fake bitcoin win scam

From - Sat May  9 07:40:32 2020
X-Account-Key: account3
X-UIDL: 1042748947.58982
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
Return-Path: <heljga77@i.ua>
Received: from mx5.mail.bg ([unix socket])
	 by stor3 (Cyrus 2.5.10-Debian-2.5.10-3) with LMTPA;
	 Sat, 09 May 2020 02:38:17 +0300
X-Sieve: CMU Sieve 2.4
X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on stor3.stor3
X-Spam-Level:
X-Spam-Status: No, score=-1.0 required=5.0 tests=BAYES_00,DKIMWL_WL_MED,
	DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,FROM_EXCESS_BASE64,SPF_PASS,
	TVD_SPACE_RATIO_MINFP shortcircuit=no autolearn=ham autolearn_force=no
	version=3.4.2
Received-SPF: pass (i.ua: 91.198.36.57 is authorized to use 'heljga77@i.ua' in 'mfrom' identity (mechanism 'ip4:91.198.36.0/25' matched)) receiver=mx5.mail.bg; identity=mailfrom; envelope-from="heljga77@i.ua"; helo=st12.mi6.kiev.ua; client-ip=91.198.36.57
Authentication-Results: mx5.mail.bg; dkim=pass (1024-bit key)
	header.i=@i.ua; dkim-adsp=none
Received: from st12.mi6.kiev.ua (st12.mi6.kiev.ua [91.198.36.57])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(No client certificate requested)
	by mx5.mail.bg (Postfix) with ESMTPS id 8D1B2808E4CD;
	Sat,  9 May 2020 02:38:17 +0300 (EEST)
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=i.ua;
	s=mail; h=Message-Id:Content-Transfer-Encoding:Content-Type:MIME-Version:Date
	:From:Subject:To:Sender:Reply-To:Cc:Content-ID:Content-Description:
	Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:
	In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:List-Subscribe:
	List-Post:List-Owner:List-Archive;
	bh=13enTuwyh5GODLSxe9j2MeOWOq9KYb+DZakSh8FXRbQ=; b=fHyFm4nl9dP76b7MP8QxuGnjHa
	OZD+Kpk9bOiPy++o1qwOYAMMRGXEw4Z/4BA8TQ9ALA9cvqdrC3JbYWMMoXd2GxKzbSRTUTYaJk2oY
	zfN9/6Q5+5oyKeQTZ4McfzdGVBRozGoUk/m5O1RuEax2ZhsLxXan6KlypXbfyZ8I6eZ8=;
Received: from web by st12.mi6.kiev.ua with local (Exim 4.90_1)
	(envelope-from <heljga77@i.ua>)
	id 1jXCZM-000171-JU; Sat, 09 May 2020 02:38:16 +0300
To: ajreid@dir.bg
Subject: =?utf-8?B?0JLQsNGI0LUg0L/RgNC40LPQu9Cw0YjQvdC40LUg4oSWMjl1?=
From: =?utf-8?B?0JDQu9C10LrRgdCw0L3QtNGAINCb0YvRgdC10L3QutC+?= <heljga77@i.ua>
Date: Sat, 09 May 2020 02:38:16 +0300
MIME-Version: 1.0
X-Mailer: I.UA Mail System
X-Server: st12.mi6.kiev.ua
X-Sender-IP: 193.200.151.69
X-User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 8bit
Message-Id: <E1jXCZM-000171-JU@st12.mi6.kiev.ua>

Здравствуйте Вы гарантированно получаете один из 1000 бесплатных билетов, для получения приза перейдите по ссылке https://bit.ly/2WztHLC?29u

HTTP/2 301
server: nginx
date: Sat, 09 May 2020 04:47:06 GMT
content-type: text/html; charset=utf-8
content-length: 114
cache-control: private, max-age=90
content-security-policy: referrer always;
location: https://agentliink.com/5wbo
referrer-policy: unsafe-url
set-cookie: _bit=k494L6-68f46cb0b3cb9dc38b-00j; Domain=bit.ly; Expires=Thu, 05 Nov 2020 04:47:06 GMT
via: 1.1 google
alt-svc: clear

https://agentliink.com/5wbo

HTTP/2 302
server: ddos-guard
set-cookie: __ddg1=mu3uzGp0xzJ0cmGeHt41; Domain=.agentliink.com; HttpOnly; Path=/; Expires=Sun, 09-May-2021 04:47:07 GMT
date: Sat, 09 May 2020 04:47:07 GMT
content-type: text/html; charset=utf-8
location: http://conv-forsc.info/m/4eR
strict-transport-security: max-age=15768000; includeSubdomains; preload
access-control-allow-origin: *
x-frame-options: ALLOWALL
x-content-type-options: nosniff

http://conv-forsc.info/m/4eR

HTTP/1.1 302 Found
Server: nginx/1.10.2
Date: Sat, 09 May 2020 04:47:10 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/7.1.3
Cache-Control: private, must-revalidate
pragma: no-cache
expires: -1
Set-Cookie: XSRF-TOKEN=eyJpdiI6IjJzMzVSTDN3blgyMW5Ob0MrbHFSMWc9PSIsInZhbHVlIjoibVh1SU83M3o5WDg4K3U5M05oaVRKeTZrMFczVWpLU09sWXJ4MVRrbjY0VEMxS21vWTUzbnJiZ3BnRmlhT2U3QiIsIm1hYyI6Ijg5NDM3YTlhZTczNzg0NDQwYTFhZTg0ZmQ3NzczNDlkN2I0N2FmNGJmZmMxZTEyZjg4OTE3NGFmZGNkYmI5ZGMifQ%3D%3D; expires=Sat, 09-May-2020 06:47:10 GMT; Max-Age=7200; path=/
Set-Cookie: convertoclick_session=eyJpdiI6IjVpR0V2ZUNOOFhZbHVXcjI0UzNJR3c9PSIsInZhbHVlIjoic2NTaXBkd281Q2dnN1BoSzJEc0tGSk5EaW9WOXZqMDJQUUJ5VVpvTWthbVwvcklQWFlOTllEak0xOVwvRnpPcjdRIiwibWFjIjoiMTEzMjc4NTNiYWZkNjZhNGIyNDIyZmY2NjRjYjFiMGM5NmQ1MTc5NTNkMzAzZjIyM2JiOTVkZjVjMDZjNmY2ZiJ9; expires=Sat, 09-May-2020 06:47:10 GMT; Max-Age=7200; path=/; httponly
Location: https://data-centrum-bitc.ru/converto/redirect-to-landing?url=https%3A%2F%2F1stbitcoin.ru%2Fvip%2F&source=4eR