Re: BetcoinCasino.com-Betcoin.ag-DICE FREEROLLS TODAY! - 100% Bonus!480 BTC jackpots
Also received such a mail, headers also look fishy (terms-google.com?)
the text version links to https://www.betcoin.ag/auupdate?token=...
but in the html version it links to: http://141.105.69.206/dn/?e=... (that ip is from russia
)
Code:
Return-Path:
X-Original-To: myemailaddresse@arcor.de
Received: from mail-in-05.arcor-online.net (mail-in-05.arcor-online.net [151.189.21.45])
by mail-in-16-z2.arcor-online.net (Postfix) with ESMTP id C75112167B2
for ; Wed, 13 Jan 2016 18:49:33 +0100 (CET)
Received: from host.terms-google.com (unknown [185.49.68.106])
by mx.arcor.de (Postfix) with ESMTPS id 3pgbrF1Brvz2xFx
for ; Wed, 13 Jan 2016 18:49:33 +0100 (CET)
Received: from user1 by host.terms-google.com with local (Exim 4.72)
(envelope-from )
id 1aJPY3-0000P4-Hf
for myemailaddress@arcor.de; Wed, 13 Jan 2016 17:49:31 +0000
To: "myemailaddress@arcor.de"
Subject: Important security update.
Date: Wed, 13 Jan 2016 17:49:31 +0000
From: Betcoin
Message-ID:
X-Priority: 3
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="b1_f00d00eb7afcd0cdb023a77497b83e70"
Content-Transfer-Encoding: 8bit
X-Arcor-Antispam: SPF_NONE RECEIVED_FROM_UNKNOWN URL_IN_DBL HTML_CLOAKED_SPAM
X-ArcorSpamBlocker: Spamcount: 10 Sensitivity: 13
X-Original-To: myemailaddresse@arcor.de
Received: from mail-in-05.arcor-online.net (mail-in-05.arcor-online.net [151.189.21.45])
by mail-in-16-z2.arcor-online.net (Postfix) with ESMTP id C75112167B2
for ; Wed, 13 Jan 2016 18:49:33 +0100 (CET)
Received: from host.terms-google.com (unknown [185.49.68.106])
by mx.arcor.de (Postfix) with ESMTPS id 3pgbrF1Brvz2xFx
for ; Wed, 13 Jan 2016 18:49:33 +0100 (CET)
Received: from user1 by host.terms-google.com with local (Exim 4.72)
(envelope-from )
id 1aJPY3-0000P4-Hf
for myemailaddress@arcor.de; Wed, 13 Jan 2016 17:49:31 +0000
To: "myemailaddress@arcor.de"
Subject: Important security update.
Date: Wed, 13 Jan 2016 17:49:31 +0000
From: Betcoin
Message-ID:
X-Priority: 3
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="b1_f00d00eb7afcd0cdb023a77497b83e70"
Content-Transfer-Encoding: 8bit
X-Arcor-Antispam: SPF_NONE RECEIVED_FROM_UNKNOWN URL_IN_DBL HTML_CLOAKED_SPAM
X-ArcorSpamBlocker: Spamcount: 10 Sensitivity: 13
the text version links to https://www.betcoin.ag/auupdate?token=...
but in the html version it links to: http://141.105.69.206/dn/?e=... (that ip is from russia
)