5omECH9a/U4juveMtSKjXErwg7Z7+k=
X-Microsoft-Exchange-Diagnostics: 1;CO1NAM03HT199;4:wxAxM/ovCC2jTljy+UhAWK1u9sONM1iiKkHaI8RhPO8+AE+WAvE+/U0VkeVzchOOHTbeoIRcvO4ryg7NZ0lKlto906RglN+Op0wzzWMN8zrYFYh8ll4RvTKD8KsK5FOc0f97NTXb+y98u4ZC5PjgZnLJadaNrmlBuuIdgPxN93xdTaiAdQr2rWhBM6AOIfsw12vQFz5athRmA/Nr2WzFI2cJfU3uNhqtle36WYa0QCJZ6sxzqIqPxfv0GlXt/4ck;23:CMNRMlwEDM8Ae7yDACZRlTyAPsv0zaESlUBINbnT1+dvQli2xpxTMBQd0YmU3Uejo3OUogUhRoMY95hMsxrusRbcX52/1zmEPuZIfAJbi1pOmNRkBjnVIdOUDVIKoa618fGom/csVVaiaOKL22mU9jmJ7Vb1duuR6SNiDvErlqqK/wGlsL2gdc4XGKnouig16oP8kHK2/Xajvgya5sLCeQ==;6:UcucEP/C79GBVwYoJ4CCPIvpbDgRJF6gYvBz+j4Rb7kddB2+S7fU7xND6wn9HFEflYlUupnoDocAGdQOSR0f4R5Tp/Pj4ZLv0AFREsLowYPSFCs7HTdfPDyLJ5D9p0ouEd/NX1MMDa2Bi5YITxd/wpXw2lBcfbdE2y47qwn4Cva1j1qUGq0vsGw3pduyrMOsB/3nj/jXeBS9vLU6YKLkzSbKk+UI4A8exIWnJzO3s4ZkWQsZD6OnoXFV0+V65K89wM/ctm1WUmrRkW92n9PhdyvhmuSatrYJw9bYiZjcqy1TZTpfK89LhnOx4T0JNB7FjrLSUos7pJ9dYJ3iNK5inQ==
X-Microsoft-Exchange-Diagnostics: 1;CO1NAM03HT199;5:uE549/tPRVnDdwNXfmgttuu1qh388QP/ZH/HdCpZQ9S7R9vZVFFJw2bds5e7oR9BapZjcUmfgo4rzr0mDDu/3gbMJwS520sCXhlWf8PG4JreDyiPNnyn2YifX6fe832asfnCJM+DZmfiGun/XiB++g==;24:xhqln7yxq5P0+WnktMhTMxp5SDQ24MagTO/tJRwJP0laknzpZMoHkDACSQVU+MqsFU5EYGdDmx6JmN/QuqZ02CdHeu6ht7oelCrdZC7WWgI=;7:TZO3geM1APH8NeYgwDK9A/IyH7wCtFZF3x4UWmiIjk84rng7jtA+xYEJ002wgWRB5tDE/qrAeiP/Erx0kGdJBOlbz9SuK9QZEOCX6JDbAkjHf+IJao/mwvA6GJrXXgh5axqVdP3jfacUuSvIwn8EARqoVhvDGwFMvywiZxMJV/l3tzrH0W5t6oYDdx+iXa4AU9gm9+W7in4UmlkzF6CrgQ0chIRvE9fsoG4p37WbClk=
X-Microsoft-Exchange-Diagnostics: 1;DM5PR12MB1467;27:CDPYE7d/0niEWmh0U1kmQfCjXDPK2/aa5np/k7mlXbsEvkxMqudOAa7UfgCpuSiwY3oPHEeaU9SCdpva5e+MADl5+WLz/PTKW8sST4YKswOrXiQH4n94/11X0MxA09y7
X-Ms-Exchange-Organization-Messagedirectionality: Incoming
X-Ms-Exchange-Transport-Endtoendlatency: 00:00:00.5768053

-------- Конец пересылаемого сообщения --------