blacklist.imp.ch

Saved Evidences

The stored evidence for this listing. The raw body is displayed as text, not rendered.

SourcesRaw header sourceRaw body sourceView rendered mail
Relay path (6 hops)
  1. humanecolorado1.onmicrosoft.com→MN1PEPF0000ECDA.mail.protection.outlook.com
    Microsoft · 2025-10-26 19:51:29
  2. MN1PEPF0000ECDA.namprd02.prod.outlook.com→BLAPR05CA0016.outlook.office365.com
    Microsoft · 2025-10-26 19:51:27 · -2s (clock skew)
  3. BLAPR05CA0016.namprd05.prod.outlook.com→BL3PR16MB4393.namprd16.prod.outlook.com
    Microsoft · 2025-10-26 19:51:30 · +3s
  4. 🇺🇸 52.102.136.13 mail-westus2azhn15012013.outbound.protection.outlook.com→asterix.imp.ch
    ESMTPS · 2025-10-26 19:51:39 · +9s
  5. →IMP ImproWare AG mail infrastructure (2 hops)
    • 🇨🇭 157.161.12.4 asterix.imp.ch→asterix.imp.ch
      LMTP · 2025-10-26 19:51:50 · +11s
    • 🇨🇭 157.161.12.4 asterix.imp.ch→tragicomix.imp.ch
      LMTP · 2025-10-26 19:51:50
From
Free Oral-B Set – Claim Before It’s Gone <from4gzh9f2qnuv3hhfkzt4scl6xgm8v2fesz@humanecolorado1.onmicrosoft.com>
To
chiandetti@eblcom.ch
Date
26.10.2025 19:42:30 CET
Subject
Claim Your UnitedHealthcare Gift
SourceReport
Authentication
SPFfail
DKIM–
Spam score
SPF
SPF_HELO_NONESPF: HELO does not publish an SPF Record
SPF_PASSSPF: sender matches SPF record
HTML
HTML_FONT_LOW_CONTRASTHTML font color similar or identical to background
HTML_MESSAGEHTML included in message
MIME
MIME_HTML_ONLYMessage only has text/html MIME parts
MIME_HTML_ONLY_MULTIMultipart message only has text/html MIME parts
DNS lists
RCVD_IN_DNSWL_NONESender listed at https://www.dnswl.org/, no trust
RCVD_IN_MSPIKE_H2Average reputation (+2)
Other
FREEMAIL_FROMSender email is commonly abused enduser mail provider
LONGLN_LOW_CONTRASTExcessively long line + hidden text
LONG_INVISIBLE_TEXTLong block of hidden text - bayes poison?
MPART_ALT_DIFFHTML and text parts are different
3.2

Header

X-SPAM-SRCREPO
Return-Path<from4gzh9f2qnuv3hhfkzt4scl6xgm8v2fesz@humanecolorado1.onmicrosoft.com>
Delivered-Tochiandetti@eblcom.ch
Receivedfrom asterix.imp.ch ([157.161.12.4]) by tragicomix.imp.ch with LMTP id sIDIKcZt/mgYgyQA0cKaAg:P1 (envelope-from <from4gzh9f2qnuv3hhfkzt4scl6xgm8v2fesz@humanecolorado1.onmicrosoft.com>) for <chiandetti@eblcom.ch>; Sun, 26 Oct 2025 19:51:50 +0100
Receivedfrom asterix.imp.ch ([157.161.12.4]) by asterix.imp.ch with LMTP id sIDIKcZt/mgYgyQA0cKaAg (envelope-from <from4gzh9f2qnuv3hhfkzt4scl6xgm8v2fesz@humanecolorado1.onmicrosoft.com>) for <chiandetti@eblcom.ch>; Sun, 26 Oct 2025 19:51:50 +0100
Receivedfrom MW6PR02CU001.outbound.protection.outlook.com (mail-westus2azhn15012013.outbound.protection.outlook.com [52.102.136.13]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (P-384) server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by asterix.imp.ch (Postfix) with ESMTPS id AA817C03A3 for <chiandetti@eblcom.ch>; Sun, 26 Oct 2025 19:51:39 +0100 (CET)
ARC-Seali=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=OKrbJEgz/Xvx/30QVuFfK9vFrKGAWRU+nJ/lfIC0uLWQRZKIO/kbT42pUoD/XRcdu+M4+udSZdoLeeST6ZigEX/4o/tUAbows4QIP28x+vDgbV3wDOqH9q9XN4VCvWnFUX6aEkvWLW6wNOPvHei9jsh63okOMUnvWkdn6TapE38e6kBsfPFjaTLMfg8MWTCxbXIhrvdWrCd6tSobG3bqjBM1W1Rmn9ejvCMOZ7cLyxr5n7saXKzNqlxvJGycrB7BPDvLSARgko/odHX6wh7x/IMJmSTCCe/8XWdHEzMWR0luzToJ1QDwjB8o+E7BzjC+EzMwqKSk5DOHTu9IJKFdCA==
ARC-Message-Signaturei=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=icNdj3sTPU9aLNbCNOaHdTy5k5hTT0ytZ2Fo2yixVQo=; b=dN5fZ0fzrMunoCOLguGjggWlz8HAttcfY8lss1daL/IJ0QRkRLaBRUuDrz6J1VyvjaXcEuLkVPIW0VPcQ19WRaE7gwuNXK5hqocycTkRKR6TV4XEM2iHZus6R3BS6SpNBXmXkbI4HShANU0wOp9RzPO+VAM/2aWWrAAY2emJbEl27inXgxwDYgbYY/I5+gsss6kMS53KvulkIc2/844mgjd7Nc2ae+VU+phRk1+QkYP1H3saDbW5uAd/gSaxOKERZhY9AFOpPijCjVJZnkoUQretwdrbmvns03FquYw6YK+TL4krAFXBjRL+J3dIiBrdaWFrMuWZmzfQR/zsYLX4gA==
ARC-Authentication-Resultsi=1; mx.microsoft.com 1; spf=fail (sender ip is 78.138.51.242) smtp.rcpttodomain=eblcom.ch smtp.mailfrom=humanecolorado1.onmicrosoft.com; dmarc=none action=none header.from=humanecolorado1.onmicrosoft.com; dkim=none (message not signed); arc=none (0)
Receivedfrom BLAPR05CA0016.namprd05.prod.outlook.com (2603:10b6:208:36e::22) by BL3PR16MB4393.namprd16.prod.outlook.com (2603:10b6:208:338::5) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9253.17; Sun, 26 Oct 2025 18:51:30 +0000
Receivedfrom MN1PEPF0000ECDA.namprd02.prod.outlook.com (2603:10b6:208:36e:cafe::7e) by BLAPR05CA0016.outlook.office365.com (2603:10b6:208:36e::22) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.9275.12 via Frontend Transport; Sun, 26 Oct 2025 18:51:27 +0000
X-MS-Exchange-Authentication-Resultsspf=fail (sender IP is 78.138.51.242) smtp.mailfrom=humanecolorado1.onmicrosoft.com; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=humanecolorado1.onmicrosoft.com;
Received-SPFFail (protection.outlook.com: domain of humanecolorado1.onmicrosoft.com does not designate 78.138.51.242 as permitted sender) receiver=protection.outlook.com; client-ip=78.138.51.242; helo=humanecolorado1.onmicrosoft.com;
Receivedfrom humanecolorado1.onmicrosoft.com (78.138.51.242) by MN1PEPF0000ECDA.mail.protection.outlook.com (10.167.242.134) with Microsoft SMTP Server id 15.20.9275.10 via Frontend Transport; Sun, 26 Oct 2025 18:51:29 +0000
DateSun, 26 Oct 2025 19:42:30 +0100
FromFree Oral-B Set – Claim Before It’s Gone <from4gzh9f2qnuv3hhfkzt4scl6xgm8v2fesz@humanecolorado1.onmicrosoft.com>
Tochiandetti@eblcom.ch
SubjectClaim Your UnitedHealthcare Gift
Content-Typemultipart/alternative; boundary="_f3063eba-e75f-4721-9e6f-aeb2ac6dfde2_"
Precedencebulk
Message-ID<71f8711e-a739-48d7-ad51-1538a9ba122b@MN1PEPF0000ECDA.namprd02.prod.outlook.com>
X-EOPAttributedMessage0
X-MS-PublicTrafficTypeEmail
X-MS-TrafficTypeDiagnosticMN1PEPF0000ECDA:EE_|BL3PR16MB4393:EE_
MIME-Version1.0
X-MS-Office365-Filtering-Correlation-Id968d81b2-0207-4e49-25c4-08de14c0aca8
X-MS-Exchange-SenderADCheck1
X-MS-Exchange-AntiSpam-Relay0
X-Microsoft-AntispamBCL:0;ARA:13230040|34070700014|36860700013|61400799027|1032899013|82310400026|69100299015|4022899009|376014|2066899003|8096899003|13003099007|16130700020;
X-Microsoft-Antispam-Message-Info=?utf-8?B?UzhoenB4SDNlR0hVTUFyRmh3Unp4S28zZlJUVm9lNStvdHJUZHlCTEl4aVVL?= =?utf-8?B?bVBwbTFwY0l6YzVVRVVSN1YzU2lwcXhJTVU3TitIRURMRGNrQUlETFE5TWRn?= =?utf-8?B?MWM1T0laNHJuSDU0RG1xOUU1Z0V1UThTKzB4ME1mWTlRckhwQTZwRTlBb2Vs?= =?utf-8?B?dUpXOE1PSXg3YXVUa3ovSTd6YTRZMTVWTXVpMXdOQW5JSjZqWnFoMEZUZlVW?= =?utf-8?B?bm9SdTFYMS82SjI3d1M4UDlZZ2JFN3JtZFYxN2Nkc0RIMTNDejdlOXo2RDJw?= =?utf-8?B?SDBJZUc1dEJZRnhjcUlKOTViTGRScThvVUlGdGtSeXRwYWp0QTFqZzFqbnFK?= =?utf-8?B?REJpWW1NSkNkcis0aW5mei9xNXpFdDhnY0lZbGxWeStTN0xESEFYUnlUMHh6?= =?utf-8?B?WEI2V2E3NGY4VUtveWZWc1JlaGZRYWk0WkNRNXYyT0s5K0xlRzRxSDRvWDRJ?= =?utf-8?B?ZG95V25kK0paOE1FSnBQVnFjRnB4R1VSODJhNGI1WXpENlpXMGR1aVkwWTZF?= =?utf-8?B?Zjg2cmRBYUNXU0lJSEpvQVJYYk9pTnpZZXRtYU9sMVpSNGZpbytpa0hCS1M1?= =?utf-8?B?ZWlSWUhnRHArZ2YwMWwyYUQ2V1pPeWgzVnVLK2JKM21XYXZmNlcydVdKMi9m?= =?utf-8?B?NXNlNC94MTNqQ0M1eE85cEZwM2liQTE1QThjY0dYRElvWjV1MWN3K3h2THhi?= =?utf-8?B?UHpxbUJ4WWVzM3FoTlcxRlg2N0NPNnNqVGFJaDY5NkUwdE5ndmZ2NW1obi9U?= =?utf-8?B?TzNuVUFncDlzd1dOS1VLaGtNSFZjYWY5N0IwWEtEU1JLYWx2L1QyM2xHTWYz?= =?utf-8?B?aVI0Y3hsMTlRQThvTWtoZmpMai9vOWZBSFE5cEZ3R2RzVmhyT0RwVEhyMUEz?= =?utf-8?B?T3pHZ1ZoWU5YRS96T01lRHFkT0FqNnhwVkczT3cvaXhhUjFWQ3U1alVMZFY4?= =?utf-8?B?VkZlUmNWMjNFYk9wVXhTTDI2aUtYRE5Xby9SSXl1QjZBeGg1Vmp4SUd2Tkhx?= =?utf-8?B?UFhiTVFnczQycnZOQmIvNC8yNGtsMXc5NFdoTHBFWExCcjZPdG16TEp6bGpQ?= =?utf-8?B?cUlZTkJZczUwVWUxUDZFeGhoSko2Tmh1Sk9lbDZvYkJET1d1a2EwMU1aU0Ur?= =?utf-8?B?WnRWd0hzUGlVL3l5QUgxa05RTlVsY1RNT2hibHBOakJOMnNndUsxeGNQYkpS?= =?utf-8?B?U0RVOVhWMXIzOU53a2FYdi9ESVlZb2R2TXE4SWNXVnFKZlZIY3BlN2M4aDFj?= =?utf-8?B?QzAwdjBUOHhGQldkYXlEYzh4akFQWnZyVkxWcm1nSklHRXJSM0tUcmt6cmQ2?= =?utf-8?B?cTJYR2R3aTBCZEgwa1VMRmtuVzNUY3g1UG0xS2pQVXlJMEVtZDNXYVh1bUxk?= =?utf-8?B?ZDZaN3FHTmtSSExteWdqRk1FR2RxLzJ0Tkp5OHE4UUZIanY1RlJOUnFBdzJ2?= =?utf-8?B?SnlxVTQwekh1cEE2d3o1ckZ2MFJSMEV1N05MTFR5akpLZGZ3OVJOaVBvRmF3?= =?utf-8?B?eTIyemFhZGg0NkpNVkdka20yVHBRTDlsd2ErT2JaMnhzQ1hleFRSWEI1Qy92?= =?utf-8?B?dGFxQmlKa2hxV0dvT0VrUEl6dDlhcTlwWWZNVDJ6Qm1CQjlBTHlZdHYyNTB0?= =?utf-8?B?a0lJTkE5Y2lxQmo1bUZZY0hhSGdzWTVxYnF2YmxhN1YyTE51eGlvNjRGWkNw?= =?utf-8?B?S0xud3VVK1RLT0xud2xwWENmWFkxNjVtb0ViNTNkL0tnVUxLWm1uSUxueUIx?= =?utf-8?B?ZWhsMjltNXlOZW5sUmJ6c2RMS3FSNUdDamJvbEszZnlNajRwTzdmbEI3bWJZ?= =?utf-8?B?R1RzY2RSa2laRDhlWHU0WUhscG11cTNDTythUzB0alNzNmxnZzlEUVlhYVM1?= =?utf-8?B?djlySFJRT05kakZzZDh5ZXNMajUzOG5HRDdnQmhRL3RJTTJ5cnh1ZzRZN1ZE?= =?utf-8?B?U2R4THRpYzRqVkFDVHBnZ0RYTnh4UEY4TFlzQUNIaXdROFh3eVY4UmhGWnN1?= =?utf-8?B?L09QanNZanRzNVhscWZTQ0F6REdLSlFWUmEydzV6d29IMEFmd0lrNll0S1B2?= =?utf-8?B?NGNJeDF1MytLc1FUcHRnL2x1RkVvOHA2bmNuK0l1clEvMC9ud0Q3aEhqWkJQ?= =?utf-8?B?aCtKQ295YjdCdWJSSGdoOGprSnN0SGtYYkdMN3N4Rk5nR05IbFJFV3VUSkpv?= =?utf-8?B?Mzd4STYwb2xlU00vbENoU21hZE9aaTVZbnk1UXFob2ZJU2c0VWxGMjlmVGZR?= =?utf-8?B?VXRrMkRUSFRrd0tmVU00STNuU3I5TzM3VkROSWx3UGt3N0RENk1nSXkyeTJU?= =?utf-8?B?NG9OSEZEalA0bHZ1MVI5YzN4MHlyZ2x6bkJtQ1pqQjVyVXFuYVBSYmQzNXl5?= =?utf-8?B?c2ZkcHBNd2E3d25aanE4T0FvcFgvbDVlbHFlV0tXUWRUMGxCMEhwc0RUeGJa?= =?utf-8?B?TzU2TUV6OHR3b0lZY1hkWFFnMDQvQVFpKzQvVlJNTm1kRmdnaEVoSk41MjFn?= =?utf-8?B?czA1YUg5ZnFCQUZtSnFUbGFjQ2x4dVRuQjV6VTVuS2s0OHRWck5VWURJaVlz?= =?utf-8?B?M3J1NXpkM214LzVheTlKTGlkWnhSeEowQ3dPTEdPTng3cFBvTTd2bmpiM3p4?= =?utf-8?B?U3FhU0luc3RVMmoyUklmSVpnZ3puSzVXR3l4bXIzYVdVazdxUjZhYTM1eTJz?= =?utf-8?B?cUw1VTJ4TEFOS3JxWTdTNkFXdi81VE5Mb1c2Nzluelk0RWZXMm1rNk4xbjhO?= =?utf-8?B?SXcrT1ROUFdyN3dsZFo4dGxJNFhUUzRPazBIdGs4Z1paUVNyRDRuVUIwMDdn?= =?utf-8?B?em9udGlxQStPTjNjTk41ZWdzR0JWMjRIaldGTHYvQndsWUZYWXNEZ2RSblM0?= =?utf-8?B?c3crd095a0JiQ1MrY1cxdHRDNFJVaXhraUJuNnVHODRvbTc2M1VYeFNVTGRS?= =?utf-8?B?aWtEWDZXeUVNNktaTmUwMGhuZi9QczBvRjU5aVlGU0VBZEFQRW84dHV4UFNE?= =?utf-8?B?bHdJa1RsM044WWIzSUVwRnM0cGlMMXBVUURkbW8rd2NOZjFhMXIxQi91bmIv?= =?utf-8?B?L09FaXJIdVAvK0xJMXNMNHViYnYzSkc4eERjeEVGVnRTdEw0SkJYOWNxZ2tv?= =?utf-8?B?Q0dyQ1l4VmFmeHdZdEFKeVFVWVJCeCtpR01Ca0xGOU9tTy9IRUFSZHBwaXBn?= =?utf-8?Q?zTNQEomKw4k5stGpLZRQJ4ScAQwC?=
X-Forefront-Antispam-ReportCIP:78.138.51.242;CTRY:US;LANG:en;SCL:8;SRV:;IPV:CAL;SFV:SPM;H:humanecolorado1.onmicrosoft.com;PTR:InfoDomainNonexistent;CAT:OSPM;SFS:(13230040)(34070700014)(36860700013)(61400799027)(1032899013)(82310400026)(69100299015)(4022899009)(376014)(2066899003)(8096899003)(13003099007)(16130700020);DIR:OUT;SFP:1501;
X-OriginatorOrghumanecolorado1.onmicrosoft.com
X-MS-Exchange-CrossTenant-OriginalArrivalTime26 Oct 2025 18:51:29.5021 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id968d81b2-0207-4e49-25c4-08de14c0aca8
X-MS-Exchange-CrossTenant-Id55bd9dfe-b9d6-4a39-a79a-accdc0fd60d6
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIpTenantId=55bd9dfe-b9d6-4a39-a79a-accdc0fd60d6;Ip=[78.138.51.242];Helo=[humanecolorado1.onmicrosoft.com]
X-MS-Exchange-CrossTenant-AuthSourceMN1PEPF0000ECDA.namprd02.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAsAnonymous
X-MS-Exchange-CrossTenant-FromEntityHeaderHybridOnPrem
X-MS-Exchange-Transport-CrossTenantHeadersStampedBL3PR16MB4393
X-MS-Exchange-Organization-SCL3
X-Spam-Score3.18 FREEMAIL_FROM,HTML_FONT_LOW_CONTRAST,HTML_MESSAGE,LONGLN_LOW_CONTRAST,LONG_INVISIBLE_TEXT,MIME_HTML_ONLY,MIME_HTML_ONLY_MULTI,MPART_ALT_DIFF,RCVD_IN_DNSWL_NONE,RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_PASS
X-Scanned-ByMIMEDefang 2.84 on 127.0.1.1