Four mails to three addresses (including the telling @domain and @machine.domain), from three different 'people' / domains. Unsubscribe links for each mail are per domain sent from, suggesting they used a real spam outfit to do this. The mails advertise an upcoming "Ethical Hacker" course. The entire mail was HTML garbage, screencapture images hosted here to show content.
Azab Ahmed (Azab_Ahmed@cyclamene.info)
Younies Yasser (Younies.Yasser@decurrens.info)
Yousief Omar (Yousief.Omar@tulipse.info)
Yassin Mohamed (Yassin_Mohamed@libanisa.com)
Return-Path: (Azab_Ahmed@cyclamene.info) X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on forced.attrition.org X-Spam-Level: o X-Spam-Status: No, score=1.6 required=4.6 tests=BAYES_50,HTML_IMAGE_RATIO_02, HTML_MESSAGE,MPART_ALT_DIFF_COUNT,RDNS_NONE,UNPARSEABLE_RELAY autolearn=no X-Original-To: jericho[at]forced.attrition.org Delivered-To: jericho[at]forced.attrition.org Received: from CYCLAMENE.INFO (unknown [188.8.131.52]) by forced.attrition.org (Postfix) with ESMTP id 19953CCE25 for (jericho[at]forced.attrition.org); Mon, 7 May 2012 04:36:24 -0500 (CDT) Received: (qmail 32270 invoked by uid 507); 7 May 2012 17:17:02 -0400 Received: from (HELO cyclamene.info) () by with SMTP; 7 May 2012 17:17:02 -0400 From: "Azab Ahmed" (Azab_Ahmed@cyclamene.info) To: jericho[at]forced.attrition.org Reply-To: Azab_Ahmed@cyclamene.info Subject: =?cp1256?B?RXRoaWNhbCBIYWNrZXIgdXBjb21p?= =?cp1256?B?bmcgY291cnNlcyAyMSBNYXkgMjAxMiBjYWxsIHVzIHRvIHJlc2VydmX=?= Date: Mon, 07 May 2012 23:17:02 +0200 Message-ID: (firstname.lastname@example.org) MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="--=38EF3355153E41C4AF0D_C77A_2218_BDBE"