Scam TagCloud

Scam Email Headers

This a (redacted) view of the raw email headers of this scam email. Personally Identifiable Information (PII) has been suppressed, but can be supplied as received to appropriate investigating or law enforcement agencies on request.

EEEEEstdClass Object ( [delivered-to:] => scamdex@gmail.com [received:] => Array ( [0] => by 10.96.135.9 with SMTP id po9csp1342960qdb; Sun, 7 Jun 2015 15:50:53 -0700 (PDT) [1] => from emea01-am1-obe.outbound.protection.outlook.com (mail-am1on0116.outbound.protection.outlook.com. [157.56.112.116]) by mx.google.com with ESMTPS id q9si1161440pdn.241.2015.06.07.15.50.48 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Sun, 07 Jun 2015 15:50:53 -0700 (PDT) [2] => from AM3PR04CA0014.eurprd04.prod.outlook.com (10.242.16.14) byHE1PR04MB1356.eurprd04.prod.outlook.com (25.163.175.30) with Microsoft SMTPServer (TLS) id 15.1.172.22; Sun, 7 Jun 2015 22:50:40 +0000 [3] => from DB3FFO11FD029.protection.gbl (2a01:111:f400:7e04::142) byAM3PR04CA0014.outlook.office365.com (2a01:111:e400:8814::14) with MicrosoftSMTP Server (TLS) id 15.1.184.17 via Frontend Transport; Sun, 7 Jun 201522:50:40 +0000 [4] => from exchange.ku.dk (130.225.206.173) byDB3FFO11FD029.mail.protection.outlook.com (10.47.217.60) with Microsoft SMTPServer (TLS) id 15.1.190.9 via Frontend Transport; Sun, 7 Jun 2015 22:50:39+0000 [5] => from P1KITMBX01WC01.unicph.domain ([fe80::e478:2e7f:c93d:d9dc]) byP1KITHUB01W.unicph.domain ([::1]) with mapi id 14.03.0224.002; Mon, 8 Jun2015 00:50:36 +0200 ) [x-received:] => by 10.70.35.230 with SMTP id l6mr24663936pdj.26.1433717453247; Sun, 07 Jun 2015 15:50:53 -0700 (PDT) [return-path:] => Array ( [0] => [1] => bvl591@alumni.ku.dk ) [received-spf:] => Array ( [0] => pass (google.com: domain of bvl591@alumni.ku.dk designates 157.56.112.116 as permitted sender) client-ip=157.56.112.116; [1] => Pass (protection.outlook.com: domain of alumni.ku.dk designates130.225.206.173 as permitted sender) receiver=protection.outlook.com;client-ip=130.225.206.173; helo=exchange.ku.dk; ) [authentication-results:] => Array ( [0] => mx.google.com; spf=pass (google.com: domain of bvl591@alumni.ku.dk designates 157.56.112.116 as permitted sender) smtp.mail=bvl591@alumni.ku.dk [1] => spf=pass (sender IP is 130.225.206.173)smtp.mailfrom=alumni.ku.dk; gmail.com; dkim=none (message not signed)header.d=none; ) [from:] => Annemarie Jacobsen [subject:] => I have an important transaction to share with you [thread-topic:] => I have an important transaction to share with you [thread-index:] => AdChRIqnEgzZC5zZRECME8xKOLy5NQABZuJg [date:] => Sun, 7 Jun 2015 22:50:36 +0000 [message-id:] => <17B242101F852C4ABD1616225BC5471DB1623781@P1KITMBX01WC01.unicph.domain> [reply-to:] => "abdulrah533@foxmail.com" [accept-language:] => da-DK, en-US [content-language:] => en-US [x-ms-has-attach:] => [x-ms-tnef-correlator:] => [x-originating-ip:] => [10.78.0.173] [content-type:] => multipart/alternative;boundary="_000_17B242101F852C4ABD1616225BC5471DB1623781P1KITMBX01WC01u_" [mime-version:] => 1.0 [to:] => Undisclosed recipients:; [x-eopattributedmessage:] => 0 [x-microsoft-exchange-diagnostics:] => 1;DB3FFO11FD029;1:l3DPAaP0uIvJQ44k9WPqS91hcckNjDUohxkMarqhXvcFRYAscN0M+PO9rpYAxgVmJbvksb1hGraUEWPcMHUImLJkX9oEoFOQCok5CQb/A+lNCJgpuspjOqccdKMZUqkMNNcSA1Jo7INAh3sppogxUmUMTKyWEck7LiT4cP6M3BUcS/RDpPQnWRJ3Q088FLDnMyXBi5GrMzRRQzXKZRDMJgArHLJJ2/13jMg+aHWx5XOU/3zqSBG6+JI261ynPXJZni9dC0MRvwMKjslgJSZkJ8A17uRBbzIyvPfxsZrg43dayoUVc5RT4E6dxgLOPC7h [x-forefront-antispam-report:] => CIP:130.225.206.173;CTRY:DK;IPV:CAL;IPV:NLI;EFV:NLI;SFV:NSPM;SFS:(10019020)(6009001)(438002)(189002)(199003)(2656002)(86362001)(33656002)(26826002)(54356999)(53806999)(50986999)(43066003)(189998001)(107886002)(87936001)(5001960100002)(40036004)(110136002)(5001860100001)(55846006)(16236675004)(573454002)(1671002)(19625215002)(881003)(6806004)(512954002)(19580395003)(84326002)(19300405004)(5001830100001)(450100001)(77156002)(46102003)(2930100002)(564344004)(2920100001)(62966003)(22746005)(102836002)(104016003)(5000100001)(106466001)(22756005)(4001540100001)(2900100001)(109986003)(5250100002)(15975445007)(229853001)(74482002)(79686002)(42262002)(4001450100001);DIR:OUT;SFP:1102;SCL:1;SRVR:HE1PR04MB1356;H:exchange.ku.dk;FPR:;SPF:Pass;MLV:nov;MX:1;A:1;PTR:unicph-gw.ku.dk;LANG:en; [x-microsoft-antispam:] => UriScan:;BCL:0;PCL:0;RULEID:;SRVR:HE1PR04MB1356; [x-microsoft-antispam-prvs:] => [x-exchange-antispam-report-test:] => UriScan:; [x-exchange-antispam-report-cfa-test:] => BCL:0;PCL:0;RULEID:(601004)(520003)(5005006)(3002001);SRVR:HE1PR04MB1356;BCL:0;PCL:0;RULEID:;SRVR:HE1PR04MB1356; [x-forefront-prvs:] => 0600F93FE1 [x-originatororg:] => alumni.ku.dk [x-ms-exchange-crosstenant-originalarrivaltime:] => 07 Jun 2015 22:50:39.5164(UTC) [x-ms-exchange-crosstenant-id:] => a3927f91-cda1-4696-af89-8c9f1ceffa91 [x-ms-exchange-crosstenant-originalattributedtenantconnectingip:] => TenantId=a3927f91-cda1-4696-af89-8c9f1ceffa91;Ip=[130.225.206.173];Helo=[exchange.ku.dk] [x-ms-exchange-crosstenant-fromentityheader:] => HybridOnPrem [x-ms-exchange-transport-crosstenantheadersstamped:] => HE1PR04MB1356 )

Community Action - SPAM/non-Scam Report

Occasionally, incorrectly categorized emails get into the Scamdex Scam Email Database and need to be removed. If this email has Personally Identifiable Information (PII), or is, in your opinion, from a bona-fide entity, let us know.

Scamdex will, as soon as is practicable, take-down any emails that in our opinion should not be in our database.
Note that ALL emails in the Scamdex Scam Email Database were received as Unsolicited Commercial Email, aka UCE or SPAM, via unpublished 'Honeypot' email addresses.