Just received one and it looks like it was originated from our site cardacc.com
Content-Type: multipart/alternative; boundary="b1_408a5a6306323648dd94734e2285f4ac"
Mime-Version: 1.0
X-Get-Message-Sender-Via: viking.ica.net: authenticated_id: cardacc/only user confirmed/virtual account not confirmed
Dkim-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=almexltd.com; s=default; h=Content-Type:MIME-Version:Reply-To:Message-ID: From
ate:Subject:To:Sender:Cc:Content-Transfer-Encoding:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=lgYs4uzRsUv1qb7I0uVLNpl97PJBQyHFaaSMe34uR68
b=MWPR0vO2o3i47iOzy2MQslBbc7 vi/zwbSP2wglJ4oOsDyOe3ZSNLctY6oDqEtRE8MuDqidD0SaBWvj6 zkTVp3UzHE4vk2XESahj/Bub IkKIiE8/VvQlIbYRFmRaIKhWRNtbw22Ar7xGnotp59qT5vL2TLgBJQa871 YnmBfH4oN6cq8mB1Zh+ QTmVaCut/lXRHX9pv0E2X6XV0SDXgfki7HK988gZsS7ZfTq4t/MuqaL83NW9CNvGCVIpI5h3601qk 8bBEzhCoADm3xam0L5iFy0EapwpDJbwKitAOcCzmJn6m5mBxMU dncZ/q5XyorTYKp0eKU/h4raFpx qRVQrGcw=
X-Mailer: PHPMailer 5.2.22 (
https://github.com/PHPMailer/PHPMailer)
X-Source-Dir: cardacc.com:/public_html
X-Antiabuse: This header was added to track abuse, please include it with any abuse report
X-Antiabuse: Primary Hostname - viking.ica.net
X-Antiabuse: Original Domain - almexltd.com
X-Antiabuse: Originator/Caller UID/GID - [1034 494] / [47 12]
X-Antiabuse: Sender Address Domain - almexltd.com
X-Source:
X-Authenticated-Sender: viking.ica.net: cardacc
X-Php-Script:
www.cardacc.com/cart.php for 178.159.37.18
X-Php-Originating-Script: 1034:class.phpmailer.php
Received: from viking.ica.net ([209.151.129.171]) by mail7.ica.net (IceWarp 10.4.5) with ESMTP (SSL) id 201803142239423984 for <sales@almexltd.com>; Wed, 14 Mar 2018 22:39:42 -0400
Received: from cardacc by viking.ica.net with local (Exim 4.89_1) (envelope-from <sales@almexltd.com>) id 1ewIny-0007Xh-2F for
sales@almexltd.com; Wed, 14 Mar 2018 22:39:46 -0400
<408a5a6306323648dd94734e2285f4ac@www.cardacc.c om>
X-Source-Args: /usr/sbin/httpd -k start