Rendered inside a sandboxed frame: scripts, forms and links are disabled. Loading remote images may confirm to the sender that this address exists.

Show headers
From 198.46.138.136 Wed Feb 25 09:00:23 2026
X-SPAM-SRC: TRAP
Received: from pagamentos.atitudenegocios.com.br ([198.46.138.136]:35204) from marc.scheidegger@ararhein.ch Auth: marc.scheidegger@ararhein.ch marcscheidegger by a Spamtrap on 157.161.9.65 587 pretending to be an open relay for marcelinkasper@gmx.de; Wed, 25 Feb 2026 09:00:20 +0100 (CET)
X-Spamtrap: Authentication has been performed! If this is the first connection from this IP we see (1), no attachements present and the size of this email is low we are going to relay this to encourage the attacker to send more emails to this spamtrap.
Date: Wed, 25 Feb 2026 08:00:49 +0000
Return-Path: <marc.scheidegger@ararhein.ch>
To: marcelinkasper@gmx.de
From: NordicLands <marc.scheidegger@ararhein.ch>
Subject: =?UTF-8?B?bWFpbC5hcmFyaGVpbi5jaCxtYXJjLnNjaGVpZGVnZ2VyQGFyYXJoZWluLmNoLG1hcmNzY2hlaWRlZ2dlcg==?=
Message-ID: <ceeff19e27863d46ab2c3ccad010ef17@localhost.localdomain>
X-Priority: 3
X-Mailer: PHPMailer 5.2.6
MIME-Version: 1.0
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: base64
Show raw body
PHA+PGEgaHJlZj0iaHR0cHM6Ly9ub3JkaWMuY29tIj48aW1nIHNyYz0iaHR0
cHM6Ly9jZG4uc2hvcGlmeS5jb20vc2hvcGlmeS1lbWFpbC84MnpqN21lZ3p0
NDNjNTVtNHNxczY4aHJpOGhmLmpwZz93aWR0aD05NjAmYW1wO2hlaWdodD05
NjAiIGFsdD0iIiB3aWR0aD0iNTE0IiBoZWlnaHQ9IjQ5NiIgLz48L2E+PC9w
Pg==
mail.ararhein.ch,marc.scheidegger@ararhein.ch,marcscheidegger
From NordicLands <marc.scheidegger@ararhein.ch>
To marcelinkasper@gmx.de
Date 25.02.2026 09:00:49 CET