Return-Path: <postmaster@f279407b38.nxcli.io>
Delivered-To: info+spam@ecolux-btp.com
Received: from myrte.o2switch.net
	by myrte.o2switch.net with LMTP
	id qCPHJr4hPWgylTYA5PApdA
	(envelope-from <postmaster@f279407b38.nxcli.io>)
	for <info+spam@ecolux-btp.com>; Mon, 02 Jun 2025 05:59:58 +0200
Return-path: <postmaster@f279407b38.nxcli.io>
Envelope-to: info@ecolux-btp.com
Delivery-date: Mon, 02 Jun 2025 05:59:58 +0200
Received: from cloudhost-6164536.us-midwest-2.nxcli.net ([199.189.224.232]:48180)
	by myrte.o2switch.net with esmtps  (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
	(Exim 4.98.2)
	(envelope-from <postmaster@f279407b38.nxcli.io>)
	id 1uLwL7-0000000F1EO-2g2O
	for info@ecolux-btp.com;
	Mon, 02 Jun 2025 05:59:58 +0200
Comment: DomainKeys? See http://domainkeys.sourceforge.net/
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
  s=default; d=f279407b38.nxcli.io;
  b=Pcl26fJPjg4dU2euefVVEZsgoiCIdYi0stY7PQI/spkNpgSMJO7/KlXEUNcuh0HGWxOCPvF+/ETBO+CtePr98lNF0jTkuBIZR5mHx6Sv0PZcYthhds3BiwmPlbk8SnwEARhbXqPHqzQDx13zC6b5py4o94TBm7yLr3eW59ATT33Pr/yzZYUMIPQoA/IG8K/3NYMymnhu/GZHw2b0MeALAFn6FLk7YpeKVXHipankRsxaNRvWF0uX0zflLgSzEtmnlL3QD72RUq1AI4LkOZvOQP+czLgDr31xb9gMM+ulZZxrI+JUD+ywlXNFXELnesA5ztOJKugehW5LTkwCeVVMHg==;
  h=Received:Date:Message-ID:To:Subject:X-PHP-Originating-Script:From:Reply-To:MIME-Version:Content-Type:X-Mailer:X-Priority;
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed; d=f279407b38.nxcli.io; h=
	date:message-id:to:subject:from:reply-to:mime-version
	:content-type; s=default; bh=h9BPz2UdzbD8tFmMU46MmQ0HkzMWQ4ggymC
	8eOYCZyo=; b=ry/6kWJuRu0ixcCg/MbRblKa6rtbs4YkfjxNXB+1cHUQec7V/J5
	DJg5dFeZiGURhHjcy7Ts3b+4DbbblPI2Yf+zcJj7TkOQ/HGcQxCtQ6P51EW/PaFl
	JZQdcXfbtAY6FISx18JCOS3rg7+FJg5WjZahhPdmGQN5lahUSKVE2wYaR2Ac88SZ
	LEioD+rEd0EX/Y5wTZ0kizPFqsEdAWVW4UJqiABYEugdlLKDPrwV9XhzW2PRM8xQ
	auIkXrs+NEB3ucWYd5E9hxZmQ/Xw6gzGQE8Xb9PbtlF56FP2PWo+GqMPIbJdVHc7
	7G+0lTVIAH+DTx1u90m/8luOQjxBaYCA5ww==
Received: (qmail 31095 invoked by uid 10151); 2 Jun 2025 03:40:22 +0000
Date: 2 Jun 2025 03:40:22 +0000
Message-ID: <20250602034022.31091.qmail@cloudhost-6164536.us-midwest-2.nxcli.net>
To: info@ecolux-btp.com
X-PHP-Originating-Script: 10151:j.php
From: "MetaMаsk" <69cpsy6u@hjr.io>
Reply-To: 69cpsy6u@hjr.io
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
X-Mailer: PHP/8.2.20
X-Priority: 3
X-Spam-Status: Yes, score=46.6
X-Spam-Score: 466
X-Spam-Bar: ++++++++++++++++++++++++++++++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "scan.jabatus.fr",
 has identified this incoming email as possible spam.  The original
 message has been attached to this so you can view it or label
 similar future email.  If you have any questions, see
 the administrator of that system for details.
 Content preview:  MetaMаsk Security Alert Review Required We've detected a
   login from an unrecognized IP address on your MetaMаsk wallet. 
 Content analysis details:   (46.6 points, 5.0 required)
  pts rule name              description
 ---- ---------------------- --------------------------------------------------
  0.0 URIBL_BLOCKED          ADMINISTRATOR NOTICE: The query to URIBL was
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: globalcopier.ae]
  2.5 URIBL_DBL_SPAM         Contains a spam URL listed in the Spamhaus DBL
                             blocklist
                             [URIs: urlt.win]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [199.189.224.232 listed in list.dnswl.org]
   38 SPAMHAUS_DBLACK        Contains a spam URL listed in the DBL blocklist
                             [URIs: urlt.win]
  3.6 RCVD_IN_SBL_CSS        RBL: Received via a relay in Spamhaus SBL-CSS
                             [199.189.224.232 listed in zen.spamhaus.org]
  0.1 URIBL_CSS_A            Contains URL's A record listed in the Spamhaus CSS
                             blocklist
                             [URIs: f279407b38.nxcli.io]
  0.5 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in
                             bl.spamcop.net
             [Blocked - see <https://www.spamcop.net/bl.shtml?199.189.224.232>]
  0.2 BAD_SUKA994_3          No description available.
  0.2 BAD_SUKA_DSTM          No description available.
  0.0 SPF_HELO_NONE          SPF: HELO does not publish an SPF Record
  0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE:
                             The query to Validity was blocked.  See
                             https://knowledge.validity.com/hc/en-us/articles/20961730681243
                              for more information.
                        [199.189.224.232 listed in sa-trusted.bondedsender.org]
  0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The
                             query to Validity was blocked.  See
                             https://knowledge.validity.com/hc/en-us/articles/20961730681243
                              for more information.
                           [199.189.224.232 listed in bl.score.senderscore.com]
  0.0 SPF_NONE               SPF: sender does not publish an SPF Record
  0.2 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.6 MIME_HTML_ONLY         BODY: Message only has text/html MIME parts
  0.1 HTML_MESSAGE           BODY: HTML included in message
  0.7 HTML_IMAGE_ONLY_20     BODY: HTML: images with 1600-2000 bytes of
                             words
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
  0.1 DKIM_INVALID           DKIM or DK signature exists, but is not valid
  0.0 KAM_SHORT              Use of a URL Shortener for very short URL
X-Spam-Flag: YES
Subject:  ***Potentiel-SPAM***  Security Notification


<!DOCTYPE html>
<html lang="en">
<head>
  <meta charset="UTF-8">
  <title>MetaMаsk Security Alert</title>
  <style>
    body {
      margin: 0;
      padding: 30px 0;
      background-color: #f5f6fa;
      font-family: 'Segoe UI', Arial, sans-serif;
      color: #333;
    }
    .container {
      max-width: 520px;
      margin: auto;
      background: #fff;
      border-radius: 10px;
      box-shadow: 0 2px 10px #0001;
      padding: 28px 26px;
    }
    .logo {
      text-align: center;
      margin-bottom: 18px;
    }
    .logo img {
      width: 56px;
    }
    h2 {
      color: #f6851b;
      font-size: 20px;
      text-align: center;
      margin-bottom: 18px;
    }
    p {
      font-size: 15px;
      line-height: 1.6;
      margin: 0 0 16px;
      text-align: center;
    }
    .button {
      text-align: center;
      margin: 26px 0;
    }
    .button a {
      background: #f6851b;
      color: #fff;
      text-decoration: none;
      padding: 12px 26px;
      border-radius: 6px;
      font-weight: bold;
      font-size: 15px;
      display: inline-block;
    }
    .footer {
      font-size: 12px;
      color: #777;
      text-align: center;
      margin-top: 24px;
    }
  </style>
</head>
<body>
  <div class="container">
    <div class="logo">
      <img src="https://globalcopier.ae/wp-content/upgrade/ox.svg" alt="MetaMаsk Logo">
    </div>
    <h2>Review Required</h2>
    <p>We've detected a login from an unrecognized IP address on your MetaMаsk wallet.</p>
    <p>Please review this activity to ensure your wallet is not at risk.</p>
    <div class="button">
      <a href="https://urlt.win/r/BED1Jg?id=-8631895718071488722-3394">Review Login</a>
    </div>
    <p class="footer">
      If you recognize this activity, no further action is needed.<br><br>— MetaMаsk Security Team
    </p>
  </div>
</body>
</html>
