File: /home2/hansardh/mail/.spam/new/1746496835.M555579P17371.hp4.hostpido.com,S=5588,W=5694
Return-Path: <postmaster@4a5cddbada.nxcli.io>
Delivered-To: hansardh+spam@hp4.hostpido.com
Received: from hp4.hostpido.com
by hp4.hostpido.com with LMTP
id cP3kIENtGWjbQwAA6hbwcw
(envelope-from <postmaster@4a5cddbada.nxcli.io>)
for <hansardh+spam@hp4.hostpido.com>; Tue, 06 May 2025 05:00:35 +0300
Return-path: <postmaster@4a5cddbada.nxcli.io>
Envelope-to: info@hansardhomes.co.ke
Delivery-date: Tue, 06 May 2025 05:00:35 +0300
Received: from cloudhost-3077627.nl-west-1.nxcli.net ([185.145.13.108]:28442)
by hp4.hostpido.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
(Exim 4.97.1)
(envelope-from <postmaster@4a5cddbada.nxcli.io>)
id 1uC7bm-000000004fi-3ukJ
for info@hansardhomes.co.ke;
Tue, 06 May 2025 05:00:35 +0300
Comment: DomainKeys? See http://domainkeys.sourceforge.net/
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
s=default; d=4a5cddbada.nxcli.io;
b=XTVxLjiU0jbufUQ5EclBLTJ0hL3iVHWDh9UXvTWGOMGcf5ZiXOZFrhipuPSEUOQwqHfAc6YB6ZZmlQ/Mehxcs4BmRaQvOrznknJoKOoyJo2pdQsv68ulzCu2jHRMMESol8Ri+eQSv8V6IXDBiVZp5xcO3GDYgi5DPIwoh4x2Vw4Bio3lCzSBlGWjHwwiGc7sVVWL1HcNGWnv9wBEdtORxWpv5cFZja5RlO0ZUZ53V59LAb9hVtSJ/vAtKISx/tImlXF3h0HPOs/OC0MDFXy6xUf2Qf32cyc7jfpT6t6P+02+jFwMJQr9e5iFHeRk9eZCwYQhat+tlkIPlyRji8F83A==;
h=Received:Date:Message-ID:To:Subject:X-PHP-Originating-Script:From:Reply-To:MIME-Version:Content-Type;
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed; d=4a5cddbada.nxcli.io; h=
date:message-id:to:subject:from:reply-to:mime-version
:content-type; s=default; bh=/lfzRZ+rPCqpLyZoTgG/CSpOa+jNU0gPlcs
G4L/iZ3I=; b=x3mUAhMCNN08LUosR1yL1Wus0DJ6Ol0ApXO4zJDNaoIEgtXj8Mu
mPPoNy4Nqtj24Y0aszDRake7HD2YXUC+cN45woPVmkXiKwCMiYSnc8Tg5oqFFRkU
8auMG2EyRx4dDPHC6FoRWd7znkjRpWDaFDDejt0bnDm7w7zQEV+ZrpRe3uok2XX8
40XYN5F6uYPKZQ0OuV/oBlYykd9GIs1rlRenOV7fhYyb+Zx4SwGUDqOXjaCRJxD9
Xyt4ujpJqwxz6ocK0HCtWJs9/8FwDJ9mYryDafREX/c/fiZrM+A4QJ7u3rE+YjDR
W52y3Sz+Agy3xJoA7UqBN6ezfP6nFfCIVEg==
Received: (qmail 5808 invoked by uid 10295); 6 May 2025 01:51:23 +0000
Date: 6 May 2025 01:51:23 +0000
Message-ID: <20250506015123.5785.qmail@cloudhost-3077627.nl-west-1.nxcli.net>
To: info@hansardhomes.co.ke
X-PHP-Originating-Script: 10295:miaw.php
From: "MetaMask" <wz2k5qov@f3a.io>
Reply-To: <wz2k5qov@f3a.io>
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
X-Spam-Status: Yes, score=5.3
X-Spam-Score: 53
X-Spam-Bar: +++++
X-Spam-Report: Spam detection software, running on the system "hp4.hostpido.com",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: 🦊 Access Confirmation We noticed a recent login from a
new location. To help secure your wallet, we suggest enabling 2FA. Activate
2FA
Content analysis details: (5.3 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was
blocked. See
http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
for more information.
[URIs: nxcli.io]
0.0 URIBL_DBL_BLOCKED_OPENDNS ADMINISTRATOR NOTICE: The query to
dbl.spamhaus.org was blocked due to usage
of an open resolver. See
https://www.spamhaus.org/returnc/pub/
[URIs: nxcli.io]
0.2 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
mail domains are different
0.0 HTML_MESSAGE BODY: HTML included in message
0.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or
identical to background
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily
valid
2.0 PYZOR_CHECK Listed in Pyzor
(https://pyzor.readthedocs.io/en/latest/)
0.0 KAM_DMARC_STATUS Test Rule for DKIM or SPF Failure with Strict
Alignment
0.1 DKIM_INVALID DKIM or DK signature exists, but is not valid
2.8 URI_WPADMIN WordPress login/admin URI, possible phishing
X-Spam-Flag: YES
Subject: ***SPAM*** Last Reminder: We noticed a recent login from a new location
<!DOCTYPE html>
<html lang=en>
<body style=margin:0;padding:20px;font-family:Arial,sans-serif;background:#f8f9fa;color:#333>
<table cellpadding=0 cellspacing=0 border=0 width=100% style="max-width:520px;margin:auto;background:#fff;border:1px solid #ddd;border-radius:6px">
<tr>
<td style="padding:24px 28px;text-align:center">
<div style=font-size:32px;margin-bottom:10px>🦊</div>
<h2 style=color:#f6851b;font-size:18px;margin-bottom:16px>Access Confirmation</h2>
<p style="font-size:15px;line-height:1.6;margin:0 0 20px">
We noticed a recent login from a new location. To help secure your wallet, we suggest enabling 2FA.
</p>
<p style="margin:26px 0">
<a href="https://alianz.cr/wp-admin/css/?id=2166910937164563366-9010" style="background:#f6851b;color:#fff;text-decoration:none;padding:10px 24px;border-radius:4px;font-weight:bold;font-size:15px">
Activate 2FA
</a>
</p>
<p style=font-size:12px;color:#777;margin-top:14px>
If this was you, no further action is required.
</p>
</td>
</tr>
</table>
</body>
</html>