Saved Evidences
The stored evidence for this listing. The raw body is displayed as text, not rendered.
Relay path (1 hop)
- 🇺🇸 198.46.138.136 pagamentos.atitudenegocios.com.br→a
From
NordicLands <marc.scheidegger@ararhein.ch>
To
marcelinkasper@gmx.de
Date
25.02.2026 09:00:49 CET
Subject
mail.ararhein.ch,marc.scheidegger@ararhein.ch,marcscheidegger
SourceSpamtrap
Authentication
SPF–
DKIM–
Spam score–
Header
| X-SPAM-SRC | TRAP |
|---|---|
| Received | from pagamentos.atitudenegocios.com.br ([198.46.138.136]:35204) from marc.scheidegger@ararhein.ch Auth: marc.scheidegger@ararhein.ch marcscheidegger by a Spamtrap on 157.161.9.65 587 pretending to be an open relay for marcelinkasper@gmx.de; Wed, 25 Feb 2026 09:00:20 +0100 (CET) |
| X-Spamtrap | Authentication has been performed! If this is the first connection from this IP we see (1), no attachements present and the size of this email is low we are going to relay this to encourage the attacker to send more emails to this spamtrap. |
| Date | Wed, 25 Feb 2026 08:00:49 +0000 |
| Return-Path | <marc.scheidegger@ararhein.ch> |
| To | marcelinkasper@gmx.de |
| From | NordicLands <marc.scheidegger@ararhein.ch> |
| Subject | =?UTF-8?B?bWFpbC5hcmFyaGVpbi5jaCxtYXJjLnNjaGVpZGVnZ2VyQGFyYXJoZWluLmNoLG1hcmNzY2hlaWRlZ2dlcg==?= |
| Message-ID | <ceeff19e27863d46ab2c3ccad010ef17@localhost.localdomain> |
| X-Priority | 3 |
| X-Mailer | PHPMailer 5.2.6 |
| MIME-Version | 1.0 |
| Content-Type | text/html; charset=ISO-8859-1 |
| Content-Transfer-Encoding | base64 |