Scam TagCloud

Scam Email Headers

This a (redacted) view of the raw email headers of this scam email. Personally Identifiable Information (PII) has been suppressed, but can be supplied as received to appropriate investigating or law enforcement agencies on request.

EEEEEstdClass Object ( [return-path:] => [delivered-to:] => Array ( [0] => unknown [1] => scamdex@gmail.com ) [received:] => Array ( [0] => from imap.gmail.com (74.125.195.108:993) by mail.scamalot.com with IMAP4-SSL; 06 Jul 2020 04:25:46 -0000 [1] => by 2002:a05:6638:24f:0:0:0:0 with SMTP id w15csp4554763jaq; Mon, 8 Jun 2020 01:59:17 -0700 (PDT) [2] => from mail-sor-f41.google.com (mail-sor-f41.google.com. [209.85.220.41]) by mx.google.com with SMTPS id o2sor6591014wrj.36.2020.06.08.01.59.16 for (Google Transport Security); Mon, 08 Jun 2020 01:59:17 -0700 (PDT) [3] => from d05ea0a.online-server.cloud ([82.223.10.118]) by gmr-mx.google.com with ESMTPS id f16si967017wrq.5.2020.06.08.01.59.16 for (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Mon, 08 Jun 2020 01:59:16 -0700 (PDT) [4] => from WIN-ETGQQT9LA10 (unknown [87.246.7.100]) by d05ea0a.online-server.cloud (Postfix) with ESMTPA id C769F7CBA2 for ; Mon, 8 Jun 2020 08:08:05 +0000 (UTC) ) [x-received:] => Array ( [0] => by 2002:adf:e908:: with SMTP id f8mr22144794wrm.184.1591606757134; Mon, 08 Jun 2020 01:59:17 -0700 (PDT) [1] => by 2002:a5d:5483:: with SMTP id h3mr23123223wrv.10.1591606756853; Mon, 08 Jun 2020 01:59:16 -0700 (PDT) ) [arc-seal:] => Array ( [0] => i=2; a=rsa-sha256; t=1591606757; cv=pass; d=google.com; s=arc-20160816; b=YZT4F713Bk3+9oaCw7znenn22ndt3lcqxGSkY1unM6sMcv3s2PPvBzT2AwCbxXglmx F5+QvLKQFArPh4ZN70BQjk8/YCha7VXFjrLIfjGk7qiG7H7h2SYHum8B+W8Qp53O0tnW 6eG1bQ3Sg6cgOhAgfuiQV29vIMd5Wun5zhXR3H5kwONH44nQw7B4EIZGhXF6673VAv+3 QC4r2GESJnpoXPTN6dnsQKIiM7JFUMeS8oTennSOVcP9eUijYZFvY9JXn5QURyJ6dEs9 PUt0e3HDfQnBGidC9WefXvIUDuvSSi16ZF3rJLjkZwGK0MXD/xyNBsh3LVwjgZyJfWIu gKOQ== [1] => i=1; a=rsa-sha256; t=1591606756; cv=none; d=google.com; s=arc-20160816; b=ZDKTUl0lKGga+b1sKbvVT8PehkzshIwA8WIs6goVAD9RuDDTEWqe8wnxWHTHCGXD4/ I5tPgnkmCOkr6nmeIJO439LXxzvNNAGK4eL+iMw1jEOR2S68GPwC1RCGn/ZFIWzm3m+j xYaTgM7ASft9vmrrtqYS3Sr+1VubguodVM7Wi5T9gL/n+T2ZCPWTSRkEn+f5RLIhT6Ts nrLG6IQmIOxKfz47U3rV9+ttm34OI1zY8Hdcr9C8wHdTBM/0sFCL6fzQ9mDUwKcuVHPU gkGbusnaq0+3ItWLjuJAFWJSvzR47rxjO2kUWNFU8WuUiF2QKoydvS+PdrHYYQn115ZI UecA== ) [arc-message-signature:] => Array ( [0] => i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=date:reply-to:mime-version:to:subject:from:message-id; bh=0IS7pbxdRxtWHkaMWkM0FAoINsL+Ehct+ZUjtXKMssw=; b=VbkR4B5E5YW3nQRqrc9hZ9LezYz/U0LitzIYI88MaPhzBcxL4qHM8Js50bMDkS0eDR STH31hYi5VloI9MXh5OHXaJ0RVa4NhbFQ1NFAUZIbNC9nSlsuLP/Gci9bbT4BwWioQ0Y hSaUsB97776PnHNW/xtavz4iRJ4Y/JED5IPOQKQXHWJW7XK1wJRs3lppogBdCPAj0HTw dUmuox0SJN7QNzb75c7Om0pCE4I+RkIVjMKmwO5i/Lw/9UyTpCmIIk63AvCoXtqdWR4P 2XuH0oBGpk8aEJXkGVxUQ41s+x3FOI8bCo/2kGrA9JSXs5uLIWRaBLT2e2hHi2v5r2ZE 3+qw== [1] => i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=date:reply-to:mime-version:to:subject:from:message-id; bh=0IS7pbxdRxtWHkaMWkM0FAoINsL+Ehct+ZUjtXKMssw=; b=J2rBZcaHbWiIofjIzq02p+AJ3OBQxUkweid8sb88L9zELXPxI7vXoLRnCoyxD2BOJ1 E2YIA1q3jaX8FkOZNR3T97Nqi9/oZKI3Oe3LfPLIJXf46C6SbxUfyjCe/yKpZz6m+rOn gzMCmXcIQx6REZfSH0zcslZ/c7Y0heq6GydXb6glC026CJXpU44AqyTxkv/ESD7W7oDP 1EaJ688W6i3gqL+Rv+ozPry6JwU+WHTBjrggqTXb392cPd7T3FLAidpJWYHgIvMu3ETB DqUgteYwL/gM762avFV3ZY/eeSs9yFsDyh3yvMotMIfOeLlFxKpaSYfIuKiv2LEEaI7A UleQ== ) [arc-authentication-results:] => Array ( [0] => i=2; mx.google.com; arc=pass (i=1 spf=pass spfdomain=puromarruecos.com); spf=fail (google.com: domain of info@puromarruecos.com does not designate 209.85.220.41 as permitted sender) smtp.mailfrom=info@puromarruecos.com [1] => i=1; gmr-mx.google.com; spf=pass (google.com: domain of info@puromarruecos.com designates 82.223.10.118 as permitted sender) smtp.mailfrom=info@puromarruecos.com ) [received-spf:] => Array ( [0] => fail (google.com: domain of info@puromarruecos.com does not designate 209.85.220.41 as permitted sender) client-ip=209.85.220.41; [1] => pass (google.com: domain of info@puromarruecos.com designates 82.223.10.118 as permitted sender) client-ip=82.223.10.118; ) [authentication-results:] => mx.google.com; arc=pass (i=1 spf=pass spfdomain=puromarruecos.com); spf=fail (google.com: domain of info@puromarruecos.com does not designate 209.85.220.41 as permitted sender) smtp.mailfrom=info@puromarruecos.com [x-google-dkim-signature:] => v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-original-authentication-results:x-gm-message-state:message-id :from:subject:to:mime-version:reply-to:date; bh=0IS7pbxdRxtWHkaMWkM0FAoINsL+Ehct+ZUjtXKMssw=; b=mWHnUQX8Lf5iU7eCIoW+I48nemb8TOTUTrMOOVx7s31Qlrv91vIWgSmwyMZYY4S6cd tsT76VUpGUmpqqfVTv19mqajPx+/dmw1Lb+8eCHCoXo2PVxoyeaupemHW7WwL03jlQR/ Cdb8S44LdOjnN5zkDOEvr3JNhkenrsol4xIl/6IYEJ7m/D3PTAjkdVv461ktbY/tZzDy llcofyo9Ij8w+RxmWq6QuN5k9pqR0dwL8XyJouHMfzBWbr6OOHN54RifdbR20GtbmaDP AhALFJKP6cntS7bjlDE6JDHzUgn9v89ol4L06SGf3PwHNRLnJbXt34qnr4/Fc+XlUP+W XZIQ== [x-original-authentication-results:] => gmr-mx.google.com; spf=pass (google.com: domain of info@puromarruecos.com designates 82.223.10.118 as permitted sender) smtp.mailfrom=info@puromarruecos.com [x-gm-message-state:] => AOAM532cUoeLgBzLco3o8wBR8+4idisSlhHq4csHjk9TVovrAO8SHCig we1Pr9GmTsWpZJ7o+6d9sC5QjaET6XYRkaoz/A== [x-google-smtp-source:] => ABdhPJyce9qbfbUEuZ4QB/VK5I1iHPcjVH1i9XkbM6p4vhZ5IgQzS0pOeUzPinANUvyWU3ZioAHpuyams8ITeMaJW00+WNAgFXg= [message-id:] => <5eddfde4.1c69fb81.d320d.b0acSMTPIN_ADDED_MISSING@gmr-mx.google.com> [from:] => "Theresa Emerick" [subject:] => ATTN: April Statement [to:] => "accounts" [content-type:] => multipart/alternative; boundary="sJheNvX4PMtW54ZWMUpbQ5oNBk5cE=_Zhu" [mime-version:] => 1.0 [reply-to:] => "Theresa Emerick" [date:] => Mon, 8 Jun 2020 01:08:06 -0700 [x-getmail-retrieved-from-mailbox:] => =?utf-8?q?=5BGmail=5D/Spam?= [x-gmail-thrid:] => =?utf-8?q?1668920646943865855?= [x-gmail-msgid:] => =?utf-8?q?1668920646943865855?= )

Community Action - SPAM/non-Scam Report

Occasionally, incorrectly categorized emails get into the Scamdex Scam Email Database and need to be removed. If this email has Personally Identifiable Information (PII), or is, in your opinion, from a bona-fide entity, let us know.

Scamdex will, as soon as is practicable, take-down any emails that in our opinion should not be in our database.
Note that ALL emails in the Scamdex Scam Email Database were received as Unsolicited Commercial Email, aka UCE or SPAM, via unpublished 'Honeypot' email addresses.