Saved Evidences
The stored evidence for this listing. The raw body is displayed as text, not rendered.
Relay path (4 hops)
- unknown source→mail-yw1-x1147.google.com
- mail-yw1-x1147.google.com→obelix.imp.ch
→IMP ImproWare AG mail infrastructure (2 hops)
- 🇨🇭 157.161.12.5 obelix.imp.ch→obelix.imp.ch
- 🇨🇭 157.161.12.5 obelix.imp.ch→tragicomix.imp.ch
From
=?UTF-8?B?Q1ZTIOKAkyBNZWRpY2FyZSBTZXJ2aWNlcyAjW0tNUkstMDA4ODJd?= <noreply@legaloffers.onmicrosoft.com>
To
ruru@breitband.ch
Date
07.08.2025 00:08:09 CEST
Subject
Respond today to secure your pending member benefit
SourceReport
Authentication
SPF–
DKIMpass
Spam score
2.0DKIM
DKIM_SIGNEDMessage has a DKIM or DK signature, not necessarily valid
DKIM_VALIDMessage has at least one valid DKIM or DK signature
SPF
SPF_HELO_NONESPF: HELO does not publish an SPF Record
SPF_PASSSPF: sender matches SPF record
HTML
HTML_MESSAGEHTML included in message
MIME
MIME_HTML_MOSTLYMessage multipart principalement en MIME text/html
DNS lists
RCVD_IN_DNSWL_NONESender listed at https://www.dnswl.org/, no trust
Other
FREEMAIL_FORGED_FROMDOMAIN2nd level domains in From and EnvelopeFrom freemail headers are different
FREEMAIL_FROMSender email is commonly abused enduser mail provider
FROM_OFFERSFrom address is "at something-offers"
HEADER_FROM_DIFFERENT_DOMAINSFrom and EnvelopeFrom 2nd level mail domains are different
MPART_ALT_DIFFHTML and text parts are different
URI_HEXURI hostname has long hexadecimal sequence
Header
| X-SPAM-SRC | REPO |
|---|---|
| Return-Path | <3SdKTaBAbAIgzuo0xxqqzsxq3KDGxqsmx0rrq34.0zyuo3040r5.o0y@maestro.bounces.google.com> |
| Delivered-To | ruru@breitband.ch |
| Received | from obelix.imp.ch ([157.161.12.5]) by tragicomix.imp.ch with LMTP id yCJmJ1XSk2g87wIAGLljUw:P1 (envelope-from <3SdKTaBAbAIgzuo0xxqqzsxq3KDGxqsmx0rrq34.0zyuo3040r5.o0y@maestro.bounces.google.com>) for <ruru@breitband.ch>; Thu, 07 Aug 2025 00:08:21 +0200 |
| Received | from obelix.imp.ch ([157.161.12.5]) by obelix.imp.ch with LMTP id yCJmJ1XSk2g87wIAGLljUw (envelope-from <3SdKTaBAbAIgzuo0xxqqzsxq3KDGxqsmx0rrq34.0zyuo3040r5.o0y@maestro.bounces.google.com>) for <ruru@breitband.ch>; Thu, 07 Aug 2025 00:08:21 +0200 |
| Received | from mail-yw1-x1147.google.com (mail-yw1-x1147.google.com [IPv6:2607:f8b0:4864:20::1147]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by obelix.imp.ch (Postfix) with ESMTPS id F3232E30CD for <ruru@breitband.ch>; Thu, 7 Aug 2025 00:08:10 +0200 (CEST) |
| Authentication-Results | obelix.imp.ch; dkim=pass (2048-bit key; unprotected) header.d=legaloffers-onmicrosoft-com.20230601.gappssmtp.com header.i=@legaloffers-onmicrosoft-com.20230601.gappssmtp.com header.a=rsa-sha256 header.s=20230601 header.b=zfKlIBFw; dkim-atps=neutral |
| Received | by mail-yw1-x1147.google.com with SMTP id 00721157ae682-71bc21d2790so4397557b3.1 for <ruru@breitband.ch>; Wed, 06 Aug 2025 15:08:10 -0700 (PDT) |
| DKIM-Signature | v=1; a=rsa-sha256; c=relaxed/relaxed; d=legaloffers-onmicrosoft-com.20230601.gappssmtp.com; s=20230601; t=1754518089; x=1755122889; darn=breitband.ch; h=to:from:subject:date:message-id:reply-to:mime-version:from:to:cc :subject:date:message-id:reply-to; bh=ZCbLc5WSEVn1WU6zOQWilAKdpTAJIQvXwXqR+SsdhhQ=; b=zfKlIBFwOeCk1Pb6gCSM0RmF4QsYufJzRWsu3Gy3NeEwNioLkZ1Q3HKuWNwiV/UlhT oUbV3e+ziP3LCNpM4aZgne2MXU1zwx0FYR2x6IahOzpItk5wXpSHc3sv22Gg0Oc0YV62 3V5L3JbtBAf9mPv74eShpfnYge7JczcFt+n7Hi7lQHwzW27riZMBPZo8gbBCM3Rqyc96 Nd2pUMnf6T3ZDv61INY6j/3eRFVf/J1CHovnR1TNyhUZpjnvsbrert3L9AuMHjkKFFB4 yAhOSNLTuTg4gxYsBYQMnE3+PLJ6ctu13oi3DpGw06HnIqsjx1S989K0RS1RGSyHf+Gf lCPw== |
| X-Google-DKIM-Signature | v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1754518089; x=1755122889; h=to:from:subject:date:message-id:reply-to:mime-version :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=ZCbLc5WSEVn1WU6zOQWilAKdpTAJIQvXwXqR+SsdhhQ=; b=uopKCujpGsXjKZ/LSqgUfakGNntH+x3OOVAGN5jqDPs5tqxU5RQaSwotAki0sZC1XP 9wVcdqhTRPglyIivGy8ErYaHEnwzcc96opj17NToHlR4h5+5mc5s6Q7jc2hB2UVLgcj2 IoLScSg0LbvT1+5URZ8Gwl+j3kFo5sU1oipduj6eQdhA1aVFd6iUxFz6wvBtheTV1UzI M4Y5P6ORj/Ywe4ANdQRcqgPUEwD518E6GWlhW6UXhoUYoVDrjWgEYv+6WqHHCmllhgiX FRZxtCnGiG9ZS296RNvfmvITlPVCmj3TmDcPfQvCVloABs5cQ0qPs+xwzUUJaXZnEySp h6xw== |
| X-Gm-Message-State | AOJu0YzVTM5cANNyitDg08EiTGIYFrPLMYkkFcOMlx6EARVamiWXp3mm 8Tc1FcrHzj+d/gAFvegpkLkXKwyvmfqyEw/3gYCRtPVkFjoMkYwfOaJGH89xFrw2SI8c5vu9YXu RNWZ5vHvobVxd2694IRYP8Owhm257EBGtRWSdXbR9OPmCUD0Sjo3iA2lfMxGwI6aDs8Gs+aEALQ oo |
| X-Google-Smtp-Source | AGHT+IFWwq+K/DKunoTrr9FYeaWaKsYWGlFP5e9FqHDNOU0DddB3j/v+oqAdJQNtEYtNzEx7pAs6apfSow== |
| MIME-Version | 1.0 |
| X-Received | by 2002:a05:690c:62c9:b0:71a:1445:b418 with SMTP id 00721157ae682-71bc9739874mr64873317b3.8.1754518089398; Wed, 06 Aug 2025 15:08:09 -0700 (PDT) |
| Reply-To | noreply@legaloffers.onmicrosoft.com |
| Message-ID | <autogen-java-290e6573-d414-42b8-bbf0-6287fcb88f1d@google.com> |
| Date | Wed, 06 Aug 2025 22:08:09 +0000 |
| Subject | =?UTF-8?B?UmVzcG9uZCB0b2RheSB0byBzZWN1cmUgeW91ciBwZW5kaW5nIG1lbWJlciBiZW5lZml0?= |
| From | =?UTF-8?B?Q1ZTIOKAkyBNZWRpY2FyZSBTZXJ2aWNlcyAjW0tNUkstMDA4ODJd?= <noreply@legaloffers.onmicrosoft.com> |
| To | ruru@breitband.ch |
| Content-Type | multipart/alternative; boundary="000000000000789405063bb993c7" |
| X-Greylist | Sender IP whitelisted by DNSRBL, not delayed by milter-greylist-4.6.2 (obelix.imp.ch [0.0.0.0]); Thu, 07 Aug 2025 00:08:11 +0200 (CEST) |
| X-MS-Exchange-Organization-SCL | 2 |
| X-Spam-Score | 1.994 DKIM_SIGNED,DKIM_VALID,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM,FROM_OFFERS,HEADER_FROM_DIFFERENT_DOMAINS,HTML_MESSAGE,MIME_HTML_MOSTLY,MPART_ALT_DIFF,RCVD_IN_DNSWL_NONE,SPF_HELO_NONE,SPF_PASS,URI_HEX |
| X-Scanned-By | MIMEDefang 2.84 on 127.0.1.1 |