Re: please confirm your payment- Bitcoin Spam

Dear customer,

You are due to be advanced 2.3k today and we generally send this via Paypal

Please select your method

Other methods are available so select the one which suits you.

Regards,

Support

Unsubscribe | Report abuse

Komisch, aber in der Mail schreibt Ihr was anderes, als um das es wirklich geht. Hier geht es um Bitcoin Spam und der wird mittlerweile auch schon als Spam gefiltert und deswegen muss man das Spamopfer schon mit Falschmeldungen hinter dem Ofen vor holen bzw. die Spamfilter versuchen aus zu tricksen. Deswegen gehört auch diese Mail einfach und unbeachtet gelöscht und melden Sie sich ja nicht über den Link des Spammers dort an, denn dann macht der Provision dadurch

Versandadresse der Spammail:

Versandadresse: Payment-center – supportp@promopt.info

Verlinkung in der Spammail:

In der Mail wird auf diese Url verlinkt: promopt.info/mw/index.php/campaigns/xxx/track-url/xxx/xxx

promopt.info/mw/index.php/campaigns/xxx/track-url/xxxx/xxxx  (Link in der Mail)

stserv.trk.org/promopt

blue-winners.com/arminimum

neooffr.com/2f-special.html

clickbetter.com

Inhaberdaten der verwendeten Domain(s):

Mailheader der Spammail:

Return-path: <return@promopt.info>
Delivery-date: Tue, 10 Apr 2018 04:37:13 +0200
Received: from [195.4.92.14] (helo=mx4.freenet.de)
by mbox19.freenet.de with esmtpa (ID exim) (Exim 4.90_1 #2)
id 1f5j9l-0000EF-GT
for nerv@mich.net; Tue, 10 Apr 2018 04:37:13 +0200
Received: from rmg2.promopt.info ([70.34.109.42]:58441)
by mx4.freenet.de with esmtp (port 25) (Exim 4.90_1 #2)
id 1f5j9l-0000Jm-0Z
for nerv@mich.net; Tue, 10 Apr 2018 04:37:13 +0200
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=default; d=promopt.info;
h=Message-ID:Date:Subject:From:Reply-To:To:MIME-Version:Content-Type:List-Unsubscribe:List-Id; i=supportp@promopt.info;
bh=x2df8ffXjbi+uQWdf6NJyi/3/UnI=;
b=mUMEDf7vckGS7GZYdk/XVv2VakTFfB5y9hTMoHjCtY7SMl/4+pC1O42ceniqQApUXCJT4n1T36EN
JOKrvcF3PIn//VrDUnsiGvp5Fs2rzcgxfgxbg7LDU4mixc3p3zlRwx6cb4b78qObJ+KOagsFDwkSNB
rnvNLIgVLPjGKn1/uqw=
DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=default; d=promopt.info;
b=j+PGo10XS3o4WCDeWp65nRPAfjwZhF0408MkNeU8ihSsbnfXWvlVO4C8xNEOKVFJ6fOI82hXg6fV
CuelDV35RV9jhbDC/hlV5m6DjLs7dbVy2FghY3ixQ5Y5+o1ha95TrTswRLqEnwCULL92GMX/WHLEw
JhzBNksaRNhtg3WBqhw=;
Message-ID: <226cgh3e88ff509293acabeea3dc493@promopt.info>
Date: Mon, 09 Apr 2018 22:36:32 +0000
Subject: Re: please confirm your payment-
From: Payment-center <supportp@promopt.info>
Reply-To: Payment-center <supportp@promopt.info>
To: “nerv@mich.net” <nerv@mich.net>
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary=”_=_swift_v4_152gh313392_745578bghde98cf3d732gh7fbfcd47086b_=_”
X-Sender: return@promopt.info
X-Report-Abuse: Please report abuse for this campaign here:
http://promopt.info/mw/index.php/campaigns/xxxxx/report-abuse/xxxxx/xxxxx
X-Receiver: nerv@mich.net
X-Mw-Tracking-Did: 0
X-Mw-Subscriber-Uid: yy19kgx33c964
X-Mw-Mailer: SwiftMailer – 5.4.x
X-Mw-EBS: http://promopt.info/mw/index.php/lists/block-address
X-Mw-Delivery-Sid: 1
X-Mw-Customer-Uid: cxghj75oc6gz028
X-Mw-Customer-Gid: 1
X-Mw-Campaign-Uid: pv15hjecfc48
Precedence: bulk
List-Unsubscribe: <http://promopt.info/mw/index.php/lists/kf83hjqbyen6fa/unsubscribe/hj198gx33c96hj/pv15hjhjjgecfchj48/unsubscribe-direct?source=email-client-unsubscribe-button>
List-Id: kf8hjqbyen6fa <list>
Feedback-ID: pv15hjgecfc48:yy198gx33c964:kf835qbhjen6fa:cx075ochjz028
X-ACL-Warn: 457 Greylisted, please come back later.
X-Spam-Score: 0.7 (/)
X-Spam-Report: Action: no action
Symbol: TO_MATCH_ENVRCPT_ALL(0.00)
Symbol: FROM_NEQ_ENVFROM(0.00)
Symbol: TO_DN_EQ_ADDR_ALL(0.00)
Symbol: REPLYTO_EQ_FROM(0.00)
Symbol: DMARC_POLICY_ALLOW(-0.25)
Symbol: HAS_REPLYTO(0.00)
Symbol: FORGED_SENDER_MAILLIST(0.00)
Symbol: ONCE_RECEIVED(0.10)
Symbol: FAKE_REPLY(1.00)
Symbol: MID_RHS_MATCH_FROM(0.00)
Symbol: RCPT_COUNT_ONE(0.00)
Symbol: IP_SCORE(0.49)
Symbol: ASN(0.00)
Symbol: PRECEDENCE_BULK(0.00)
Symbol: HAS_LIST_UNSUB(-0.01)
Symbol: RCVD_NO_TLS_LAST(0.00)
Symbol: FROM_HAS_DN(0.00)
Symbol: MIME_GOOD(-0.10)
Symbol: R_DKIM_ALLOW(-0.20)
Symbol: DKIM_TRACE(0.00)
Symbol: RCVD_COUNT_ONE(0.00)
Symbol: R_SPF_ALLOW(-0.20)
Symbol: MAILLIST(-0.10)
Message: (SPF): spf allow
Message-ID: 226hj013e88ff509hj3acabeea3dc493@promopt.info
Delivered-To: nerv@mich.net
Envelope-to: nerv@mich.net
X-Originated-At: 70.34.109.42!58441