from mushawe.yoafrica.com ([196.44.176.11])
	by gwayi.yoafrica.com with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256)
	(Exim 4.90_1 (FreeBSD))
	(envelope-from <hostmaster-23610494-postmaster=yoafrica.com@r.iecc.com>)
	id 1gEGK1-00005Z-Iq
	for postmaster@yoafrica.com; Sun, 21 Oct 2018 18:11:21 +0200

from mukosi.yoafrica.com ([196.44.176.140]:18039)
	by mushawe.yoafrica.com with esmtp (Exim 4.90_1)
	id 1gEGR6-0007Nw-SN
	for postmaster@yoafrica.com; Sun, 21 Oct 2018 18:18:40 +0200

from localhost (localhost [127.0.0.1])
	by mukosi.yoafrica.com (Postfix) with ESMTP id 5248BD3DB8B
	for <postmaster@yoafrica.com>; Sun, 21 Oct 2018 18:11:58 +0200 (CAT)

No, score=2.675 tagged_above=-999 required=5
	tests=[ADVANCE_FEE_3_NEW=3.275, ALL_TRUSTED=-0.6, BAYES_40=-0.001,
	DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001]
	autolearn=no autolearn_force=no

mukosi.yoafrica.com (amavisd-new);
	dkim=pass (1536-bit key) header.d=iecc.com

from mukosi.yoafrica.com (localhost [127.0.0.1])
	by mukosi.yoafrica.com (Postfix) with ESMTP id D3E29D3DC31
	for <postmaster@yoafrica.com>; Sun, 21 Oct 2018 18:11:52 +0200 (CAT)

from mail-report.iecc.com (mail-report.iecc.com [64.57.183.30])
	by mukosi.yoafrica.com (Postfix) with ESMTP id ED5CED3DC59
	for <postmaster@yoafrica.com>; Sun, 21 Oct 2018 18:11:51 +0200 (CAT)

iecc.com; smtp.remote-ip=41.190.32.11; spf=softfail spf.mailfrom=under_hate@hotmail.com spf.helo=zwsmtp0.yoafrica.com; dmarc=pass header.from=hotmail.com (p=none, pct=100)

abuse@yoafrica.com, postmaster@yoafrica.com, wellington@yoafrica.com

E-mail spam alert (23610494 from 41.190.32.11) re Hello, good day, 

multipart/report; report-type=feedback-report;
        boundary="1540138270.57837_boundary"

This is an abuse report message in ARF format; for format details see
RFC 5965, http://tools.ietf.org/html/rfc5965

The following message, which appears to be from one of your users,
arrived recently at one of the domains that I manage.  It
looks to me like spam, unsolicited bulk e-mail.  Could you encourage
him/her/it to cut it out?  Thanks.

It was sent from IP address 41.190.32.11 to virtual-taugh-johnl@taugh.com,
 and arrived here at 20 Oct 2018 23:04:43 -0000 .

Please let me know when you've dealt with the abuser.

FYI, time stamps should be accurate to the second.  We use NTP to
sync our clock.  

NOTE: THE ENCLOSED COPY OF THE ANNOYING MESSAGE INCLUDES THE FULL
HEADERS.  If your mail program does not display them, set it to display
all the headers.  Some buggy mail and ticketing software may be unable
to display the headers present on the enclosed message.  If you are
forced to use such software, you can find a full copy of the message
including the headers at

 http://spample.iecc.com/ulj/23610494

Regards,
John Levine, hostmaster@iecc.com, postmaster@iecc.com,
postmaster@gurus.com, postmaster@services.net

Yes, score=7.7 required=4.4 tests=BAYES_60,DCC_CHECK,
	FREEMAIL_FROM,FREEMAIL_REPLYTO,FREEMAIL_REPLYTO_END_DIGIT,HTML_MESSAGE,
	SPF_SOFTFAIL autolearn=no autolearn_force=no version=3.4.2

	*  1.5 BAYES_60 BODY: Bayes spam probability is 60 to 80%
	*      [score: 0.6087]
	*  0.7 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)
	*  0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in
	*      digit (bprc1893[at]gmail.com)
	*  0.3 FREEMAIL_FROM Sender email is commonly abused enduser mail
	*      provider (under_hate[at]hotmail.com)
	*  0.0 HTML_MESSAGE BODY: HTML included in message
	*  4.0 DCC_CHECK Detected as bulk mail by DCC (dcc-servers.net)
	*  1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain
	*      different freemails

from zwsmtp0.yoafrica.com (zwsmtp0.yoafrica.com [41.190.32.11])
  by mail1.iecc.com ([64.57.183.56])
  with ESMTPS (TLS1.2/X.509/AEAD) via TCP port 16941/25 id 610041466; 20 Oct 2018 23:04:42 -0000

from runde.yoafrica.com ([196.44.176.6])
	by zwsmtp0.yoafrica.com with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256)
	(envelope-from <under_hate@hotmail.com>)
	id 1gDzRX-000FhC-RS; Sun, 21 Oct 2018 00:09:59 +0200

from listman.yoafrica.com ([196.44.176.7] helo=verapamil.yoafrica.com)
	by runde.yoafrica.com with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256)
	id 1gDzRz-000PTb-SY; Sun, 21 Oct 2018 00:10:27 +0200

from localhost ([127.0.0.1]:33037 helo=mail.megasave.co.zw)
	by verapamil.yoafrica.com with esmtp (Exim 4.90_1 (FreeBSD))
	id 1gDzUJ-0004Yh-QD; Sun, 21 Oct 2018 00:12:51 +0200

multipart/alternative;
 boundary="=_a52943c1c45bb1043e1aa245c19a4e69"

<620b4bf3641a82b25a012fff1c78275e@webmail.co.za>
 <a9e53f877248715322f2dec334a778a5@hotmail.com>
 <f3d0f6ba1bde68f556d7ec4d47dd5515@hotmail.com>
 <c3c9bc323063d04629e525e62a22aac5@hotmail.com>
 <1663ad0ab4df28105af051c8885adfce@hotmail.com>

Hello, good day, 

 I have an immediate need for a business cooperation with you.
I got your contact through the Global Business/Investment Network. 

I represent an interest group who will want to negotiate a possible
working terms with you on an investment interest in your country.
Please get back to me for more details. 

Kind regards
Mr. Praimdass Jafar 

Tel: +27630470313
Please reply to my private email: cpt949359@gmail.com

<html><head><meta http-equiv=3D"Content-Type" content=3D"text/html; charset=
=3DUTF-8" /></head><body style=3D'font-size: 10pt; font-family: Verdana,Gen=
eva,sans-serif'>
<p><br /></p>
<p>Hello, good day,</p>
<p>&nbsp;I have an immediate need for a business cooperation with you.<br /=
> I got your contact through the Global Business/Investment Network.</p>
<p><br /> I represent an interest group who will want to negotiate a possib=
le<br /> working terms with you on an investment interest in your country=
=2E<br /> Please get back to me for more details.</p>
<p><br /> Kind regards<br /> Mr. Praimdass Jafar</p>
<p>Tel: +27630470313<br /> Please reply to my private email: <a href=3D"mai=
lto:cpt949359@gmail.com">cpt949359@gmail.com</a></p>

</body></html>

From hostmaster-23610494-postmaster=yoafrica.com@r.iecc.com Sun Oct 21 18:11:21 2018