from mushawe.yoafrica.com ([196.44.176.11])
	by gwayi.yoafrica.com with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256)
	(Exim 4.90_1 (FreeBSD))
	(envelope-from <hostmaster-23611717-abuse=yoafrica.com@r.iecc.com>)
	id 1gKHHt-000FHQ-Ei
	for abuse@yoafrica.com; Wed, 07 Nov 2018 08:26:01 +0200

from gairezi.yoafrica.com ([196.44.176.14]:62924)
	by mushawe.yoafrica.com with esmtp (Exim 4.90_1)
	id 1gKHOz-0002Eg-5q
	for abuse@yoafrica.com; Wed, 07 Nov 2018 08:33:21 +0200

from localhost (localhost [127.0.0.1])
	by gairezi.yoafrica.com (Postfix) with ESMTP id 8044A2E82BD
	for <abuse@yoafrica.com>; Wed,  7 Nov 2018 08:27:05 +0200 (CAT)

No, score=1.501 tagged_above=-999 required=5
	tests=[ANY_BOUNCE_MESSAGE=0.1, BAYES_50=0.8, BOUNCE_MESSAGE=0.1,
	DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, KAM_LOTTO1=0.5,
	KAM_LOTTO2=1, LOTS_OF_MONEY=0.001, SPF_PASS=-0.001, ST_P0F_Unix=-1]
	autolearn=no autolearn_force=no

gairezi.yoafrica.com (amavisd-new);
	dkim=pass (1536-bit key) header.d=iecc.com

from gairezi.yoafrica.com (localhost [127.0.0.1])
	by gairezi.yoafrica.com (Postfix) with ESMTP id 6169D2E8299
	for <abuse@yoafrica.com>; Wed,  7 Nov 2018 08:26:59 +0200 (CAT)

pass (r.iecc.com: 64.57.183.30 is authorized to use 'hostmaster-23611717-abuse=yoafrica.com@r.iecc.com' in 'mfrom' identity (mechanism 'ip4:64.57.183.0/26' matched)) receiver=gairezi.yoafrica.com; identity=mailfrom; envelope-from="hostmaster-23611717-abuse=yoafrica.com@r.iecc.com"; helo=mail-report.iecc.com; client-ip=64.57.183.30

from mail-report.iecc.com (mail-report.iecc.com [64.57.183.30])
	by gairezi.yoafrica.com (Postfix) with ESMTP id 4799A2E82AB
	for <abuse@yoafrica.com>; Wed,  7 Nov 2018 08:26:56 +0200 (CAT)

iecc.com; smtp.remote-ip=41.190.32.15; spf=softfail spf.mailfrom=hswestonaria@live.co.za spf.helo=zwsmtp0.yoafrica.com

abuse@yoafrica.com, postmaster@yoafrica.com, wellington@yoafrica.com

E-mail spam alert (23611717 from 41.190.32.15) re Notification of winning! 

multipart/report; report-type=feedback-report;
        boundary="1541571945.48411_boundary"

This is an abuse report message in ARF format; for format details see
RFC 5965, http://tools.ietf.org/html/rfc5965

The following message, which appears to be from one of your users,
arrived recently at one of the domains that I manage.  It
looks to me like spam, unsolicited bulk e-mail.  Could you encourage
him/her/it to cut it out?  Thanks.

It was sent from IP address 41.190.32.15 to virtual-taugh-johnl@taugh.com,
 and arrived here at 5 Nov 2018 11:01:54 -0000 .

Please let me know when you've dealt with the abuser.

FYI, time stamps should be accurate to the second.  We use NTP to
sync our clock.  

NOTE: THE ENCLOSED COPY OF THE ANNOYING MESSAGE INCLUDES THE FULL
HEADERS.  If your mail program does not display them, set it to display
all the headers.  Some buggy mail and ticketing software may be unable
to display the headers present on the enclosed message.  If you are
forced to use such software, you can find a full copy of the message
including the headers at

 http://spample.iecc.com/hpv/23611717

Regards,
John Levine, hostmaster@iecc.com, postmaster@iecc.com,
postmaster@gurus.com, postmaster@services.net

Yes, score=11.8 required=4.4 tests=BAYES_80,DCC_CHECK,
	FREEMAIL_FORGED_REPLYTO,FREEMAIL_REPLYTO,HTML_MESSAGE,LOTS_OF_MONEY,
	MONEY_FROM_41,SPF_SOFTFAIL autolearn=no autolearn_force=no
	version=3.4.2

	*  2.0 BAYES_80 BODY: Bayes spam probability is 80 to 95%
	*      [score: 0.8659]
	*  0.7 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)
	*  0.0 HTML_MESSAGE BODY: HTML included in message
	*  4.0 DCC_CHECK Detected as bulk mail by DCC (dcc-servers.net)
	*  0.0 LOTS_OF_MONEY Huge... sums of money
	*  2.1 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
	*  1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain
	*      different freemails
	*  2.0 MONEY_FROM_41 Lots of money from Africa

from zwsmtp0.yoafrica.com (smtp2.yoafrica.com [41.190.32.15])
  by mail1.iecc.com ([64.57.183.56])
  with ESMTPS (TLS1.2/X.509/AEAD) via TCP port 60871/25 id 611957237; 05 Nov 2018 11:01:52 -0000

from runde.yoafrica.com ([196.44.176.6])
	by zwsmtp0.yoafrica.com with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256)
	(envelope-from <hswestonaria@live.co.za>)
	id 1gJcXZ-0004XI-Vc; Mon, 05 Nov 2018 12:55:29 +0200

from listman.yoafrica.com ([196.44.176.7] helo=verapamil.yoafrica.com)
	by runde.yoafrica.com with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256)
	id 1gJcXn-000NaI-Uf; Mon, 05 Nov 2018 12:55:43 +0200

from localhost ([127.0.0.1]:44054 helo=mail.megasave.co.zw)
	by verapamil.yoafrica.com with esmtp (Exim 4.90_1 (FreeBSD))
	id 1gJcaQ-0004J0-3F; Mon, 05 Nov 2018 12:58:26 +0200

multipart/alternative;
 boundary="=_873d7cd61b999727094afaad758c37d9"

<166530ec06ab22bb2c2efcadfe3e6ed1@live.co.za>
 <169f823c78aced914de8a125dc90410f@megasave.co.zw>
 <cc5c6fe6ddad01d7297a692f643cbda3@live.co.za>

Congratulations!! your email address has won you an online mega lottery
prize of £820,731.

Your active e-mail address attached to computer generated TICKET NUMBER:
BH 05607545 7152 with reference number UK/KA2C110EN5 has won UK Mega
Lottery 2nd category award prize. To claim your prize, contact Mr.
Francis Fisher, Royal Bank of Scotland London on Tel: +447781514317
E-Mail: telexunit@execs.com   

"PLEASE DO NOT REPLY BACK TO THE SENDERS ADDRESS OR THE FROM EMAIL
ADDRESS, THIS NOTIFICATION IS SENT AUTOMATICALLY VIA COMPUTER VIRTUAL
NOTIFICATION TO WINNING EMAIL ADDRESSES AND A RESPONSE WILL NOT BE
ATTENDED BY HUMAN BUT COMPUTER" CONTACT THE FIDUCIARY AGENTS AS ABOVE "

<html><head><meta http-equiv=3D"Content-Type" content=3D"text/html; charset=
=3DUTF-8" /></head><body style=3D'font-size: 10pt; font-family: Verdana,Gen=
eva,sans-serif'>
<p>Congratulations!! your email address has won you an online<span>&nbsp;me=
ga </span>lottery prize of &pound;820,731.<br /> <br /> Your active e-mail =
address attached to computer generated<span>&nbsp;</span><strong>ticket num=
ber:&nbsp;</strong><strong>BH 05607545 7152</strong><strong>&nbsp;</strong>=
with reference number<strong>&nbsp;UK/KA2C110EN5&nbsp;</strong>has won UK M=
ega Lottery 2nd category award prize. To claim your prize, contact Mr. Fran=
cis Fisher, Royal Bank of Scotland London on Tel: +447781514317 E-Mail: tel=
exunit@execs.com&nbsp;&nbsp;</p>
<p><br /></p>
<p style=3D"text-align: center;"><span style=3D"font-size: 8pt; color: #ff0=
000;">"<strong>Please do not reply back to the senders address or the from =
email address, this notification is sent automatically via computer virtual=
 notification to winning email addresses and a response will not be attende=
d by Human but computer" contact the fiduciary agents as above</strong> "</=
span></p>

</body></html>

From hostmaster-23611717-abuse=yoafrica.com@r.iecc.com Wed Nov 07 08:26:01 2018