"SALES DEPARTMENT" sales@alfa.infoexpress.pl

[SlapHappy]

* 109.144.143.79 Bt Openzone Wlan Services n/a United Kingdom


Received: by 10.217.61.7 with SMTP id h7csp102729wex;
Thu, 18 Oct 2012 13:40:24 -0700 (PDT)
Received: by 10.14.221.8 with SMTP id q8mr33398702eep.28.1350592823681;
Thu, 18 Oct 2012 13:40:23 -0700 (PDT)
Return-Path: <sales@alfa.infoexpress.pl>
Received: from alfa.infoexpress.pl (alfa.infoexpress.pl. [213.25.185.5])
by mx.google.com with ESMTPS id a8si20342508eep.137.2012.10.18.13.40.19
(version=TLSv1/SSLv3 cipher=OTHER);
Thu, 18 Oct 2012 13:40:23 -0700 (PDT)
Received-SPF: pass (google.com: best guess record for domain of
sales@alfa.infoexpress.pl designates 213.25.185.5 as permitted sender)
client-ip=213.25.185.5;
Authentication-Results: mx.google.com; spf=pass (google.com: best guess record
for domain of sales@alfa.infoexpress.pl designates 213.25.185.5 as permitted
sender) smtp.mail=sales@alfa.infoexpress.pl
Received: from [109.144.143.79] (helo=User)
by alfa.infoexpress.pl with esmtpa (Exim 4.71)
(envelope-from <sales@alfa.infoexpress.pl>)
id 1TOwxG-0002Ph-1t; Thu, 18 Oct 2012 22:44:38 +0200
Message-Id: <E1TOwxG-0002Ph-1t@alfa.infoexpress.pl>
From: "SALES DEPARTMENT"<sales@alfa.infoexpress.pl>
Subject: Re:Order
Date: Thu, 18 Oct 2012 21:39:41 +0100
MIME-Version: 1.0
Content-Type: text/html;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-Spam_score: 32.6
X-Spam_score_int: 326
X-Spam_bar: ++++++++++++++++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "alfa.infoexpress.pl",
has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.

Content preview: SALES DEPARTMENT LTD 103 New Oxford Street Hello, This message
is from the sales department. Please log in to view order details and quotations
[...]

Content analysis details: (32.6 points, 5.0 required)

pts rule name description
---- ---------------------- --------------------------------------------------
-1.0 ALL_TRUSTED Passed through trusted hosts only via SMTP
3.5 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
2.6 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
4.3 NSL_RCVD_HELO_USER Received from HELO User
1.0 MISSING_HEADERS Missing To: header
1.2 HTML_TAG_BALANCE_BODY BODY: HTML has unbalanced "body" tags
0.0 HTML_MESSAGE BODY: HTML included in message
0.7 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
3.3 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
1.4 FROM_MISSP_NO_TO From misspaced, To missing
0.0 FSL_NEW_HELO_USER FSL_NEW_HELO_USER
4.4 AXB_XMAILER_MIMEOLE_OL_024C2 AXB_XMAILER_MIMEOLE_OL_024C2
2.6 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE
0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only
1.5 FAKE_REPLY_C FAKE_REPLY_C
2.0 FROM_MISSPACED From: missing whitespace
1.7 TO_NO_BRKTS_FROM_MSSP Multiple formatting errors
1.4 FROM_MISSP_EH_MATCH From misspaced, matches envelope
1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook

SALES DEPARTMENT LTD
103 New Oxford Street


Hello,

This message is from the sales department. Please log in to view order details and quotations

View Products

"http:/ /www.efectoespejo.com/wp-content/themes/city/js/image/viewtradeorder.htm"
^^ Phishing website link.


Best regards
Richard Knowles
Sales Department Ltd
<a