blacklist.imp.ch

Saved Evidences

The stored evidence for this listing. The raw body is displayed as text, not rendered.

SourcesRaw header sourceRaw body sourceView rendered mail
Relay path (6 hops)
  1. dororo00.onmicrosoft.com→CY4PEPF0000E9CD.mail.protection.outlook.com
    Microsoft · 2025-10-27 18:45:56
  2. CY4PEPF0000E9CD.namprd03.prod.outlook.com→PH7P223CA0005.outlook.office365.com
    Microsoft · 2025-10-27 18:45:57
  3. PH7P223CA0005.NAMP223.PROD.OUTLOOK.COM→LV8P220MB1874.NAMP220.PROD.OUTLOOK.COM
    Microsoft · 2025-10-27 18:45:57
  4. mail-westus3azhn150100002.outbound.protection.outlook.com→idefix.imp.ch
    ESMTPS · 2025-10-27 18:46:02 · +5s
  5. →IMP ImproWare AG mail infrastructure (2 hops)
    • 🇨🇭 157.161.12.6 idefix.imp.ch→idefix.imp.ch
      LMTP · 2025-10-27 18:46:14 · +12s
    • 🇨🇭 157.161.12.6 idefix.imp.ch→tragicomix.imp.ch
      LMTP · 2025-10-27 18:46:14
From
Oral-B Kit – A Gift for UnitedHealthcare Members <fromdji7r14t1qtaamq4x6uhjskczbw14lxux@dororo00.onmicrosoft.com>
To
chiandetti@eblcom.ch
Date
27.10.2025 18:45:36 CET
Subject
[NAME], Your UnitedHealthcare Gift Awaits
SourceReport
Authentication
SPFfail
DKIM–
Spam score
SPF
SPF_HELO_NONESPF: HELO does not publish an SPF Record
SPF_PASSSPF: sender matches SPF record
HTML
HTML_FONT_LOW_CONTRASTHTML font color similar or identical to background
HTML_MESSAGEHTML included in message
MIME
MIME_HTML_ONLYMessage only has text/html MIME parts
MIME_HTML_ONLY_MULTIMultipart message only has text/html MIME parts
DNS lists
RCVD_IN_SWINOG_WHITE
Other
FREEMAIL_FROMSender email is commonly abused enduser mail provider
FROM_LOCAL_NOVOWELFrom: localpart has series of non-vowel letters
LONGLN_LOW_CONTRASTExcessively long line + hidden text
LONG_INVISIBLE_TEXTLong block of hidden text - bayes poison?
MPART_ALT_DIFFHTML and text parts are different
3.4

Header

X-SPAM-SRCREPO
Return-Path<fromdji7r14t1qtaamq4x6uhjskczbw14lxux@dororo00.onmicrosoft.com>
Delivered-Tochiandetti@eblcom.ch
Receivedfrom idefix.imp.ch ([157.161.12.6]) by tragicomix.imp.ch with LMTP id cGu2Ceav/2gcvBcAf9g64g:P1 (envelope-from <fromdji7r14t1qtaamq4x6uhjskczbw14lxux@dororo00.onmicrosoft.com>) for <chiandetti@eblcom.ch>; Mon, 27 Oct 2025 18:46:14 +0100
Receivedfrom idefix.imp.ch ([157.161.12.6]) by idefix.imp.ch with LMTP id cGu2Ceav/2gcvBcAf9g64g (envelope-from <fromdji7r14t1qtaamq4x6uhjskczbw14lxux@dororo00.onmicrosoft.com>) for <chiandetti@eblcom.ch>; Mon, 27 Oct 2025 18:46:14 +0100
Receivedfrom PH7PR06CU001.outbound.protection.outlook.com (mail-westus3azhn150100002.outbound.protection.outlook.com [IPv6:2a01:111:f403:d91c::2]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (P-384) server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by idefix.imp.ch (Postfix) with ESMTPS id 369E9C055F for <chiandetti@eblcom.ch>; Mon, 27 Oct 2025 18:46:02 +0100 (CET)
ARC-Seali=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=dheiAOImTKhHyvK/RYxezyNgR8CcMsJzPpZHdua2OO4JN7jLYPGvruSrRM25hT2NHKeirD+mwEzDrdVRU2eOXy7Zw637kEENvrUVYf5SnzkXt1IOqccdc/o7JwAqXyvoM231waxc8WrPr/+fL9rpIiu647gKofJ8Y8JnD40K/LmqGayg81mfuMyjbv6EjV0M9Pcp3yNE615jfuX6E4dl7G1tKw2C4vKp9jgHEpFubSUZ+IM8fNlo7ofb3xrmjaRjBfkyfOpMTJEhulJlLSd5gEd/9Vpa7mDlNk6dflbmwjUN1hv+a/p1v8p1S0Zo2d9d1TeNayiU3Q0I7KCuAJo8qA==
ARC-Message-Signaturei=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=Iw94pEtjE/2kkH2fB7jjuc9m+qz+zQu6B7eX9NwfhNk=; b=I0PeX7ECMRRU81wdtGavp1DdbtmiPHUjFINsDb2JAz/rm4lG8nWFutiLmcVy1yeVmkn5XdVKj5GxRQZBnSMaW4qckuj4Ad4vHHeaPzdzFGStkQz6LWeN9MsaiCVOmMK7Olkr81gXNIz/sEx07pRWyHDk4H15+3TO7ORx/c3KLDBG/XBCYKdbtRnwrIxmE0oXkM2tpxCK34SlWxXdxi8OOoEIm4AvdinIeYcVZ0MkGwzYS3Cgy0dxrRzL2KvxFuz6iTHevJkLuyhDe8nervOGsioFzN4/ZgrVfcuBU4uQi1w9HCtMBBO4hm0Xvi/7kyn/vFe5qJoriMvsLVopBNBTgg==
ARC-Authentication-Resultsi=1; mx.microsoft.com 1; spf=fail (sender ip is 103.241.67.189) smtp.rcpttodomain=eblcom.ch smtp.mailfrom=dororo00.onmicrosoft.com; dmarc=none action=none header.from=dororo00.onmicrosoft.com; dkim=none (message not signed); arc=none (0)
Receivedfrom PH7P223CA0005.NAMP223.PROD.OUTLOOK.COM (2603:10b6:510:338::7) by LV8P220MB1874.NAMP220.PROD.OUTLOOK.COM (2603:10b6:408:1be::7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9253.18; Mon, 27 Oct 2025 17:45:57 +0000
Receivedfrom CY4PEPF0000E9CD.namprd03.prod.outlook.com (2603:10b6:510:338:cafe::da) by PH7P223CA0005.outlook.office365.com (2603:10b6:510:338::7) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.9253.17 via Frontend Transport; Mon, 27 Oct 2025 17:45:57 +0000
X-MS-Exchange-Authentication-Resultsspf=fail (sender IP is 103.241.67.189) smtp.mailfrom=dororo00.onmicrosoft.com; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=dororo00.onmicrosoft.com;
Received-SPFFail (protection.outlook.com: domain of dororo00.onmicrosoft.com does not designate 103.241.67.189 as permitted sender) receiver=protection.outlook.com; client-ip=103.241.67.189; helo=dororo00.onmicrosoft.com;
Receivedfrom dororo00.onmicrosoft.com (103.241.67.189) by CY4PEPF0000E9CD.mail.protection.outlook.com (10.167.241.132) with Microsoft SMTP Server id 15.20.9275.10 via Frontend Transport; Mon, 27 Oct 2025 17:45:56 +0000
DateMon, 27 Oct 2025 18:45:36 +0100
FromOral-B Kit – A Gift for UnitedHealthcare Members <fromdji7r14t1qtaamq4x6uhjskczbw14lxux@dororo00.onmicrosoft.com>
Tochiandetti@eblcom.ch
Subject[NAME], Your UnitedHealthcare Gift Awaits
Content-Typemultipart/alternative; boundary="_9da72f7f-228c-4abd-861d-8eedecb2ce52_"
Precedencebulk
Message-ID<35d739c7-c676-4069-9c61-14c34967e359@CY4PEPF0000E9CD.namprd03.prod.outlook.com>
X-EOPAttributedMessage0
X-MS-PublicTrafficTypeEmail
X-MS-TrafficTypeDiagnosticCY4PEPF0000E9CD:EE_|LV8P220MB1874:EE_
MIME-Version1.0
X-MS-Office365-Filtering-Correlation-Idc534556b-9576-4f2b-e0dc-08de1580aedf
X-MS-Exchange-SenderADCheck1
X-MS-Exchange-AntiSpam-Relay0
X-Microsoft-AntispamBCL:0;ARA:13230040|586017|376014|61400799027|34070700014|36860700013|82310400026|4022899009|1032899013|69100299015|8096899003|2066899003|13003099007|16130700020;
X-Microsoft-Antispam-Message-Info=?utf-8?B?aTZlVE5JTitEUnhjUGs3NFhuRkZQSHdmaVFwNjRwWHJuRUxDai9taUJlcUZF?= =?utf-8?B?MG82b2c1MklKVU5Ca1prdEU4cmRrSWZDYlFDOEZzcEFUeGczcDNNS1BFTVV6?= =?utf-8?B?c0Zic1lEb2dxYlEvM3NDRDF5ZFFnUGw4U1lVTkFXNXMzcjhxZ2U5MlR2aWZU?= =?utf-8?B?R1hZeGtrQU00QnZXekhoZm40ZVNjaklCYkQyRHE1RzFIOUpUODZNNklCSkxN?= =?utf-8?B?TWlyNzd4L2Zna0FzdEoxNDB3aVlPTUY2WFFja1pTQU82Y256bk43bUlwRW8r?= =?utf-8?B?STRtcjZsSlRMQkdBdjhhNGFsRWVSS29iZWFTdlhTTFR4Q01lbFkvNG40K2Z0?= =?utf-8?B?SkdQNDJweE93ajBldGVhcmo1VGgydzNxNkVNSm1oNzV5RW1BMXBnN0czQnhO?= =?utf-8?B?eGVsa1FnT3R4Qk85VmkyOFV6VndEekRlYW9zNVpMd1ZmbGx6Q2FWaUxkZ2Q0?= =?utf-8?B?VzY2U3pEWjhTbGQvd0MraEduOW51STZBS3k4T2ttbmFhM2Vmc2xDSHNuVEhV?= =?utf-8?B?MGdESjR2SjJlNTEvTGh3TVlkQ1hkNHUrVnRxclZNdmx5b1hIQ1lhalBrYStn?= =?utf-8?B?cWM4YlEwYm4wK21HblpYYUZIaTU3U0RXMlluMHJHd21TMXBvc2J5TE1JY05U?= =?utf-8?B?dml1SnJiSWY4a3NXVXhha0hGU2F2UTcxbUY4ZUVEaWNqbm9ONnRpWUtnemJ1?= =?utf-8?B?UzF2SGRleEJISWplSUFPNmQ5cklXekhKcUpNczFtMGk4TGdtUzR1eFVEdWVT?= =?utf-8?B?amluakJwdDg3Njd3L056anlSbWlXS1VwZXdvQXFqRjVvWnFheXg4VGRQMVo2?= =?utf-8?B?RE5YYjdVMndSc1JUUjFTM2hHUElRRU5IWndQeTFrUEdhYmN4emJtcXNxRFJ4?= =?utf-8?B?RXJBQkRTREc5cnJwc01iazNiWHFVK0tSU1BJd0VnRVpPTlhuZThqeWh0cHNn?= =?utf-8?B?a3NJZVdsbk4vSC9wLzF3aEl5T1Z5NGVnTUtPK25ZZnM3dnZ2YnN4VXd4emlB?= =?utf-8?B?U2I2eHJyamRLVkx5V3dLeFpINDR5cVZPcXk4KytiMDBkUjlIRHRGRnJSbEtZ?= =?utf-8?B?RWo1d1hUcFJha0hwdiszRGxFdTBtYU5iQVpmNCt3Y3VpdFhxM0tVTHV1NkpO?= =?utf-8?B?ekZkSWkwckJzT0ZwZFZ4UDJmTEh2b21NaExyMVMydEpXT0hnRDRHT05xd2tB?= =?utf-8?B?d0VSK0hNRUUwVytyOHdwbkJwK3BGM1M2elVyN2xXRkFZSThtNURhMDR2bmQ0?= =?utf-8?B?emZyeE5ZbHNWcm16QW90VFB0S240cjZ5RWQvOEcvK0t1ZVBva3dBb0dxcGhn?= =?utf-8?B?OVh5bXJDRFp3OWVVM3p5Q1RIU3pQSmtKNmlxWTVGaVZobWE0M0NsTXNhKzRG?= =?utf-8?B?bHRhTldEMk80SHR5YjJpZnpWQmhLQWRWUmlNUGp3WkVMc3hySVRHUXQ5OVRS?= =?utf-8?B?TVB5eDZVRSszSE1kMFhXN2YzTks2SFpudUV3KzdvZnAvSDZ1NXBkVnZUc2Nl?= =?utf-8?B?UGRyYWN1b0Z3NmFKQm1jVGdQR3VQMi9TNG1jMzNDRmVlUmpEY3Z6MEoybmZy?= =?utf-8?B?RjBPYjE3dElvb3p3UHc0MDBxS0NvNzNVZGZjV3hlNUFaNnI3ZkkrZDBRWTNp?= =?utf-8?B?UXMzbCtVSE5yaXpwVHZ3UXNuWUZ5NUpqQkwvVzVsVGwxUDJaN1JsNGY2d3VG?= =?utf-8?B?OW5yZUpMQkdnVmNYZ1BSVStXbDZHY0RUbGdFaUZiNENNTThDRVllNmtyYjVv?= =?utf-8?B?MFZ2TzR0Mzg1ZzhnOVdGbzI5MmNUMnVUVTJzQUJOQlR1VGlWa1p5cDBiQ0lG?= =?utf-8?B?c2EyckgyREpFUEczc0hwaERuUFNORFZEWGJRUzB3UVhMOUVWaEs4Z1lPUmZN?= =?utf-8?B?TW9qNE1wUm5zWVBRVjJINDZKaGVqNEdsKzFWd0o2bDhxeHZSK0d6Mjh4MmR5?= =?utf-8?B?Z3JPcXBmT0xvaGpGRDdGaFlPVVI5Z2I1UzRyOGR2YjFocU9QbVY3SzYwWmFo?= =?utf-8?Q?0qy5imhw4VchPZIcAqf/hDxmCqVKlU=3D?=
X-Forefront-Antispam-ReportCIP:103.241.67.189;CTRY:ES;LANG:en;SCL:1;SRV:;IPV:CAL;SFV:NSPM;H:dororo00.onmicrosoft.com;PTR:InfoDomainNonexistent;CAT:NONE;SFS:(13230040)(586017)(376014)(61400799027)(34070700014)(36860700013)(82310400026)(4022899009)(1032899013)(69100299015)(8096899003)(2066899003)(13003099007)(16130700020);DIR:OUT;SFP:1501;
X-OriginatorOrgdororo00.onmicrosoft.com
X-MS-Exchange-CrossTenant-OriginalArrivalTime27 Oct 2025 17:45:56.3920 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Idc534556b-9576-4f2b-e0dc-08de1580aedf
X-MS-Exchange-CrossTenant-Ida62eb0a9-cdcb-4235-942e-804bf70d2caf
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIpTenantId=a62eb0a9-cdcb-4235-942e-804bf70d2caf;Ip=[103.241.67.189];Helo=[dororo00.onmicrosoft.com]
X-MS-Exchange-CrossTenant-AuthSourceCY4PEPF0000E9CD.namprd03.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAsAnonymous
X-MS-Exchange-CrossTenant-FromEntityHeaderHybridOnPrem
X-MS-Exchange-Transport-CrossTenantHeadersStampedLV8P220MB1874
X-MS-Exchange-Organization-SCL3
X-Spam-Score3.424 FREEMAIL_FROM,FROM_LOCAL_NOVOWEL,HTML_FONT_LOW_CONTRAST,HTML_MESSAGE,LONGLN_LOW_CONTRAST,LONG_INVISIBLE_TEXT,MIME_HTML_ONLY,MIME_HTML_ONLY_MULTI,MPART_ALT_DIFF,RCVD_IN_SWINOG_WHITE,SPF_HELO_NONE,SPF_PASS
X-Scanned-ByMIMEDefang 2.84 on 127.0.1.1