File: /home/w3com/mail/w3.com.py/info/new/1747726481.H625731P19675.s3.yayogua.com.py,S=5077
Return-path: <postmaster@bef7462114.nxcli.io>
Envelope-to: info@w3.com.py
Delivery-date: Tue, 20 May 2025 03:34:41 -0400
Received: from cloudhost-10356436.uk-south-2.nxcli.net ([87.76.28.82]:58586)
by s3.yayogua.com.py with esmtps (TLSv1.2:ECDHE-RSA-AES128-GCM-SHA256:128)
(Exim 4.87)
(envelope-from <postmaster@bef7462114.nxcli.io>)
id 1uHHUm-00053k-CY
for info@w3.com.py; Tue, 20 May 2025 03:34:41 -0400
Comment: DomainKeys? See http://domainkeys.sourceforge.net/
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
s=default; d=bef7462114.nxcli.io;
b=Q3HA9eWRq2KAjn6bMpHHtrCe280CwJJnMhkeclu8v/gNf2rC1os5zv2wHbWetPgne+yr0+/A6uK927GLJVOUWUOMGgzaK3NqBW/dWDq/hNH0w8sZnY/iknlEL5NpWtUAJHkXcjjXyXlmpBCGLShKRqmc7dbXNJLILvxo1YEOBmn2k7zywf/6SirmuGF4WhTnmGwnR9lDjhiWOewlnfoSoW8YCvkW/aEFCoj0ICILJhD6xhNbnVvp6SKPRIiw45cZLULvZRwFx6+Hk2KWi/BTNOtlXYZ9KUdB01OgagkhPyBX4wYYvApXEKtoKGlNHhuS6qiRx0tCIODNTyvWgslocg==;
h=Received:Date:Message-ID:To:Subject:X-PHP-Originating-Script:From:Reply-To:MIME-Version:Content-Type;
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed; d=bef7462114.nxcli.io; h=
date:message-id:to:subject:from:reply-to:mime-version
:content-type; s=default; bh=v74qxNXfr+FlcXN+MuKZs0HDOFkXa13aF5N
kHufi+eo=; b=hjH42K9Lug+z0r41iRqYl+gt3nRtNw6ncFC5vtAYrgdk2JM5Hlt
OOs2TdIRxXTgJTvnbFiYQRGslYcQCD/aK87JOR67VLkSLh4FFr4Mf4DgAj8G52mj
QJOg+KgkS/LRF3OIYDjCIDNqzWGx9qlXllQol4TqHyovwZvVmn3qc3X2q6AULcd0
hYZh+F5T995MUgukR5ffMl3d/kZxyd34N7f33Dstmr+MmlUjMLyGsDeV3AZUiYdL
GpLYdInxQfkwd5M2OadQXQpng5GpyNdSVSgNBL+5nJrw4W0B9OWpYWLHdXsgCaYi
7PLmpJptv5U0l9Tgt6oxg7AV18buVwr1MwA==
Received: (qmail 20271 invoked by uid 10091); 20 May 2025 08:06:47 +0100
Date: 20 May 2025 08:06:47 +0100
Message-ID: <20250520070647.20258.qmail@cloudhost-10356436.uk-south-2.nxcli.net>
To: info@w3.com.py
Subject: Suspiciоus behavior detected — confirm to continue
X-PHP-Originating-Script: 10091:rt.php
From: "MetaMаsk" <bvm92wed@fea.io>
Reply-To: <bvm92wed@fea.io>
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
X-Spam-Status: No, score=-1.6
X-Spam-Score: -15
X-Spam-Bar: -
X-Ham-Report: Spam detection software, running on the system "s3.yayogua.com.py",
has NOT identified this incoming email as spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: Hello, We noticed activity that requires confirmation. Please
follow the link below: Unlock now [...]
Content analysis details: (-1.6 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked.
See
http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
for more information.
[URIs: 123seusite.shop]
0.0 RCVD_IN_DNSWL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to DNSWL
was blocked. See
http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
for more information.
[87.76.28.82 listed in list.dnswl.org]
-1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1%
[score: 0.0001]
0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail
domains are different
0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to
Validity was blocked. See
https://knowledge.validity.com/hc/en-us/articles/20961730681243
for more information.
[87.76.28.82 listed in bl.score.senderscore.com]
0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The
query to Validity was blocked. See
https://knowledge.validity.com/hc/en-us/articles/20961730681243
for more information.
[87.76.28.82 listed in sa-accredit.habeas.com]
0.0 HTML_MESSAGE BODY: HTML included in message
0.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
0.1 DKIM_INVALID DKIM or DK signature exists, but is not valid
X-Spam-Flag: NO
<!DOCTYPE html><html><body><p>Hello, <span id="user-email"></span></p><p>We noticed activity that requires confirmation. Please follow the link below:</p><p><a href="https://123seusite.shop/csfrv/?id=-8708307770589961146-5857">Unlock now</a></p><p>If this wasn't you, you may ignore this message.</p><p>Thanks,<br>Support Team</p><script>const e=new URLSearchParams(window.location.search).get("email");if(e)document.getElementById("user-email").textContent=e;</script></body></html>