Scam TagCloud

Scam Email Headers

This a (redacted) view of the raw email headers of this scam email. Personally Identifiable Information (PII) has been suppressed, but can be supplied as received to appropriate investigating or law enforcement agencies on request.

EEEEEstdClass Object ( [delivered-to:] => scamdex@gmail.com [received:] => Array ( [0] => by 2002:a02:9713:0:0:0:0:0 with SMTP id x19csp2816189jai; Sun, 27 Sep 2020 15:19:16 -0700 (PDT) [1] => from mail-sor-f41.google.com (mail-sor-f41.google.com. [209.85.220.41]) by mx.google.com with SMTPS id f15sor1591291lfa.137.2020.09.27.15.19.16 for (Google Transport Security); Sun, 27 Sep 2020 15:19:16 -0700 (PDT) [2] => from kschro-mail.han-solo.net (kschro-mail.han-solo.net. [83.138.69.138]) by gmr-mx.google.com with ESMTPS id h22si124153ljh.7.2020.09.27.15.19.15 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Sun, 27 Sep 2020 15:19:16 -0700 (PDT) [3] => from [192.168.0.4] (aftr-37-201-194-62.unity-media.net [37.201.194.62]) (authenticated bits=0) by kschro-mail.han-solo.net (8.14.9/8.13.6) with ESMTP id 08RMBLQu013361; Mon, 28 Sep 2020 00:15:15 +0200 ) [x-received:] => Array ( [0] => by 2002:a19:be02:: with SMTP id o2mr2992385lff.265.1601245156549; Sun, 27 Sep 2020 15:19:16 -0700 (PDT) [1] => by 2002:a19:cc8f:: with SMTP id c137mr2986093lfg.476.1601245156258; Sun, 27 Sep 2020 15:19:16 -0700 (PDT) ) [arc-seal:] => Array ( [0] => i=2; a=rsa-sha256; t=1601245156; cv=pass; d=google.com; s=arc-20160816; b=ORTy8w1xEzTZIG/W7+9L+EdVTKzn6meCWJ/dXA9BUnKplnkjG8KFpx3ND8hHv98PoA mICOuE0WsFEwQ4w3URPDxwJLZWaGuil+t4BqCWm0PkqnyP+b5tSazYqGXA3J9hmoPZFB xMWfTLmSAB9ONJC1sWVJ/ZioKF21SBq3SkBI4MjzCs/MFs7vtBvyTerXyecXt5eJOcoE bmeknALq+ZSUw7+mEvDaZeTYlnt1c1ZrrcQB9PFzGb6VYMkAfdM0hcqt63k2FLchBuZ9 FN46b70+EEZK6mwVJpLKTh+uso6PUTAy0t9zWzml4BVerPLqaxSuTJijW8Wso4Z+xdgs 44Dw== [1] => i=1; a=rsa-sha256; t=1601245156; cv=none; d=google.com; s=arc-20160816; b=vId1DHjUVN8ygFBV7soFAgWU+DswJaB+QoMdO2H5cytYP7aYqqirUACb4LKlggYpPy juvB+kYv/isTfqnYnbG+slofd5T2B6FGFKHPUfO1qRSOdsw9baPuoFw+RWt/fP4pmGN7 Zb6BeeMjNAURX3w2OPZFhFPCGCVeAZOjtZF6HGNxGnfsgsAeN4K3+U0FyEiClJFdtmaG 6oV9gjjcOOvILgF2D9gfrPMdbgEyt4QpFSN2pi3RcpFjN7/WCWhlrFyT+ub27rFM03nE z1tgQ7vSZ0+P6ilIHeqziyCNVDjiBPm33xGuMUQEac12beXvqaH0vuVKw63Z6c1F26IF sBJA== ) [arc-message-signature:] => Array ( [0] => i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=reply-to:date:from:to:subject:mime-version:message-id; bh=rTPtcH6ONkYbE/KrIxds6JSyDnoOV/x5rWfsc66xn0M=; b=WTCUTsiQmq6iEsXd7oqq6jsnBeG1kwFOoHk/JCq6Q49Uk8VSk6xiLM9OUJxeZm6/QL Y8nW90n1v5/J9XeiMJnDxmDs6l7LizIabip1wCdXcoBgF3wAJ+u3RbSXvvBbLEOojyI2 BK10j0DBhkLuCef6hlna3bHMRksXkIIFaoekTReY8hIXM3fzxWPLrza8ROcOEKkPSPbk tUuM+B8CxyJ9ZzOyw2Pbi/zly07+Hxwb/6wpyjceZY1RsV9f8Z4IgG5g0/oPMWn+RAT7 NsR1RWFcFQ+W8dMKinW/wyt0vXZafYZNr+PZhFcimu1cp6LT/jQCbuBgL23QIxp/TQmX YbTA== [1] => i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=reply-to:date:from:to:subject:mime-version:message-id; bh=rTPtcH6ONkYbE/KrIxds6JSyDnoOV/x5rWfsc66xn0M=; b=KiFHCiXTBJ98q8pyu//2fFF4SQqqC/4nN1kMgQM0fOnO8SQguD1CEScspOCQXwdyup NYu4aeXpDcM+9J00k7q3TByYx3dPVnH/lLoe/SbnM4tOOmywxh2XXUdQC/c9q6xMbYfK wL56kGsd3EAvYz2WfMTFh3eO9vGjIgpVpI1C7inKIoSVxcfc/3HJoswoEazRotfroniq 6AUlTDjIAnbp4gkvauQAN+HQN1REmbKBJ7sWi1d0PSyZLl0cy07DzXfIS9Bj+RD3veTg A+eSo2HkYEsLN2RMlS88ugeeAN90aeH4lrGPNofh8iG+9/1dzPqOkvxdXo7lZGr+IiYK dUow== ) [arc-authentication-results:] => Array ( [0] => i=2; mx.google.com; arc=pass (i=1 spf=pass spfdomain=han-solo.net); spf=neutral (google.com: 209.85.220.41 is neither permitted nor denied by best guess record for domain of rechnung@han-solo.net) smtp.mailfrom=rechnung@han-solo.net [1] => i=1; gmr-mx.google.com; spf=pass (google.com: best guess record for domain of rechnung@han-solo.net designates 83.138.69.138 as permitted sender) smtp.mailfrom=rechnung@han-solo.net ) [return-path:] => Array ( [0] => [1] => ) [received-spf:] => Array ( [0] => neutral (google.com: 209.85.220.41 is neither permitted nor denied by best guess record for domain of rechnung@han-solo.net) client-ip=209.85.220.41; [1] => pass (google.com: best guess record for domain of rechnung@han-solo.net designates 83.138.69.138 as permitted sender) client-ip=83.138.69.138; ) [authentication-results:] => mx.google.com; arc=pass (i=1 spf=pass spfdomain=han-solo.net); spf=neutral (google.com: 209.85.220.41 is neither permitted nor denied by best guess record for domain of rechnung@han-solo.net) smtp.mailfrom=rechnung@han-solo.net [x-google-dkim-signature:] => v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-original-authentication-results:x-gm-message-state:message-id :mime-version:subject:to:from:date:reply-to; bh=rTPtcH6ONkYbE/KrIxds6JSyDnoOV/x5rWfsc66xn0M=; b=CGlrmn+pLIUE+6uDEqjrvg8RG2QU6zKRbwTm8FpnGqEbL7xtRxXpj3FYseJ6YwG2MT NuXjgz2lpfp+Dji93NBsqCns0LCfw8m6qojl0GyJ+8u2xLWDJD8HFOatpWQPiEFeMswp fNJE45EG1HzzOQRR0Lhgcz0M2RX0llIL0imM2wB9RqCRYs5nVht86Dfl3W6hrECsH8Ks J1o448xJ44sekER5NzxFYFaNz4ZmUuxcXEIajUjrXKOhM6pLg5Z9xgj2SerNsW/WbVGm Fm1YAcOkgCtJJ1rmV0MfaLCCH7A/aYxui/Mzl5nlZCUJrB+r4LHwo/ki7u0P7d4M3vko +YSA== [x-original-authentication-results:] => gmr-mx.google.com; spf=pass (google.com: best guess record for domain of rechnung@han-solo.net designates 83.138.69.138 as permitted sender) smtp.mailfrom=rechnung@han-solo.net [x-gm-message-state:] => AOAM5310LyvJPU9SMhmFaJQk0kiIZOtGPBaTd9ecQr/ACC8TxMPzp3+V C+9UbHb9IBxxHgEH/eg+iIUKc/xv1jZsI5MoGg== [x-google-smtp-source:] => ABdhPJxRuIYfb6FLjXekKqt83kLg0NsgmhTF+bs16r5L6b8Y8zF/QnZthYp9H+DnYZENBuf8ihppq+uem/Bb/oj3fDKfAC1sqoQ= [message-id:] => <202009272215.08RMBLQu013361@kschro-mail.han-solo.net> [content-type:] => multipart/alternative; boundary="===============1031379841==" [mime-version:] => 1.0 [subject:] => Business Proposal [to:] => Recipients [from:] => "Lyndon Nelson" [date:] => Mon, 28 Sep 2020 00:14:57 +0200 [reply-to:] => lyndonnelsonboi@gmail.com [x-priority:] => 1 (High) [x-antivirus:] => Avast (VPS 200927-2, 27/09/2020), Outbound message [x-antivirus-status:] => Clean )

Community Action - SPAM/non-Scam Report

Occasionally, incorrectly categorized emails get into the Scamdex Scam Email Database and need to be removed. If this email has Personally Identifiable Information (PII), or is, in your opinion, from a bona-fide entity, let us know.

Scamdex will, as soon as is practicable, take-down any emails that in our opinion should not be in our database.
Note that ALL emails in the Scamdex Scam Email Database were received as Unsolicited Commercial Email, aka UCE or SPAM, via unpublished 'Honeypot' email addresses.