SPAM pertaining to be from WHMCS domains

[easyhosting]

Hi All

 

got these 2 spam emails today

 

 

 

below is the header of the emails ( i have removed my emails and server hostname)

 

Return-path: <postman@livemailservice.com>
Envelope-to: ***************
Delivery-date: Sat, 06 Feb 2016 05:52:45 +0000
Received: from t-smtp3.livemailservice.com ([5.100.152.33]:52428)
by *************** with esmtp (Exim 4.86)
(envelope-from <postman@livemailservice.com>)
id 1aRvnT-0008SE-Kv
for ***************; Sat, 06 Feb 2016 05:52:45 +0000
Date: Sat, 6 Feb 2016 05:51:58 +0000 (GMT)
From: WHMCS Domains <domains@whmcs.com>
To: ***************
Subject: Urgent: Your refund request for USD 17.43 has been cancelled
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 7bit
X-Spam-Status: No, score=0.6
X-Spam-Score: 6
X-Spam-Bar: /
X-Ham-Report: Spam detection software, running on the system "***************",
has NOT identified this incoming email as spam.  The original
message has been attached to this so you can view it or label
similar future email.  If you have any questions, see
root\@localhost for details.

Content preview:  Cancel Refund Request WHMCS Domains Your refund request has
   been cancelled We have processed cancellation of your refund request and
  the amount has been credited back to your account. For your record, here are
   the details: [...] 

Content analysis details:   (0.6 points, 5.0 required)

 pts rule name              description
---- ---------------------- --------------------------------------------------
 0.0 URIBL_BLOCKED          ADMINISTRATOR NOTICE: The query to URIBL was blocked.
                            See
                            [url]http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block[/url]
                             for more information.
                            [uRIs: resellerclub.com]
-0.0 RCVD_IN_MSPIKE_H4      RBL: Very Good reputation (+4)
                            [5.100.152.33 listed in wl.mailspike.net]
 0.6 URG_BIZ                BODY: Contains urgent matter
 0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail
                            domains are different
-0.0 SPF_PASS               SPF: sender matches SPF record
-0.3 RP_MATCHES_RCVD        Envelope sender domain matches handover relay domain
-1.9 BAYES_00               BODY: Bayes spam probability is 0 to 1%
                            [score: 0.0031]
 0.0 HTML_MESSAGE           BODY: HTML included in message
 0.7 MIME_HTML_ONLY         BODY: Message only has text/html MIME parts
 1.6 MISSING_MID            Missing Message-Id: header
-0.0 RCVD_IN_MSPIKE_WL      Mailspike good senders
X-Spam-Flag: NO

[wsa]

I get this sometime also

[WHMCS John]

Hi,

These emails are legitimate. You can confirm this by reviewing the transactions in your ResellerClub acocunt provided by WHMCS: http://freeaccount.myorderbox.com

[easyhosting]

Hi, These emails are legitimate. You can confirm this by reviewing the transactions in your ResellerClub acocunt provided by WHMCS: http://freeaccount.myorderbox.com

cant be as i have never used my WHMCS domains account for many years and have no clients or services in it as i now have my own direct resellerclub account, so yes these are SPAM and reported as such