Scam TagCloud

Scam Email Headers

This a (redacted) view of the raw email headers of this scam email. Personally Identifiable Information (PII) has been suppressed, but can be supplied as received to appropriate investigating or law enforcement agencies on request.

EEEEEstdClass Object ( [delivered-to:] => scamdex@gmail.com [received:] => Array ( [0] => by 10.96.135.9 with SMTP id po9csp1264545qdb; Sun, 7 Jun 2015 11:55:59 -0700 (PDT) [1] => from emea01-am1-obe.outbound.protection.outlook.com (mail-am1on0750.outbound.protection.outlook.com. [2a01:111:f400:fe00::750]) by mx.google.com with ESMTPS id lu16si595149pab.77.2015.06.07.11.55.55 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Sun, 07 Jun 2015 11:55:59 -0700 (PDT) [2] => from AM3PR04CA0025.eurprd04.prod.outlook.com (10.242.16.25) byHE1PR04MB1163.eurprd04.prod.outlook.com (25.162.249.13) with Microsoft SMTPServer (TLS) id 15.1.184.17; Sun, 7 Jun 2015 18:55:47 +0000 [3] => from AM1FFO11FD003.protection.gbl (2a01:111:f400:7e00::191) byAM3PR04CA0025.outlook.office365.com (2a01:111:e400:8814::25) with MicrosoftSMTP Server (TLS) id 15.1.184.17 via Frontend Transport; Sun, 7 Jun 201518:55:47 +0000 [4] => from exchange.ku.dk (130.225.206.173) byAM1FFO11FD003.mail.protection.outlook.com (10.174.64.85) with Microsoft SMTPServer (TLS) id 15.1.190.9 via Frontend Transport; Sun, 7 Jun 2015 18:55:41+0000 [5] => from P1KITMBX01WC01.unicph.domain ([fe80::e478:2e7f:c93d:d9dc]) byP2KITHUB02W.unicph.domain ([::1]) with mapi id 14.03.0224.002; Sun, 7 Jun2015 20:55:22 +0200 ) [x-received:] => by 10.70.127.140 with SMTP id ng12mr23461377pdb.94.1433703359290; Sun, 07 Jun 2015 11:55:59 -0700 (PDT) [return-path:] => Array ( [0] => [1] => bvl591@alumni.ku.dk ) [received-spf:] => Array ( [0] => pass (google.com: domain of bvl591@alumni.ku.dk designates 2a01:111:f400:fe00::750 as permitted sender) client-ip=2a01:111:f400:fe00::750; [1] => Pass (protection.outlook.com: domain of alumni.ku.dk designates130.225.206.173 as permitted sender) receiver=protection.outlook.com;client-ip=130.225.206.173; helo=exchange.ku.dk; ) [authentication-results:] => Array ( [0] => mx.google.com; spf=pass (google.com: domain of bvl591@alumni.ku.dk designates 2a01:111:f400:fe00::750 as permitted sender) smtp.mail=bvl591@alumni.ku.dk [1] => spf=pass (sender IP is 130.225.206.173)smtp.mailfrom=alumni.ku.dk; gmail.com; dkim=none (message not signed)header.d=none; ) [from:] => Annemarie Jacobsen [subject:] => Greetings [thread-topic:] => Greetings [thread-index:] => AdChSF3MB5qLDJHUS8+bFs5nL6thGwABH46QAAI+3VAABH2OoAAI+vuQABH1Y+AAI+qcoABH1RXA [date:] => Sun, 7 Jun 2015 18:55:21 +0000 [message-id:] => <17B242101F852C4ABD1616225BC5471DB161D259@P1KITMBX01WC01.unicph.domain> [reply-to:] => "abdulrah533@foxmail.com" [accept-language:] => da-DK, en-US [content-language:] => en-US [x-ms-has-attach:] => [x-ms-tnef-correlator:] => [x-originating-ip:] => [10.78.0.173] [content-type:] => multipart/alternative;boundary="_000_17B242101F852C4ABD1616225BC5471DB161D259P1KITMBX01WC01u_" [mime-version:] => 1.0 [to:] => Undisclosed recipients:; [x-eopattributedmessage:] => 0 [x-microsoft-exchange-diagnostics:] => 1;AM1FFO11FD003;1:X0updhI/UmjCuStMBB/QdQZeg0pQrVbo/QhEV7jVTTiL7fDuHOQO2P8JImOHcYJ0rEiG8Vsf+glz086m6eAoOkDEeohI4baR4B5XYtsDlsXEPBe8QKi/j11ZcK8CjbJW59/RYgs1NC45kG1R0pLcoZj6yT7xKXTFzHonqLmTCFL8e62mkHRdMvZtm6uStMc7vmhPVoZAwTwe2/cE7+4A+Cf+k2D643HYOAZSwmwvfs1bIJCfbsLqWAIgFO21tCNJTCZOFhOKYNGtuoFa/8F6Zn9lSaGBZcECKOJv3D2DcyPZ2+70ylB5bV8WXGFbUQQ4 [x-forefront-antispam-report:] => CIP:130.225.206.173;CTRY:DK;IPV:CAL;IPV:NLI;EFV:NLI;SFV:NSPM;SFS:(10019020)(6009001)(438002)(199003)(189002)(5000100001)(5250100002)(1671002)(102836002)(15975445007)(189998001)(2930100002)(2920100001)(2900100001)(16236675004)(551934003)(33656002)(46102003)(43066003)(19625215002)(74482002)(40036004)(110136002)(107886002)(5001960100002)(6806004)(564344004)(881003)(106466001)(22746005)(22756005)(86362001)(512954002)(19580395003)(104016003)(109986003)(229853001)(2656002)(84326002)(221733001)(54356999)(50986999)(53806999)(224903001)(87936001)(450100001)(55846006)(19300405004)(77156002)(62966003)(102436001)(42262002)(79686002)(4001450100001);DIR:OUT;SFP:1102;SCL:1;SRVR:HE1PR04MB1163;H:exchange.ku.dk;FPR:;SPF:Pass;MLV:nov;A:1;MX:1;PTR:unicph-gw.ku.dk;LANG:en; [x-microsoft-antispam:] => UriScan:;BCL:0;PCL:0;RULEID:;SRVR:HE1PR04MB1163; [x-microsoft-antispam-prvs:] => [x-exchange-antispam-report-test:] => UriScan:; [x-exchange-antispam-report-cfa-test:] => BCL:0;PCL:0;RULEID:(601004)(520003)(5005006)(3002001);SRVR:HE1PR04MB1163;BCL:0;PCL:0;RULEID:;SRVR:HE1PR04MB1163; [x-forefront-prvs:] => 0600F93FE1 [x-originatororg:] => alumni.ku.dk [x-ms-exchange-crosstenant-originalarrivaltime:] => 07 Jun 2015 18:55:41.3304(UTC) [x-ms-exchange-crosstenant-id:] => a3927f91-cda1-4696-af89-8c9f1ceffa91 [x-ms-exchange-crosstenant-originalattributedtenantconnectingip:] => TenantId=a3927f91-cda1-4696-af89-8c9f1ceffa91;Ip=[130.225.206.173];Helo=[exchange.ku.dk] [x-ms-exchange-crosstenant-fromentityheader:] => HybridOnPrem [x-ms-exchange-transport-crosstenantheadersstamped:] => HE1PR04MB1163 )

Community Action - SPAM/non-Scam Report

Occasionally, incorrectly categorized emails get into the Scamdex Scam Email Database and need to be removed. If this email has Personally Identifiable Information (PII), or is, in your opinion, from a bona-fide entity, let us know.

Scamdex will, as soon as is practicable, take-down any emails that in our opinion should not be in our database.
Note that ALL emails in the Scamdex Scam Email Database were received as Unsolicited Commercial Email, aka UCE or SPAM, via unpublished 'Honeypot' email addresses.